An kulle Daga Wurin Aiki na Google ko Microsoft 365 Admin Console: Takeover TXT DNS da farfadowa¶

Gano cewa kamfanin ku, kamfanin lauyoyi, aikin likita, ko ƙungiyar sa-kai an kulle su gaba ɗaya daga cikin Google Workspace (admin.google.com* ko ** Microsoft 365 / ID na Entra (admin.microsoft.com** Masu haya ga girgije saboda kawai Super Administrator ko Global Administrator sun rasa wayoyinsu tare da tsaban Microsoft/Google Authenticator MFA, sun bar kamfanin akan sharuɗɗan maƙiya kuma sun canza kalmar sirri, ko kuma ya mutu ba zato ba tsammani shine rikicin ci gaba na kasuwanci mai wanzuwa. Ba tare da samun damar gudanarwa ba, ba za ku iya ƙara ko cire ma'aikata ba, sake saita kalmar sirrin mai amfani da aka kulle, sabunta katunan lissafin da ke ƙarewa kafin duk imel ɗin kamfanin ku (MX) da SharePoint/Google Drive an dakatar da ababen more rayuwa, ko soke alamun zaman tsohon jami'in dan damfara. An yi sa'a, duka Google da Microsoft injiniyan injiniyoyin kasuwancin su a kusa da tushe na gaskiya na sirri: ** Madaidaicin ikon mallakar doka na ɗan hayan gajimare na al'ada yana cikin mahallin da ke sarrafa ikon yankin DNS Jama'a na sunan yankin a Magatakarda Domain (kamar Cloudflare, AWS Route 53, GoDaddy, ko Namecheap). Ko da admins sifili za su iya shiga kuma kowane kayan aikin YubiKey ko Authenticator app ya tafi, kuna iya aiwatar da gaggawa ** DNS TXT ko CNAME Kalubalen Mallakar Mallaka (ko dai ta hanyar Google ta atomatik toolbox.googleapps.com/apps/recovery/form bututun mai, Microsoft's ** Mai Gudanar da Ciki (Internal Admin Takeover)Unmanaged Tenant*** kwarara, ko **Tawagar Kariyar Data Microsoft (DPT) Tikitin Tabbatarwa na DNS ***) don cire MFA daga asusun gudanarwa da aka kulle ko haɓaka daidaitaccen asusun ma'aikaci na yanzu zuwa cikakken Mai Gudanarwa na Duniya. Idan tsohon ma'aikacin ma'aikaci ko mai kai hari na fansa yana ba da himma sosai wajen fitar da kudaden banki na kamfanoni ko bayanan mara lafiya yayin kulle ku, kira yankin ku. lambobin gaggawa (911 a Amurka da Kanada, 999 a Birtaniya, 112 a fadin Tarayyar Turai) ko kai rahoton kutsen ga FBI IC3 / CISA nan da nan. Don yanki mai alaƙa, asusu, da gaggawar abubuwa biyu, duba jagororin mu akan satar sunan yankin, ƙarewar DNS, da karɓar gidan yanar gizo, haramcin asusun gajimare da kiraye-kirayen ɗaukar bayanai, kuma sake amfani da lambar waya mai abubuwa biyu da kulle SMS.

