You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/security/fundamentals/customer-lockbox-alternative-email.md
+6-5Lines changed: 6 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ author: msmbaldwin
5
5
ms.service: information-protection
6
6
ms.topic: article
7
7
ms.author: mbaldwin
8
-
ms.date: 03/15/2024
8
+
ms.date: 04/16/2025
9
9
---
10
10
11
11
# Customer Lockbox for Microsoft Azure alternate email notifications
@@ -18,7 +18,7 @@ Alternate email notification feature enables customers to use alternate email ID
18
18
> [!IMPORTANT]
19
19
> This feature only enables Customer Lockbox notifications to be sent to alternate email IDs. It does not enable alternate users to act as approvers for Customer Lockbox requests.
20
20
>
21
-
> For example, Alice has the subscription owner role for subscription X and she adds Bob's email address as alternate email/other email in her user profile who has a reader role. When a Customer Lockbox request is created for a resource scoped to subscription 'X', Bob will receive the email notification, but he'll not be able to approve/reject the Customer Lockbox request as he does not have the required privileges for it (subscription owner role).
21
+
> For example, Alice has the subscription owner role for subscription X and she adds Bob's email address as alternate email/other email in her user profile who has a reader role. When a Customer Lockbox request is created for a resource scoped to subscription 'X', Bob receives the email notification, but he is unable to approve/reject the Customer Lockbox request because he does not have the required privileges for it (subscription owner role).
22
22
23
23
## Prerequisites
24
24
@@ -52,11 +52,12 @@ Here are the steps to set up the Customer Lockbox for Microsoft Azure alternate
52
52
:::image type="content" source="./media/customer-lockbox-overview/customer-lockbox-alternative-email-add-email.png" lightbox="./media/customer-lockbox-overview/customer-lockbox-alternative-email-add-email.png" alt-text="A screenshot of the Other emails add interface.":::
53
53
1. Add alternate email address in the text field and select save.
54
54
:::image type="content" source="./media/customer-lockbox-overview/customer-lockbox-alternative-email-other-email.png" lightbox="./media/customer-lockbox-overview/customer-lockbox-alternative-email-other-email.png" alt-text="A screenshot of the alternative email input interface.":::
55
-
1. Select the save button in the Contact Information tab to save the updates.
56
-
:::image type="content" source="./media/customer-lockbox-overview/customer-lockbox-alternative-email-save.png" lightbox="./media/customer-lockbox-overview/customer-lockbox-alternative-email-save.png" alt-text="A screenshot of the Contact Information table, emphasizing the save interface.":::
55
+
1. Select the "Save" button in the Contact Information tab to save the updates.
56
+
:::image type="content" source="./media/customer-lockbox-overview/customer-lockbox-alternative-email-save.png" lightbox="./media/customer-lockbox-overview/customer-lockbox-alternative-email-save.png" alt-text="A screenshot of the Contact Information table, emphasizing the 'Save' interface.":::
57
57
1. The contact information tab for this user should now show updated information with alternate email:
58
58
:::image type="content" source="./media/customer-lockbox-overview/customer-lockbox-alternative-email-contact-information-updated.png" lightbox="./media/customer-lockbox-overview/customer-lockbox-alternative-email-contact-information-updated.png" alt-text="A screenshot of the updated information.":::
59
-
1. Anytime a lockbox request is triggered and if the above user is identified as a Lockbox approver, the Lockbox email notification is sent to both primary and other email addresses, notifying that the Microsoft Support is trying to access a resource within their tenant, and they should take an action by logging into Azure portal to approve/reject the request. Here is an example screenshot:
59
+
2. When a Customer Lockbox request is initiated, notifications are automatically sent to both the primary and alternate email addresses of users configured as Lockbox approvers. These emails inform the approver that Microsoft Support requires access to a resource within their Azure tenant and that action is needed. Approvers must sign in to the Azure portal to approve or reject the request. Here is an example of the notification email:
60
+
60
61
:::image type="content" source="./media/customer-lockbox-overview/customer-lockbox-alternative-email-notification.png" lightbox="./media/customer-lockbox-overview/customer-lockbox-alternative-email-notification.png" alt-text="A screenshot of the email notification.":::
Copy file name to clipboardExpand all lines: articles/security/fundamentals/ransomware-detect-respond.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,15 +6,15 @@ ms.service: security
6
6
ms.subservice: security-fundamentals
7
7
ms.topic: article
8
8
ms.author: mbaldwin
9
-
ms.date: 01/10/2022
9
+
ms.date: 04/16/2025
10
10
11
11
---
12
12
13
13
# Detect and respond to ransomware attacks
14
14
15
-
There are several potential triggers that might indicate a ransomware incident. Unlike many other types of malware, most will be higher-confidence triggers (where little additional investigation or analysis should be required prior to the declaration of an incident) rather than lower-confidence triggers (where more investigation or analysis would likely be required before an incident should be declared).
