Graph Insights Adjustments

Microsoft Viva takes over the functionality of the My Analytics and Workplace Analytics features step by step. And there is also a lot going on in the backend. The MeetingInsights and ItemInsights endpoints have been customizable for some time and now the PeopleInsights endpoint can also be configured. This affects the following areas:

• Profile Cards
• User Profile in Delve
• Listing relevant people / working with overview

I have already posted about the options to customize MeetingInsights and ItemInsights in the article "My Analytics, Workplace Analytics & Delve - or from the backend perspective Office Graph & Microsoft Graph".

Customize Insights

In general, the ItemInsights as well as the PeopleInsights can now be customized. The respective endpoint can be completely disabled or enabled / disabled for an Azure-AD Group. The third category, MeetingInsights, can only be globally enabled or disabled.

Details on ItemInsights and MeetingInsights: Customizing item insights privacy in Microsoft Graph

Customize PeopleInsights

PeopleInsights show relationships between people. This evaluates public signals such as joint Microsoft 365 Groups / Teams or shared Exchange distribution lists. This data is displayed in Delve and the profile cards in Microsoft 365 and can be queried via the API:

By default, this feature is enabled in a Microsoft 365 tenant. The following options are available for customization:

• Disable PeopleInsights for all users:

PATCH, beta:

{

  "isEnabledInOrganization": false

}

• Disable PeopleInsights for an Azure AD Group by additionally using the disabledForGroup paramter: 

PATCH, beta:

{

  "isEnabledInOrganization": false,

  "disabledForGroup": "f742839d-2321479-4de9-9616-e61877675c88c"

}

 To do this, for example, with Microsoft Graph Explorer, the following steps are performed:

• Open Graph Explorer and log in: https://developer.microsoft.com/en-us/graph/graph-explorer 
• GET, beta: https://graph.microsoft.com/beta/organization returns the OrganizationId that is needed in the next step:

• Get the current settings:

GET, beta: https://graph.microsoft.com/beta/organization/{organizationId}/settings/peopleInsights

• Customize the settings as needed:

PATCH, beta:

{

  "isEnabledInOrganization": false,

  "disabledForGroup": "f953948d-3423-4ac7-9616-d6187975c00c"

}

 

Effect: No more users are displayed in the "works with" section:

Important:

• The settings for PeopleInsights are currently only available in BETA.
• The update process does not check if an Azure AD Group exists. If the Group does not exist, no changes will be made for any user.
• It can take up to 24 hours for insightsSettings adjustments to take effect, or longer in the BETA version.

 

Cross-tenant access settings in Azure AD

Using Azure AD to provide access to resources in another tenant is not new. The Azure B2C and B2B feature have been available for several years. Now Microsoft has released the Cross-Tenant Access Settings feature as Preview. This allows general settings and settings per tenant, which is accessed as a guest user or from which guests access your own environment:

In addition, there is the option to accept the multifactor authentication that may already have been performed when logging on to the other Azure AD. Another option relates to the status of the device used, which can then be verified in a conditional access policy, for example.  Both the "Compliant Device" status and the "Hybrid Azure AD Joined" status can be trusted:

Overview Cross-tenant access with Azure AD External Identities

Using Cross-tenant access settings you can set default settings for your environment as well as settings per tenant from which accesses are made. So if you work with partners or selected customers on a regular basis, you can configure explicit rules for B2B collaboration - External users and groups, B2B - collaboration Applications and Trust settings for inbound and outbound traffic:

The following applies:

• The default settings apply to all external Azure AD's that are not listed in the Organizational Setting tab. These default settings can be changed, but not deleted.
• For access that is not authenticated via an Azure AD, the settings under: Edit or view collaboration restrictions applys

Configure cross-tenant access settings

The default settings for inbound and outbound traffic can be set to B2B collaboration - External users and groups, B2B - collaboration Applications and Trust settings. These values then apply to all tenants that are not explicitly registered:

On the Organizational Setting tab, explicit environments can be added via Add Organization:

These can then either also inherit the default settings, or get explicit settings:

The following settings can be configured for each tenant: 

• Select explicit external users and groups:

• Select applications:

• Settings for MFA and device

Source and more details: Configure cross-tenant access settings for B2B collaboration

Reporitng

Reports on access from other tenants can be created both via PowerShell and via the "Monitoring" tab in Azure AD.

Example via PowerShell for cross-tenant sign-in activity:

• Get-MSIDCrossTenantAccessActivity -SummaryStats -ResolveTenantId

Example via PowerShell for the sign-in logs:

Get-MgAuditLogSignIn ` 

-Filter “ResourceTenantID ne ‘your tenant id’” ` 

-all:$True| ` 

group ResourceTenantId,AppDisplayName,UserPrincipalName| ` 

select count, @{n=’Ext TenantID/App User Pair’;e={$_.name}}]

Source and more details:  Identify inbound and outbound sign-ins

Cross-tenant access activity workbook:

This workbook is available in the Azure AD under "Monitoring" and provides reports that can be filtered by the following values:

• Time range (up to 90 days)
• External tenant ID
• User principal name
• Application
• Status of the sign-in (success or failure)

Restrict Microsoft Teams Copy & Paste

The need to restrict the copy & paste feature in Teams can have different reasons.
For example, it can prevent users from copying content from Teams chats and posting it in other apps. In general, it is important to consider whether these restrictions apply to the web version of Microsoft Teams or to the Teams client/app. Both can be restricted, but different solutions are used in each case:

A common scenario, for example, is to restrict the copy & paste feature for guest users. This can also increase security on unmanaged devices, for example in the case of guest users or a bring-your-own-device strategy.

To implement this scenario for browser access, a Conditional Access policy is created that only affects guest users/selected users or groups and in which Azure AD joined devices can be excluded.

If the Teams Client / the Teams App is used for access, a App Protection Policy must be used in Endpoint Manager. This policy can then be restricted to "unmanaged" devices, for example.

Restrict copy & paste when accessing via the browser

When accessing via the browser, the request is redirected from a conditional access policy via Defender for Cloud Apps, with the "Use Conditional Access App Control" setting:

The conditional access rule can be restricted to guests or specific groups from Azure AD, for example:

A rule must then be created in Defender for Cloud Apps that prevents the copy & paste capability:

As the screenshot shows, the following other capabilities can also be restricted:

• Print
• Send item
• Send Teams message

In the "Session control type" section of the policy, you can see that uploads or downloads can also be restricted in this way. A separate policy must then be created for this, since the filter in the "Session control type" section only allows a single filter.

The user now receives the following notification when trying to copy data from a Teams chat:

Restrict copy & paste when accessing via Teams client / Teams app

App Protection rules are used when accessing via the client / app. This is a feature in Microsoft Endpoint Manger. For the scenario of restricting access from unmanaged devices, the "unmanaged" option is selected for the Device Type in the policy. In the "Apps" section of the policy, the applications that are affected by the policy are defined. As the screenshot shows, the same policy can also cover additional apps, such as Microsoft Planner:

In the section "Data protection" the setting "Restrict cut, copy, and paste between other apps" is available:

The user will now see this message when trying to copy data from a Teams chat and post it in WhatsApp, for example:

The following additional settings can be configured in the App Protection Policy:

• Backup org data to Android backup services
• Send org data to other apps
• Receive data from other apps
• Screen capture
• Printing org data
• Restrict web content transfer with other apps