{"id":7915,"date":"2024-08-28T09:01:17","date_gmt":"2024-08-28T00:01:17","guid":{"rendered":"https:\/\/m365jp.net\/?p=7915"},"modified":"2024-08-28T09:03:10","modified_gmt":"2024-08-28T00:03:10","slug":"mc875063-microsoft-defender-for-identity-new-recommendations-for-microsoft-secure-score","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2024-08-28-mc875063-microsoft-defender-for-identity-new-recommendations-for-microsoft-secure-score","title":{"rendered":"MC875063 | Microsoft Defender for Identity: New recommendations for Microsoft Secure Score"},"content":{"rendered":"<div class=\"postie-post\">\n<div>\n<hr>\n<table id=\"section\">\n<tbody>\n<tr>\n<th width=\"95%\">MC875063 | Microsoft Defender for Identity: New recommendations for Microsoft Secure Score<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<table id=\"data\">\n<tbody>\n<tr>\n<th>Classification<\/th>\n<td>stayInformed<\/td>\n<\/tr>\n<tr>\n<th>Last Updated<\/th>\n<td>08\/27\/2024 23:08:04<\/td>\n<\/tr>\n<tr>\n<th>Start Time<\/th>\n<td>08\/27\/2024 23:07:51<\/td>\n<\/tr>\n<tr>\n<th>End Time<\/th>\n<td>12\/27\/2024 08:00:00<\/td>\n<\/tr>\n<tr>\n<th>Message Content<\/th>\n<td>\n<p>Coming soon for Microsoft Defender XDR | Microsoft Defender for Identity: We\u2019re adding to Microsoft Secure Score improvement actions to ensure a more accurate representation of security posture. We will update your score automatically.  <\/p>\n<p>[When this will happen:]  <\/p>\n<p>Public Preview: We will begin rolling out mid-September 2024 and expect to complete by late September 2024.  <\/p>\n<p>General Availability (Worldwide, GCC, GCC High, DoD, USSec, USNat): We will begin rolling out mid-September 2024 and expect to complete by mid-October 2024.  <\/p>\n<p>[How this will affect your organization:]  <\/p>\n<p>After this rollout, the Defender XDR portal will include these new Microsoft Defender for Identity recommendations as Microsoft Secure Score improvement actions:  <\/p>\n<ul>\n<li>Accounts with non-default Primary Group ID  <\/li>\n<li>Domain Controllers with computer account password unchanged for more than 45 days  <\/li>\n<li>GPO assigns unprivileged identities to local groups with elevated privileges  <\/li>\n<li>GPO can be modified by unprivileged accounts  <\/li>\n<li>GPO contains passwords Group Policy Preferences files  <\/li>\n<li>Built-in Active Directory Guest account is enabled  <\/li>\n<li>Unsafe permissions on the DnsAdmins group  <\/li>\n<li>Ensure that all privileged accounts have the configuration flag &#8220;this account is sensitive and cannot be delegated&#8221;  <\/li>\n<li>Change password of krbtgt account  <\/li>\n<li>Change password of built-in domain Administrator account  <\/li>\n<\/ul>\n<p>Additionally, we are updating the existing recommendation of &#8220;Modify unsecure Kerberos delegations to prevent impersonation&#8221; to include indication of Kerberos Constrained Delegation with Protocol Transition to a privileged service.  <\/p>\n<p>These new identity recommendations are new security posture reports related to Active Directory and Group policy objects and will be available by default to customers who have installed a Defender for Identity sensor.  <\/p>\n<p>These recommendations are on by default.  <\/p>\n<p>[What you need to do to prepare:]  <\/p>\n<p>We recommend reviewing the improvement actions listed in Microsoft Secure Score. We will continue to add suggested security improvement actions on an ongoing basis.  <\/p>\n<p>Learn more: <a href=\"https:\/\/learn.microsoft.com\/defender-for-identity\/security-assessment\" target=\"_blank\" rel=\"noopener\">  Security posture assessments &#8211; Microsoft Defender for Identity | Microsoft Learn<\/a>&nbsp;(article will be updated before rollout begins)<\/p>\n<p>This rollout will happen automatically by the specified date with no admin action required before the rollout. You may want to notify your admins about this change and update any relevant documentation.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<th>Machine Translation<\/th>\n<td>\n<p>Microsoft Defender XDR \u306e\u8fd1\u65e5\u516c\u958b\u4e88\u5b9a |Microsoft Defender for Identity: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f53\u5236\u3092\u3088\u308a\u6b63\u78ba\u306b\u8868\u73fe\u3059\u308b\u305f\u3081\u306b\u3001Microsoft \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30b9\u30b3\u30a2\u306e\u6539\u5584\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u8ffd\u52a0\u3057\u3066\u3044\u307e\u3059\u3002\u30b9\u30b3\u30a2\u306f\u81ea\u52d5\u7684\u306b\u66f4\u65b0\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>[\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/p>\n<p>\u30d1\u30d6\u30ea\u30c3\u30af \u30d7\u30ec\u30d3\u30e5\u30fc: 2024 \u5e74 9 \u6708\u4e2d\u65ec\u306b\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3092\u958b\u59cb\u3057\u30012024 \u5e74 9 \u6708\u4e0b\u65ec\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n<p>\u4e00\u822c\u63d0\u4f9b (\u5168\u4e16\u754c\u3001GCC\u3001GCC High\u3001DoD\u3001USSec\u3001USNat): 2024 \u5e74 9 \u6708\u4e2d\u65ec\u306b\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3092\u958b\u59cb\u3057\u30012024 \u5e74 10 \u6708\u4e2d\u65ec\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n<p>[\u3053\u308c\u304c\u3042\u306a\u305f\u306e\u7d44\u7e54\u306b\u3069\u306e\u3088\u3046\u306b\u5f71\u97ff\u3057\u307e\u3059\u304b:]<\/p>\n<p>\u3053\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u5f8c\u3001Defender XDR \u30dd\u30fc\u30bf\u30eb\u306b\u306f\u3001Microsoft Secure Score \u6539\u5584\u30a2\u30af\u30b7\u30e7\u30f3\u3068\u3057\u3066\u3001\u6b21\u306e\u65b0\u3057\u3044 Microsoft Defender for Identity \u306e\u63a8\u5968\u4e8b\u9805\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u30c7\u30d5\u30a9\u30eb\u30c8\u4ee5\u5916\u306e\u30d7\u30e9\u30a4\u30de\u30ea\u30b0\u30eb\u30fc\u30d7ID\u3092\u6301\u3064\u30a2\u30ab\u30a6\u30f3\u30c8<\/li>\n<li>\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u30fc \u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u304c 45 \u65e5\u4ee5\u4e0a\u5909\u66f4\u3055\u308c\u3066\u3044\u306a\u3044\u30c9\u30e1\u30a4\u30f3 \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc<\/li>\n<li>GPO \u306f\u3001\u7279\u6a29\u306e\u306a\u3044 ID \u3092\u6607\u683c\u3055\u308c\u305f\u7279\u6a29\u3092\u6301\u3064\u30ed\u30fc\u30ab\u30eb \u30b0\u30eb\u30fc\u30d7\u306b\u5272\u308a\u5f53\u3066\u307e\u3059<\/li>\n<li>GPO \u306f\u3001\u7279\u6a29\u306e\u306a\u3044\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u3082\u5909\u66f4\u3067\u304d\u307e\u3059<\/li>\n<li>GPO \u306b\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3001\u30b0\u30eb\u30fc\u30d7 \u30dd\u30ea\u30b7\u30fc\u3001\u57fa\u672c\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059<\/li>\n<li>\u7d44\u307f\u8fbc\u307f\u306e Active Directory \u30b2\u30b9\u30c8 \u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b<\/li>\n<li>DnsAdmins \u30b0\u30eb\u30fc\u30d7\u306b\u5bfe\u3059\u308b\u5b89\u5168\u3067\u306a\u3044\u30a2\u30af\u30bb\u30b9\u8a31\u53ef<\/li>\n<li>\u3059\u3079\u3066\u306e\u7279\u6a29\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u69cb\u6210\u30d5\u30e9\u30b0 &#8220;\u3053\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u306f\u6a5f\u5bc6\u6027\u304c\u9ad8\u304f\u3001\u59d4\u4efb\u3067\u304d\u307e\u305b\u3093&#8221; \u304c\u3042\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059<\/li>\n<li>krbtgt\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5909\u66f4\u3059\u308b<\/li>\n<li>\u30d3\u30eb\u30c8\u30a4\u30f3\u30c9\u30e1\u30a4\u30f3\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5909\u66f4\u3059\u308b<\/li>\n<\/ul>\n<p>\u3055\u3089\u306b\u3001\u65e2\u5b58\u306e\u63a8\u5968\u4e8b\u9805\u3067\u3042\u308b\u300c\u507d\u88c5\u3092\u9632\u3050\u305f\u3081\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3067\u4fdd\u8b77\u3055\u308c\u3066\u3044\u306a\u3044 Kerberos \u59d4\u4efb\u3092\u5909\u66f4\u3059\u308b\u300d\u3092\u66f4\u65b0\u3057\u3001\u7279\u6a29\u30b5\u30fc\u30d3\u30b9\u3078\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u79fb\u884c\u3092\u4f34\u3046 Kerberos \u5236\u7d04\u4ed8\u304d\u59d4\u4efb\u306e\u8868\u793a\u3092\u542b\u3081\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u308c\u3089\u306e\u65b0\u3057\u3044 ID \u306b\u95a2\u3059\u308b\u63a8\u5968\u4e8b\u9805\u306f\u3001Active Directory \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3068\u30b0\u30eb\u30fc\u30d7 \u30dd\u30ea\u30b7\u30fc \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u95a2\u9023\u3059\u308b\u65b0\u3057\u3044\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f53\u5236\u30ec\u30dd\u30fc\u30c8\u3067\u3042\u308a\u3001Defender for Identity \u30bb\u30f3\u30b5\u30fc\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305f\u304a\u5ba2\u69d8\u304c\u65e2\u5b9a\u3067\u4f7f\u7528\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u3053\u308c\u3089\u306e\u63a8\u5968\u4e8b\u9805\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u30aa\u30f3\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3010\u6e96\u5099\u306b\u5fc5\u8981\u306a\u3053\u3068\u3011<\/p>\n<p>Microsoft Secure Score \u306b\u8a18\u8f09\u3055\u308c\u3066\u3044\u308b\u6539\u5584\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002\u63a8\u5968\u3055\u308c\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6539\u5584\u30a2\u30af\u30b7\u30e7\u30f3\u306f\u3001\u7d99\u7d9a\u7684\u306b\u8ffd\u52a0\u3055\u308c\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p>\u8a73\u7d30\u60c5\u5831: <a href=\"https:\/\/learn.microsoft.com\/defender-for-identity\/security-assessment\" target=\"_blank\" rel=\"noopener\">  \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f53\u5236\u306e\u8a55\u4fa1 &#8211; Microsoft Defender for Identity |Microsoft Learn<\/a>&nbsp;(\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u958b\u59cb\u524d\u306b\u8a18\u4e8b\u304c\u66f4\u65b0\u3055\u308c\u307e\u3059)<\/p>\n<p>\u3053\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u306f\u3001\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u524d\u306b\u7ba1\u7406\u8005\u306e\u64cd\u4f5c\u3092\u5fc5\u8981\u3068\u305b\u305a\u306b\u3001\u6307\u5b9a\u3055\u308c\u305f\u65e5\u4ed8\u307e\u3067\u306b\u81ea\u52d5\u7684\u306b\u884c\u308f\u308c\u307e\u3059\u3002\u3053\u306e\u5909\u66f4\u306b\u3064\u3044\u3066\u7ba1\u7406\u8005\u306b\u901a\u77e5\u3057\u3001\u95a2\u9023\u3059\u308b\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u66f4\u65b0\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>MC875063 | Microsoft Defender for Identity: New recommendations for Microsoft Secure Score Classification stay [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-7915","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/7915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=7915"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/7915\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=7915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=7915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=7915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}