15
+
Ransomware incidents typically present with distinct warning signs that security teams can identify. Unlike other malware types, ransomware usually produces highly evident indicators that require minimal investigation before declaring an incident. These high-confidence triggers stand in contrast to more subtle threats that would demand extensive analysis before escalation. When ransomware strikes, the evidence is often unmistakable.
16
16
17
-
In general, such infections obvious from basic system behavior, the absence of key system or user files and the demand for ransom. In this case, the analyst should consider whether to immediately declare and escalate the incident, including taking any automated actions to mitigate the attack.
17
+
In general, such infections are obvious from basic system behavior, the absence of key system or user files, and the demand for ransom. In such cases, the analyst should consider whether to immediately declare and escalate the incident, including taking any automated actions to mitigate the attack.
18
18
19
19
## Detecting ransomware attacks
20
20
@@ -25,7 +25,7 @@ Ensure rapid detection and remediation of common attacks on VMs, SQL Servers, We
-**Integrated XDR** - Use integrated Extended Detection and Response (XDR) tools like Microsoft [Defender for Cloud](https://azure.microsoft.com/services/azure-defender/) to provide high quality alerts and minimize friction and manual steps during response
27
27
-**Brute Force** - Monitor for brute-force attempts like [password spray](/defender-for-identity/compromised-credentials-alerts)
28
-
-**Monitor for Adversary Disabling Security** – as this is often part of Human-Operated Ransomware (HumOR) attack chain
28
+
-**Monitor for Adversary Disabling Security** – Often part of Human-Operated Ransomware (HumOR) attack chain
29
29
30
30
-**Event Logs Clearing** – especially the Security Event log and PowerShell Operational logs
31
31
-**Disabling of security tools/controls** (associated with some groups)
@@ -37,19 +37,19 @@ Ensure rapid detection and remediation of common attacks on VMs, SQL Servers, We
37
37
38
38
### Incident declaration
39
39
40
-
Once a successful ransomware infection has been confirmed, the analyst should verify this represents a new incident or whether it might be related to an existing incident. Look for currently open tickets that indicate similar incidents. If so, update the current incident ticket with new information in the ticketing system. If this is a new incident, an incident should be declared in the relevant ticketing system and escalated to the appropriate teams or providers to contain and mitigate the incident. Be mindful that managing ransomware incidents might require actions taken by multiple IT and security teams. Where possible, ensure that the ticket is clearly identified as a ransomware incident to guide workflow.
40
+
Once a successful ransomware infection is confirmed, the analyst should verify whether it represents a new incident or if it might be related to an existing incident. Look for currently open tickets that indicate similar incidents. If so, update the current incident ticket with new information in the ticketing system. If it is a new incident, an incident should be declared in the relevant ticketing system and escalated to the appropriate teams or providers to contain and mitigate the incident. Be mindful that managing ransomware incidents might require actions taken by multiple IT and security teams. Where possible, ensure that the ticket is clearly identified as a ransomware incident to guide workflow.
41
41
42
42
### Containment/Mitigation
43
43
44
-
In general, various server/endpoint antimalware, email antimalware and network protection solutions should be configured to automatically contain and mitigate known ransomware. There might be cases, however, where the specific ransomware variant has been able to bypass such protections and successfully infect target systems.
44
+
In general, various server/endpoint anti-malware, email anti-malware, and network protection solutions should be configured to automatically contain and mitigate known ransomware. There might be cases, however, where the specific ransomware variant is able to bypass such protections and successfully infect target systems.
45
45
46
46
Microsoft provides extensive resources to help update your incident response processes on the [Top Azure Security Best Practices](/azure/cloud-adoption-framework/secure/security-top-10#4-process-update-incident-response-processes-for-cloud).
47
47
48
-
The following are recommended actions to contain or mitigate a declared incident involving ransomware where automated actions taken by antimalware systems have been unsuccessful:
48
+
The following are recommended actions to contain or mitigate a declared incident involving ransomware where automated actions taken by anti-malware systems are unsuccessful:
49
49
50
-
1. Engage antimalware vendors through standard support processes
51
-
1. Manually add hashes and other information associated with malware to antimalware systems
52
-
1. Apply antimalware vendor updates
50
+
1. Engage anti-malware vendors through standard support processes
51
+
1. Manually add hashes and other information associated with malware to anti-malware systems
52
+
1. Apply anti-malware vendor updates
53
53
1. Contain affected systems until they can be remediated
54
54
1. Disable compromised accounts
55
55
1. Perform root cause analysis
@@ -59,7 +59,7 @@ The following are recommended actions to contain or mitigate a declared incident
59
59
60
60
## Road to recovery
61
61
62
-
The Microsoft Detection and Response Team will help protect you from attacks
62
+
The Microsoft Detection and Response Team help protect you from attacks
63
63
64
64
Understanding and fixing the fundamental security issues that led to the compromise in the first place should be a priority for ransomware targets.
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments