I have recently found your channel and love it. As an IT Director in an SMB company I wear many hats and these videos are so helpful. Thanks for making them!
Completely agree Andy, such a great security feature especially given most companies these days are deploying more JIT/JEA/PIM/Auditing etc for employees, makes sense that by default you can ensure a Microsoft engineer is governed by the same controls.
Hi Andy, The organization I work at also uses the Lockbox feature (because of our governmental nature, everything security-wise has to be tightened as much as possible), but there is something I'm curious about regarding this feature: As part of our (expensive) contract, we recently had a meeting with a senior engineer from Microsoft (in-person on our location) to give us advice and to talk about the latest developments and potential needs (we do this about once per 1-2 months). At some point we asked whether it was possible for Microsoft to save our AAD environment in case it gets hacked + our global admins, including break-glass accounts, locked out. About 1-2 years ago we asked the same question and they said no, they can't save us in that situation. However, about a month ago to our surprise they said they now can actually save our environment in that situation, but only if the Lockbox feature is turned off. They couldn't really explain why though. Any thoughts about that? (Not really a question because I'm not too concerned we'll ever get in that situation, but the turn of events was interesting. For now we're keeping the Lockbox feature on, but it secretly does make me wonder how screwed we'll be should the above situation ever somehow arise.) Cheers and keep up your amazing work.
Thanks for the comment. You know I’m hearing this more and more from various customers. There are a number of organisations, third-party that is! That are now offering as your A.D. backups. Personally I don’t see the point as there are at least 10 copies backed up in various locations. However, you make a very good point and this is something I may address in the future in one of my videos. Thanks again and have a great Christmas, Andy.
Thank you. I've just spent half an hour trying to figure out why the instructions to turn on the Customer Lockbox feature don't work on my account, because turning it on IS RECCOMENDED IN MY MICROSOFT SECURITY SCORE!! How stupid is it that they are recommending I take steps that can not me taken with my license.
I wasn't aware of lock box I thought this was referring to the personal office 365 vault function I'd dearly love to have in my Business Premium Subscription (and don't understand why it's not included with all 365 subscriptions), but TIL.
Good afternoon cool video lessons thank you very much. I have one question I use microsoft teams for business and exchange mail how to set up so that the messages that come to my mail are automatically shown in teams since I visit teams more often. I hope you will read it thank you😊💯👍
>>Dear Sir, this feature is not meant for individuals like me. Alternatively, for large entities and greater, it certainly has meaning. The only way for rejecting it is to assume that there is a core corps of engineers and techs who have prior approval to operate as their own seniors, so-to-speak, but then THEY should want the Lock Box sub-routine. >>My hypothetical scenario includes top level government (like PM, Pres, Senior General staff, intelligence community, and so forth) who need this kind if fail-safe safety. >>Thank you so much again. >>Happy Holidays. NHG
I am follower of your TH-cam page which is very helpful but I am countering issue with one Destination whomever sending message from our side all emails are bouncing back for clarification I attached the reply came to me which is related to outgoing email scan causing my mail server to be blocked , how I can change my MX record in accordance with Outlook default and removing Cloudfilter interference
Believe me only one of two things is causing this. Either you have an incorrect DNS record (MX) or transport rule that’s blocking the traffic. If you are in hybrid, go to the DNS tab in Microsoft 365 in settings, it gives you a list of the DNS records that you need. If you need technical help with DNS records, you could always submit a support request in the 365 portal, alternatively check out the Microsoft tech community. Either way, thanks for following me and I wish you all the very best, Andy
@@AndyMaloneMVP thanks if there is transport rule definitely it is on the respondent email because the message came as refused to accept and we are to receive any messages rom them but the opposite is not , for the DNS record i was notified that my mx record has problem of scanning outgoing emails as supposed to scan normally instead of using mailprotection
@@drabd0o If your system *works fine* for generally sending and receiving email but is bouncing "forwards or replies" Check your Anti-spam outbound policy in Defender (and create one if you need to). Your default may be set too low (i.e. 0) But also, I agree this should go to the MSFT tech community.
I have recently found your channel and love it. As an IT Director in an SMB company I wear many hats and these videos are so helpful. Thanks for making them!
You’re very welcome, and all the best
Completely agree Andy, such a great security feature especially given most companies these days are deploying more JIT/JEA/PIM/Auditing etc for employees, makes sense that by default you can ensure a Microsoft engineer is governed by the same controls.
yes there are internal security tools that prevent engineers accessing user data without permission.