Yi wannan yanzu¶

1. ** Tabbatar da shiga nan take zuwa Magatakardar Domain na Jama'a da Mai watsa shiri na DNS mai izini da farko.** Kafin a taɓa fom ɗin dawo da Google ko Microsoft, tabbatar da cewa zaku iya shiga Yankin DNS mai izini don babban yankin kamfanin ku (yourcompany.com). Nemo Sabar Sunan ku masu aiki (NS records) amfani dig NS yourcompany.com +short ko whois yourcompany.com. Ko ana gudanar da DNS ɗin ku a Cloudflare, AWS Route 53, GoDaddy, Namecheap, ko Solutions Network, duk wanda zai iya buga sabon. TXT ko CNAME rikodin a tushen (@) na yankin yankin ku yana riƙe da babban maɓallin don tabbatar da ikon mallakar Google da Microsoft.
2. ** Bincika ko WANI mai gudanarwa na sakandare ko Mai ba da Magani na Cloud (CSP / Reseller) har yanzu yana da damar shiga.** Yawancin kungiyoyi sun yi imanin cewa suna da admin "daya" kawai, suna manta cewa:
3. Mai Bayar da Sabis Mai Gudanarwa (MSP) ko ** Mai Ba da Maganin Cloud (CSP) mai siyarwa** (irin su Pax8, Ingram Micro, CDW, Sherweb, ko GoDaddy) yana riƙe da ** Gatan Gudanar da Wakilci (Granular Delegated Admin Privileges)GDAP / DAP*** a cikin Microsoft 365 ko Google Workspace mai haya kuma zai iya sake saita MFA na Admin ɗin ku a cikin daƙiƙa 60; KO
4. Wani manajan sakandare yana riƙe da Mai Gudanar da Tabbatar da Gatacce* a cikin Microsoft Entra ID (wanda ke da cikakken iko don sake saita MFA da kalmomin shiga har ma na Admins na Duniya).
5. ** Idan an kulle daga Google Workspace (admin.google.com), ƙaddamar da DNS mai sarrafa kansa TXT/CNAME Mayen Farfadowa Mai Gudanarwa nan da nan.** Kar a bata kwanaki ƙoƙarin sake saita kalmar wucewa ta mabukaci Gmail. Je zuwa admin.google.com, shigar da adireshin imel ɗin Super Admin da aka kulle, danna "Manta kalmar sirri?", wuce MFA ta motsa har sai tsarin ya ba da ** Tabbatar da dawo da yanki **, KO je kai tsaye zuwa Google's sadaukar da "Mai sarrafa Fayil na Aiki?"toolbox.googleapps.com/apps/recovery/form). Samar da adireshin imel na biyu mai sauƙi kuma a liƙa na musamman google-site-verification=... TXT alama zuwa yankin DNS na yankin ku.
6. ** Idan an kulle daga Microsoft 365 (admin.microsoft.com), bude "Tawagar Kariyar Bayanai (DPT)" Tsanani-Tikitin Waya nan da nan.** Ba kamar Google ba, Microsoft * baya * samar da fom ɗin gidan yanar gizo na sabis na jama'a don keɓance MFA akan ɗan haya na kasuwanci wanda aka riga aka sarrafa. Dole ne ku kira ** Tallafin Kasuwanci na Microsoft ** (lambobin da aka jera a cikin Teburin Yanki na ƙasa), kewaya da faɗakarwar muryar AI ta faɗin "Kulle daga Mai Gudanarwa na Duniya, babu sauran admins akwai, hanya zuwa Teamungiyar Kariyar Bayanai", kuma sami lambar lambar Kariyar bayanai mai lamba 16**. Buɗe na'ura mai ba da hanya tsakanin hanyoyin sadarwa na DNS don haka nan da nan zaku iya buga tabbacin TXT yi rikodin injiniyan Kariyar bayanai ya yi muku imel.
7. Kiyaye katin kiredit ɗin ku mai aiki kuma kada ku taɓa yin cajin banki yayin kullewa. Idan daftarin Google Workspace na kamfanin ku na kowane wata ko Microsoft 365 daftari ya ci karo da katin kiredit na kamfani yayin da kuke kullewa daga na'ura mai sarrafawa, ** kar a toshe katin ko shigar da cajin dawowa **. Haɓaka rashin kunya ko cajin kuɗi akan ɗan haya na kasuwanci na iya haifar da tsarin hana zamba ta atomatik don dakatar da duk akwatunan saƙon mai amfani (550 5.1.1 User Unknown bounces) da tsara ma'ajin SharePoint/Drive na mai haya don sharewa ta dindindin a cikin kwanaki 30 zuwa 90.

