DOCSEARCHbyAlgolia
Submit Docs

Golden Master Documentation

website·Indexed 31 days ago

https://goldenmaster.cloud

Configuration guides and policy documentation for Microsoft Entra and Microsoft Intune, covering authentication methods, group configurations, conditional access, and Windows security baselines including Google Chrome and OneDrive settings.

Tokens
80.1K
Snippets
217
Records
564
Agent score
52%

What's inside Golden Master

  1. Overview of Entra ID Authentication Methods Policy

    The Authentication Methods policy acts as the central authority for what constitutes a valid authentication factor in Entra ID. It defines the available methods that Conditional Access (CA) policies, Identity Protection, and Self-Service Password Reset (SSPR) rely on. For example, if a Conditional Access rule requires 'Phishing-Resistant MFA', the Authentication Methods policy must have FIDO2 or Passkeys enabled for that requirement to be satisfied.

  2. Overview of Entra ID Authentication Strengths

    Authentication Strengths are named bundles of acceptable authentication methods. They allow Conditional Access (CA) policies to specify exactly which 'flavor' of MFA is required for a sign-in. By referencing a Strength instead of a generic 'require MFA' checkbox, administrators can centrally define security bars (like 'Phishing-Resistant') and update them across all referencing CA policies simultaneously.

  3. Overview of CCScript-Windows-Detect-RMM.ps1

    CCScript-Windows-Detect-RMM.ps1 is a Custom Compliance Detection Script for Microsoft Intune. It determines if a business-critical RMM agent is both installed ('present') and currently running ('active'). If either condition is false, the device can be marked as non-compliant in Intune. The script supports auto-detection of multiple RMM platforms (NinjaOne, Datto RMM, TacticalRMM, ConnectWise Automate, N-able, Atera, ManageEngine Endpoint Central, Pulseway, Splashtop, and TeamViewer) using process, service, file path, registry, and version detection methods.

  4. Overview of Windows Update for Business (WUfB) Reports

    Windows Update for Business (WUfB) Reports is an Azure-based reporting surface that provides visibility into Update Ring policies. While Update Rings manage the deployment of updates, WUfB Reports allows administrators to monitor the actual state of those updates via Azure Log Analytics. Key insights provided include update compliance per ring, time-to-install distribution, driver installation state, failures/rollbacks with error codes, and active alerts for failed updates or low compliance thresholds.

  5. Overview of Entra ID Sign-in Risk Policies

    Entra Identity Protection monitors sign-ins in real time for indicators of compromise such as atypical travel, anonymous IPs, token replay, and leaked credentials. Each sign-in is assigned a risk score: None, Low, Medium, or High. While Entra ID detects these risks, a Sign-in Risk Policy (implemented via Conditional Access) is required to automate the response—such as blocking access or requiring MFA—otherwise, the sign-in may succeed despite being flagged as high risk.

  6. Overview of Win+Leave for automatic Windows locking

    Win+Leave is a PowerShell-based monitor that automatically locks a Windows workstation when a physical security key (such as a YubiKey) is removed from the laptop. It is designed as an MSP-friendly alternative to hardware-specific solutions like BusKill, allowing for fleet-wide deployment via Intune without requiring a cloud service or subscription.

    How it works:

    • Armed: When the key is inserted, the monitor is armed.
    • Locked: When the key is pulled out, Windows locks immediately.
    • Re-armed: When the key is inserted again, the monitor returns to the armed state.

    Key Safety Features:

    • Disarm on Lock: Once a lock is triggered, the switch disarms. It only re-arms when a working key is re-inserted, preventing users from being locked out if their key is broken.
    • Anti-Flapping: If a faulty key causes repeated locks, the tool pauses for 15 minutes and notifies the user.

  7. Overview of Microsoft Entra ID management capabilities

    The Entra documentation provides configurations for managing identity and access within Microsoft Entra ID, specifically focusing on three core areas: Conditional Access Policies for resource access control, Named Locations for defining network trust boundaries, and Security Groups for targeting users and devices within policies.

  8. Overview of Intune Device Management for MSPs

    Intune is used to configure devices, ensure compliance, and maintain security baselines across multiple client tenants. For Managed Service Providers (MSPs), a standardized Intune blueprint prevents configuration drift and allows for consistent security and application settings across all endpoints.

  9. Understand the difference between Sign-in Risk and User Risk policies

    In Entra Identity Protection, there are two distinct risk-based policies:

    1. Sign-in Risk: Evaluates the risk score for a specific, real-time sign-in event.
    2. User Risk: Evaluates the risk score for the user account based on aggregated patterns over time.

    Both policies are recommended for deployment. When upgrading a tenant from P1 to P2, the Sign-in Risk policy should be deployed first to provide immediate protection against real-time attacks.

  10. Understand the purpose of the Entra ID User Risk Policy

    The User Risk Policy reacts to a pattern of evidence aggregated over time regarding a user account, rather than a single sign-in event. It is designed for scenarios where credentials are no longer trustworthy. High user risk is triggered by:

    • Leaked credentials found in public dumps.
    • Azure AD threat intelligence correlating the account with known-bad activity.
    • Anomalous user activity detected across multiple sign-ins.
    • Accumulated sign-in risk events over time.

    Unlike the Sign-in Risk Policy (which challenges a specific sign-in), the User Risk Policy focuses on the account's overall integrity and forces a password rotation to secure the account.

  11. Enable Config Refresh to prevent Windows policy drift

    Config Refresh ensures that MDM policies are re-applied every 30 minutes rather than waiting for the standard 8-hour Intune check-in. This prevents attackers or malware from permanently disabling security settings (like BitLocker) via registry hacks, as the system will automatically revert the setting to the managed state on a frequent schedule.

    Scope and Requirements:

    • Platform: Windows 11 22H2 or later.
    • License: Intune (included in Business Premium).
    • Coverage: Affects device restrictions, endpoint security, configuration profiles, and administrative templates. It does NOT affect apps, scripts, or certificates.

  12. Manage the Windows Update Fast (Early Access) canary cohort

    The 'Fast (Early Access)' group serves as the canary cohort for Windows Updates. Devices in this group receive feature and quality updates with zero deferral (day one release) to identify potential regressions before they impact the wider production fleet. This group is the exclusive attachment point for the 'UR – Fast (Early Access)' update ring.