I am very grateful for your help and support
I'm always waiting for you that something new
thank you, thank you very much
My pleasure, and you’re very welcome 😊
I would like a video on Microsoft Teams Rooms, setting it up and using content cameras, coordinated meetings etc
I did one already on teams meetings and voice on my channel which cover these topics 👍
Hi Andy,
The organization I work at also uses the Lockbox feature (because of our governmental nature, everything security-wise has to be tightened as much as possible), but there is something I'm curious about regarding this feature: As part of our (expensive) contract, we recently had a meeting with a senior engineer from Microsoft (in-person on our location) to give us advice and to talk about the latest developments and potential needs (we do this about once per 1-2 months). At some point we asked whether it was possible for Microsoft to save our AAD environment in case it gets hacked + our global admins, including break-glass accounts, locked out. About 1-2 years ago we asked the same question and they said no, they can't save us in that situation. However, about a month ago to our surprise they said they now can actually save our environment in that situation, but only if the Lockbox feature is turned off. They couldn't really explain why though. Any thoughts about that? (Not really a question because I'm not too concerned we'll ever get in that situation, but the turn of events was interesting. For now we're keeping the Lockbox feature on, but it secretly does make me wonder how screwed we'll be should the above situation ever somehow arise.)
Cheers and keep up your amazing work.
Thanks for the comment. You know I’m hearing this more and more from various customers. There are a number of organisations, third-party that is! That are now offering as your A.D. backups. Personally I don’t see the point as there are at least 10 copies backed up in various locations. However, you make a very good point and this is something I may address in the future in one of my videos. Thanks again and have a great Christmas, Andy.
@@AndyMaloneMVP Cheers Andy, have a great Christmas!
Thank you. I've just spent half an hour trying to figure out why the instructions to turn on the Customer Lockbox feature don't work on my account, because turning it on IS RECCOMENDED IN MY MICROSOFT SECURITY SCORE!! How stupid is it that they are recommending I take steps that can not me taken with my license.
Yeah crazy eh🤪
I wasn't aware of lock box I thought this was referring to the personal office 365 vault function I'd dearly love to have in my Business Premium Subscription (and don't understand why it's not included with all 365 subscriptions), but TIL.
Good afternoon cool video lessons thank you very much. I have one question I use microsoft teams for business and exchange mail how to set up so that the messages that come to my mail are automatically shown in teams since I visit teams more often. I hope you will read it thank you😊💯👍
That’s a good idea and I think this will be the norm in times to come 👍😊
great learning video
>>Dear Sir, this feature is not meant for individuals like me. Alternatively, for large entities and greater, it certainly has meaning. The only way for rejecting it is to assume that there is a core corps of engineers and techs who have prior approval to operate as their own seniors, so-to-speak, but then THEY should want the Lock Box sub-routine.
>>My hypothetical scenario includes top level government (like PM, Pres, Senior General staff, intelligence community, and so forth) who need this kind if fail-safe safety.
>>Thank you so much again.
>>Happy Holidays. NHG
Interesting! 😊
I am follower of your TH-cam page which is very helpful but I am countering issue with one Destination whomever sending message from our side all emails are bouncing back for clarification I attached the reply came to me which is related to outgoing email scan causing my mail server to be blocked , how I can change my MX record in accordance with Outlook default and removing Cloudfilter interference
Believe me only one of two things is causing this. Either you have an incorrect DNS record (MX) or transport rule that’s blocking the traffic. If you are in hybrid, go to the DNS tab in Microsoft 365 in settings, it gives you a list of the DNS records that you need. If you need technical help with DNS records, you could always submit a support request in the 365 portal, alternatively check out the Microsoft tech community. Either way, thanks for following me and I wish you all the very best, Andy
@@AndyMaloneMVP thanks if there is transport rule definitely it is on the respondent email because the message came as refused to accept and we are to receive any messages rom them but the opposite is not , for the DNS record i was notified that my mx record has problem of scanning outgoing emails as supposed to scan normally instead of using mailprotection
@@drabd0o If your system *works fine* for generally sending and receiving email but is bouncing "forwards or replies" Check your Anti-spam outbound policy in Defender (and create one if you need to). Your default may be set too low (i.e. 0) But also, I agree this should go to the MSFT tech community.