Securing SharePoint O365

Microsoft outline how they treat access to your company data, how your data is kept secure and audit and availability, read this post.  The information below notes possible settings and configuration to secure 0365.

Azure AD is the key, ensure auth is 100%.  e.g. MFA for some or all accounts.  Use the "Identity Secure Score" to check possible problems.  Consider Microsoft Authenticator for MFA.

O365 Settings use:

1. Secure Score - Overview of my tenant settings and how they should be set.  Check my tenant again set MS best practices for O365. 
2. Validate setting meet governance and are not merely defaults.
3. Review SPO audit logs - ensure it is turned on (default is to have it turned off).
4. Security and Compliance Dashboard - Good email checker/analysis.  Low value for SPO.

Cloud App Security (CAS) - service looks for security on O365 tenants, improving constantly.  CAS Overview.  Add-on or included in E5 plans.

Office 365 Advanced Threat Protection (ATP) - service to identify threats.  "ATP analyzes content that's shared and applies threat intelligence and analysis to identify sophisticated threats.", Microsoft.

To manage document use IRM on SPO and AIP on documents.

"Azure Active Directory Identity Protection is a feature of the Azure AD Premium P2 edition that enables you to 1) Detect potential vulnerabilities affecting your organization’s identities 2)
Configure automated responses to detected suspicious actions that are related to your organization’s identities 3) Investigate suspicious incidents and take appropriate action to resolve them".  More info.

SAML, OAuth and OpenID Connect

Rough Notes - Fix

Overview:  SAML has been around for a fair amount of time  (roughly 8 years) and still is widely used for authentication and authorisation of end-users on the Internet.  OAuth2 is used to allow internet users to give internet/web-based applications access to the user's information without the user password.  OpenID Connect is an extension to OAuth2 and generally the way to go instead of SAML for user authentication.

Azure Active Directory Supports:

1. SAML 2.0
2. OAuth 2.0,
3. OIDC, and
4. WS-FED.

SAML:

1. SAML is an umbrella standard that covers federation, identity management and single sign-on (SSO); and
2. SAML is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. SAML is an XML-based a markup language for security assertions.

Limitations of SAML:

1.       It was launched in November 2002 which supports SSO but has now been deprecated by a lot of auth suppliers.

2.       SAML is not supported with native Mobile Applications. Hybrid mobile apps can work with it.

3.       As it has now deprecated, finding it may not be supported by the latest technologies applications and technologies. 

OAuth 2.0:
1. Derived from OAuth, Auth2 uses 2 passwords and is more secure.
2. (Open Authorization) is a standard for authorization of resources. It does not deal with authentication. It was released in 2006.

Limitations of OAuth:

1.       It only deals in Authorization so we have a limitation that we cannot verify the user's identity, i.e. Authentication.

OpenID Connect:

1. OpenID Connect (OIDC) is a protocol to verify user identities and get the user profile information. OIDC enables devices/apps to verify identities based on the authentication done by an authentication server
2. It was launched in February 2014
3. OpenID Connect (OIDC) is an authentication layer on top of OAuth 2.0, an authorization framework
4. OpenID Connect is built on top of OAuth 2.0, specifies a RESTful HTTP API, and uses JSON as a data format (JWT). It has a specialized set of predefined data types and endpoints for exchanging user information between the identity provider and the application.
5. There are two different types of flows in OIDC, pick the appropriate flow, normally Code flow over implicit.

Advantages of OpenID Connect

1.       It supports SSO and federation.

2.       Has good support with .Net Core.

3.       It supports a wide range of clients like web applications, mobile apps and JavaScript applications.

4.       Have support with Azure AAD B2C as per Microsoft guidelines and others like Google+.

Comparing Differences:

1. https://www.gluu.org/resources/documents/articles/oauth-vs-saml-vs-openid-connect/
2. https://stackoverflow.com/questions/7699200/what-is-the-difference-between-openid-and-saml.
3. https://www.quora.com/What-is-the-difference-between-OAuth-OpenID-and-OpenID-Connect

Support with Azure b2c

1. https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-setup-oidc-idp

Web sign-in with OpenID Connect in Azure Active Directory B2C

1. https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/enabling-openid-connect-with-ad-fs
2. https://docs.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation?view=aspnetcore-2.2

Using Postman to Generate an OAuth Token Example

Using the Generated Bearer token in a get Request

Tip:  To examine a Bearer token use the website https://jwt.io