Bishiyar yanke shawara: Maido da ikon da aka kulle Google Workspace ko Microsoft 365 dan haya¶

flowchart TD
    A["Jimlar Lockout na Sole Super Admin (Google Workspace) ko Global Admin (Microsoft 365)"] --> B{"Shin kun sayi lasisin ku ta hanyar mai siyarwa / MSP (GoDaddy, Pax8, Ingram, CDW)?"}
    B -->|"Ee: An saya ta hanyar Mai siyarwa / CSP"| C["Gyara Mafi Sauri (mins 15): Mai sake siyarwar Kira / Tallafin MSP don Amfani da Wakilin Admin su (GDAP) API don Sake saita MFA Admin ko Inganta Mai Amfani na Biyu"]
    B -->|"A'a: An Sayi Kai tsaye daga Google ko Microsoft"| D{"Wanne Platform Cloud aka kulle?"}
    D -->|"1. Google Workspace (admin.google.com)"| E["Mataki 1: Gwada Gudun Farfadowar Mai Gudanarwa A atomatik a admin.google.com -> 'Gwarai wata hanya' -> 'Tabbatar da Mai watsa shiri na yanki'"]
    E --> F{"Shin Ƙalubalen Dins ɗin Guda Na atomatik ya jawo?"}
    F -->|"Ee"| G["Ƙara Unique 'google-site-verification=...' Rubutun TXT ko CNAME a Rijistar Domain; Google Yana Sake saita Super Admin A cikin Sa'o'i 24-72"]
    F -->|"A'a / Form madaukai"| H["Ƙaddamar da Maidowa-Taimakawa Mai Gudanarwa a toolbox.googleapps.com/apps/recovery/form"]
    D -->|"2. Microsoft 365 / Entra ID (admin.microsoft.com)"| I{"Shin wannan 'Shadow / Viral' ɗan haya ne wanda ba a sarrafa shi ko cikakken ɗan haya mai sarrafa kasuwanci?"}
    I -->|"Inuwa / Viral Tenant (Ma'aikata sun yi rajista ta hanyar gwaji na kyauta na PowerBI / Ƙungiyoyi)"| J["Aiwatar da Sabis na Kai 'Mai Gudanar da Ciki' ta hanyar PowerShell / M365 Wizard Ta Amfani da Tabbacin TXT na DNS Nan take."]
    I -->|"Cikakken Dan haya Mai Gudanar da Kasuwanci (Sole Global Admin ya rasa MFA / hagu / ya mutu)"| K["Kira Tallafin Kasuwancin Microsoft -> Neman 'Ƙungiyar Kariyar Bayanai (DPT)' Haɓaka -> Wuce TXT DNS + Binciken Mallakar Kasuwanci"]

Google Workspace vs. Microsoft 365: Yadda gine-ginen dawo da haya ya bambanta¶

Duk da yake Google da Microsoft duka sun dogara da ** Izini DNS TXT Tabbatarwa *** don tabbatar da wanda ya mallaki sunan yankin bisa doka da aka haɗe zuwa mai haya ga girgije, ayyukan dawo da su na gudanarwa sun bambanta sosai. Sanin waɗanne lefi ne akan kowane dandamali zai cece ku kwanaki na tikitin tallafi na ƙarshe:

Littafin Playbook 1: Ceto Google Workspace Super Admin a kulle (admin.google.com)¶

Idan an kulle ku daga keɓaɓɓen asusun Google Workspace Super Admin ɗin ku, ko saboda wayar ku da Google Authenticator ta karye, maɓallin tsaro na kayan masarufi na FIDO2 ya ɓace, wani ɗan kwangilar IT da ya tafi ya canza kalmar sirri, ko kun kunna. "Enforce 2-Step Verification" ba tare da fara rajistar asusun admin ba, aiwatar da waɗannan matakai guda uku daidai gwargwado:

Hanyar A: Mai sarrafa kansa admin.google.com Kalubalen Tabbatar da yanki (Mafi Sauri - Sa'o'i 1 zuwa 24)¶

1. Bude tagar incognito / mai zaman kansa akan kwamfutar da ke kan ** ofis na yau da kullun ko cibiyar sadarwar Wi-Fi ta gida** (Injin haɗari na Google yana ƙididdige sabbin hanyoyin sadarwar IP da aka saba) kuma je zuwa https://admin.google.com.
2. Shigar da adireshin imel ɗin Super Admin da aka kulle (admin@yourcompany.com) sannan ka danna Na gaba.
3. Idan kun san kalmar sirrin amma an toshe ta ta 2-Step Verification (MFA), shigar da kalmar wucewa, sannan danna "Gwarai wata hanya" a kasan allon 2FA har sai kun gama dukkan hanyoyin da ba a samu ba. Idan baku san kalmar sirri ba, danna "Manta kalmar sirri?" sannan danna "Gwarai wata hanya" wuce kowane hanzarin da ba a samu ba.
4. Da zarar duk daidaitattun zaɓuɓɓukan dawo da su sun ƙare akan yankin Google Workspace mai gudanarwa guda ɗaya, injin dawo da atomatik na Google yana gabatar da allon Tabbatar da Mallakar Yanki ***:
5. Yana sa ku shigar da ** adireshin imel na lamba ** wanda zaku iya dubawa a halin yanzu (kamar na sirri @gmail.com adireshin imel ko daidaitaccen adireshin imel na ma'aikaci).
6. Google yana aika imel tare da na musamman **CNAME ko TXT rikodin tabbatarwa ** umarnin.
7. Shiga cikin kwamitin kula da DNS na mai rejista na yankinku (Cloudflare, Route 53, GoDaddy, Namecheap) kuma ƙara daidai. TXT ko CNAME rikodin a tushen (@) na yourcompany.com tare da TTL na daƙiƙa 300 (minti 5).
8. ** Tip Pro don Masu Amfani da Cloudflare:** Idan ƙara a CNAME rikodin tabbatarwa a cikin Cloudflare DNS, ** danna alamar Orange Cloud don juya shi Grey (DNS Only)**. Idan Cloudflare's Orange Cloud (Proxied) an bar shi akan tabbatarwa CNAME, Cloudflare yana katse tambayar kuma ya dawo da Cloudflare proxy IPs maimakon maƙasudin CNAME da Google ke sa ran, yana sa tabbatarwa ta gaza kowane lokaci guda.

Hanyar B: Taimakon Taimakon Admin Console farfadowa da na'ura na Portal (toolbox.googleapps.com/apps/recovery/form)¶

Me zai faru idan madauki na shiga ta atomatik kawai ya ce " Tuntuɓi mai gudanar da yankin ku don taimako" (abin mamaki lokacin da kai ne mai gudanar da yanki) ko "Google ya kasa tabbatar da wannan asusun naka ne"?

Yi amfani da sadaukarwar Google, mara inganci ** Portal Maida Asusu na Mai Gudanarwa *: 1. Bude https://toolbox.googleapps.com/apps/recovery/form a cikin browser. 2. Shigar da sunan yankin farko na Google Workspace (misali, yourcompany.com) kuma kammala CAPTCHA. 3. Zaɓi ainihin zaɓin gaggawa: - Ko dai a nemi kalmar sirri/sake saitin 2FA akan asusun Super Admin da aka kulle; KO - An ba da shawarar idan tsohon admin ɗin ya kasance maƙiya/mace: Zaɓi zaɓi don ** haɓaka asusun mai amfani na yau da kullun akan yankinku (you@yourcompany.com) zuwa Super Administrator. 4. Samar da adireshin imel ɗin tuntuɓar na biyu mai aiki inda zaku iya karɓar sabuntawar tikiti. 5. Tsarin Google nan da nan ya haifar da Lambar Tunani na Tikiti kuma ya aika muku da na musamman TXT ƙimar rikodin (wanda aka tsara kamar google-site-verification=rXOxyZ... ko google-workspace-recovery=...). 6. Buga cewa TXT yi rikodin a cikin yankin jama'a na DNS na yankinku, tabbatar da kai tsaye daga tashar tashar cewa yana rayuwa a duk duniya ta hanyar gudu:

dig TXT yourcompany.com @8.8.8.8 +short

Littafin Playbook 2: Ceto Microsoft 365 / Entra ID Global Administratoradmin.microsoft.com)¶

