You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
3
-
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
3
+
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
Copy file name to clipboardExpand all lines: SECURITY.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,38 +4,38 @@
4
4
5
5
Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).
6
6
7
-
If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), please report it to us as described below.
7
+
If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), report it to us as described below.
8
8
9
9
## Reporting Security Issues
10
10
11
11
**Please do not report security vulnerabilities through public GitHub issues.**
12
12
13
-
Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report).
13
+
Instead, report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report).
14
14
15
-
If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/opensource/security/pgpkey).
15
+
If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]). If possible, encrypt your message with our Pretty Good Privacy (PGP) key; download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/opensource/security/pgpkey).
16
16
17
-
You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc).
17
+
You should receive a response within 24 hours. If for some reason you do not, follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc).
18
18
19
-
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
19
+
Include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
20
20
21
-
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
22
-
* Full paths of source file(s) related to the manifestation of the issue
23
-
* The location of the affected source code (tag/branch/commit or direct URL)
24
-
* Any special configuration required to reproduce the issue
25
-
* Step-by-step instructions to reproduce the issue
26
-
* Proof-of-concept or exploit code (if possible)
27
-
* Impact of the issue, including how an attacker might exploit the issue
21
+
- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, and so on)
22
+
- Full paths of source files related to the manifestation of the issue
23
+
- The location of the affected source code (tag/branch/commit or direct URL)
24
+
- Any special configuration required to reproduce the issue
25
+
- Step-by-step instructions to reproduce the issue
26
+
- Proof-of-concept code or exploit code (if possible)
27
+
- Impact of the issue, including how an attacker might exploit the issue
28
28
29
29
This information will help us triage your report more quickly.
30
30
31
-
If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs.
31
+
If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs.
32
32
33
33
## Preferred Languages
34
34
35
35
We prefer all communications to be in English.
36
36
37
37
## Policy
38
38
39
-
Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd).
39
+
Microsoft follows the principle of [Coordinated Vulnerability Disclosure (CVD)](https://aka.ms/opensource/security/cvd).
Microsoft and any contributors grant you a license to the Microsoft documentation and other content
3
-
in this repository under the [Creative Commons Attribution 4.0 International Public License](https://creativecommons.org/licenses/by/4.0/legalcode),
4
-
see the [LICENSE](LICENSE) file, and grant you a license to any code in the repository under the [MIT License](https://opensource.org/licenses/MIT), see the
2
+
Microsoft and any contributors grant you a license to the Microsoft documentation and other content in this repository under the [Creative Commons Attribution 4.0 International Public License](https://creativecommons.org/licenses/by/4.0/legalcode), see the [LICENSE](LICENSE) file, and grant you a license to any code in the repository under the [MIT License](https://opensource.org/licenses/MIT), see the
5
3
[LICENSE-CODE](LICENSE-CODE) file.
6
4
7
-
Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation
8
-
may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries.
5
+
Microsoft, Windows, Microsoft Azure or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries.
9
6
The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks.
10
7
Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653.
11
8
12
9
Privacy information can be found at https://privacy.microsoft.com/en-us/
13
10
14
-
Microsoft and any contributors reserve all others rights, whether under their respective copyrights, patents,
15
-
or trademarks, whether by implication, estoppel or otherwise.
11
+
Microsoft and any contributors reserve all others rights, whether under their respective copyrights, patents, or trademarks, whether by implication, estoppel or otherwise.
Copy file name to clipboardExpand all lines: docs/architecture/1-secure-access-posture.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,9 +11,9 @@ ms.author: jricketts
11
11
ms.reviewer: ajburnle
12
12
---
13
13
14
-
# Determine your security posture for external access with Microsoft Entra ID
14
+
# Determine your security posture for external access with Microsoft Entra ID
15
15
16
-
As you consider the governance of external access, assess your organization's security and collaboration needs, by scenario. You can start with the level of control the IT team has over the day-to-day collaboration of end users. Organizations in highly regulated industries might require more IT team control. For example, defense contractors can have a requirement to positively identify and document external users, their access, and access removal: all access, scenario-based, or workloads. Consulting agencies can use certain features to allow end users to determine the external users they collaborate with.
16
+
As you consider the governance of external access, assess your organization's security and collaboration needs, by scenario. You can start with the level of control the IT team has over the day-to-day collaboration of end users. Organizations in highly regulated industries might require more IT team control. For example, defense contractors can have a requirement to positively identify and document external users, their access, and access removal: all access, scenario-based, or workloads. Consulting agencies can use certain features to allow end users to determine the external users they collaborate with.
17
17
18
18

19
19
@@ -22,7 +22,7 @@ As you consider the governance of external access, assess your organization's se
22
22
23
23
## Before you begin
24
24
25
-
This article is number 1 in a series of 10 articles. We recommend you review the articles in order. Go to the **Next steps** section to see the entire series.
25
+
This article is number 1 in a series of 10 articles. We recommend you review the articles in order. Go to the **Next steps** section to see the entire series.
26
26
27
27
## Scenario-based planning
28
28
@@ -36,11 +36,11 @@ Compile and assess your organizations scenarios to help assess employee versus b
36
36
37
37
Use the following list to help measure the level of access control.
38
38
39
-
* Information sensitivity, and associated risk of its exposure
40
-
* Partner access to information about other end users
41
-
* The cost of a breach versus the overhead of centralized control and end-user friction
39
+
- Information sensitivity, and associated risk of its exposure
40
+
- Partner access to information about other end users
41
+
- The cost of a breach versus the overhead of centralized control and end-user friction
42
42
43
-
Organizations can start with highly managed controls to meet compliance targets, and then delegate some control to end users, over time. There can be simultaneous access-management models in an organization.
43
+
Organizations can start with highly managed controls to meet compliance targets, and then delegate some control to end users, over time. There can be simultaneous access-management models in an organization.
44
44
45
45
> [!NOTE]
46
46
> Partner-managed credentials are a method to signal the termination of access to resources, when an external user loses access to resources in their own company. Learn more: [B2B collaboration overview](~/external-id/what-is-b2b.md)
@@ -49,27 +49,27 @@ Organizations can start with highly managed controls to meet compliance targets,
49
49
50
50
The goals of IT-governed and delegated access differ. The primary goals of IT-governed access are:
51
51
52
-
* Meet governance, regulatory, and compliance (GRC) targets
53
-
* High level of control over partner access to information about end users, groups, and other partners
52
+
- Meet governance, regulatory, and compliance (GRC) targets
53
+
- High level of control over partner access to information about end users, groups, and other partners
54
54
55
55
The primary goals of delegating access are:
56
56
57
-
* Enable business owners to determine collaboration partners, with security constraints
58
-
* Enable partners to request access, based on rules defined by business owners
57
+
- Enable business owners to determine collaboration partners, with security constraints
58
+
- Enable partners to request access, based on rules defined by business owners
59
59
60
-
### Common goals
60
+
### Common goals
61
61
62
62
#### Control access to applications, data, and content
63
63
64
64
Levels of control can be accomplished through various methods, depending on your version of Microsoft Entra ID and Microsoft 365.
65
65
66
-
*[Microsoft Entra ID plans and pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing)
67
-
*[Compare Microsoft 365 Enterprise pricing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans)
66
+
-[Microsoft Entra ID plans and pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing)
67
+
-[Compare Microsoft 365 Enterprise pricing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans)
68
68
69
69
#### Reduce attack surface
70
70
71
-
*[What is Microsoft Entra Privileged Identity Management?](~/id-governance/privileged-identity-management/pim-configure.md) - manage, control, and monitor access to resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune
72
-
*[Data loss prevention in Exchange Server](/exchange/policy-and-compliance/data-loss-prevention/data-loss-prevention?view=exchserver-2019&preserve-view=true)
71
+
-[What is Microsoft Entra Privileged Identity Management?](~/id-governance/privileged-identity-management/pim-configure.md) - manage, control, and monitor access to resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune
72
+
-[Data loss prevention in Exchange Server](/exchange/policy-and-compliance/data-loss-prevention/data-loss-prevention?view=exchserver-2019&preserve-view=true)
73
73
74
74
#### Confirm compliance with activity and audit log reviews
75
75
@@ -93,8 +93,8 @@ Use the following series of articles to learn about securing external access to
93
93
94
94
7.[Manage external access to resources with Conditional Access policies](7-secure-access-conditional-access.md)
95
95
96
-
8.[Control external access to resources in Microsoft Entra ID with sensitivity labels](8-secure-access-sensitivity-labels.md)
96
+
8.[Control external access to resources in Microsoft Entra ID with sensitivity labels](8-secure-access-sensitivity-labels.md)
97
97
98
-
9.[Secure external access to Microsoft Teams, SharePoint, and OneDrive for Business with Microsoft Entra ID](9-secure-access-teams-sharepoint.md)
98
+
9.[Secure external access to Microsoft Teams, SharePoint, and OneDrive for Business with Microsoft Entra ID](9-secure-access-teams-sharepoint.md)
99
99
100
100
10.[Convert local guest accounts to Microsoft Entra B2B guest accounts](10-secure-local-guest.md)
0 commit comments