Makulli na Microsoft 365 ya fi na Google Workspace lockouts wahala idan ba ku san ainihin tashoshi masu tasowa ba, saboda tsarin wayar gaba na Microsoft na ƙoƙarin gaya wa masu kira su "shiga Cibiyar Admin don buɗe tikitin tallafi", ƙirƙirar madauki lokacin da aka kulle ku daga Cibiyar Gudanarwa.

Anan ne ** ainihin hanyoyin fasaha guda huɗu da tsari *** don fita daga kullewar Microsoft 365 Global Admin:

Hanya 1: "Boyayyen Admin Secondary" & .onmicrosoft.com Duba Ketare (Duba Wannan Farko cikin Minti 5)¶

Kafin zama a riƙe tare da Ƙungiyar Kariyar Bayanai ta Microsoft, duba abubuwa uku waɗanda ke ceto kashi 40 cikin 100 na masu haya na M365 na "kulle" a wurin: 1. Ya karya SSO / uwar garken Tarayyar (Okta, Duo, Cisco, ADFS) kulle ka? - Lokacin da kuke tarayya yourcompany.com zuwa ga Mai Ba da Shaida na ɓangare na uku (IdP) kuma takardar shaidar IdP ta ƙare ko ta kulle ku, shiga kamar admin@yourcompany.com yana tura ku zuwa ga karyewar IdP. - ** Gyara Nan take:** Kowane ɗan haya na Microsoft 365 yana da yankin faɗuwar girgije-kawai wanda ke ƙarewa a @yourtenant.onmicrosoft.com. Je zuwa https://entra.microsoft.com, irin admin@yourtenant.onmicrosoft.com (ko duk sunan mai amfani na Global Admin ya wanzu akan .onmicrosoft.com domain), kuma shiga. *.onmicrosoft.com asusu KOYAUSHE Yana ƙetare ƙungiyar SAML/WS-Fed ta ɓangare na uku kuma ta inganta kai tsaye a kan Microsoft Entra ID. 2. Shin akwai wani ma'aikacin IT da ke riƙe da "Mai Gudanar da Tabbatar da Gatacce"? - Kamfanoni da yawa suna ba wa manajan IT aikin Mai Gudanar da Tabbatar da Gatacce ba tare da sanya su cikakken Admin na Duniya ba. A cikin ID na Microsoft Entra, Mai Gudanar da Tabbatar da Gatacce yana da cikakken izinin doka don sake saita kalmomin shiga DA sokewa/sake buƙatar MFA don Mai Gudanarwa na Duniya. 3. Shin kun sayi ko da lasisi ɗaya ta hanyar mai siyar da CSP (GoDaddy, Pax8, Sherweb, Ingram, CDW, Rackspace)? - Dubi bayanin katin kiredit ɗin ku. Idan lissafin ku na Microsoft 365 ya fito daga abokin tarayya maimakon kai tsaye daga MICROSOFT*G..., kira wannan tebur na tallafi a yanzu. Ko da kawai sun siyar da ku lasisin Musayar Kan layi na $6 guda ɗaya, idan dangantakar su ta GDAP (Granular Delegated Admin Privileges) tana aiki a Cibiyar Abokin Hulɗar ku, injiniyan su na iya sake saita MFA ɗin Admin na Duniya a ƙasa da mintuna 3.

Hanya 2: Yadda ake isa "Tawagar Kariyar Data Microsoft (DPT)" Lokacin da Zero Admins Zai Iya Shiga¶

Idan ka siya kai tsaye daga Microsoft kuma kaɗaicin Global Administrator ɗinka yana kulle gaba ɗaya (bataccen Wayar Tabbatarwa, ko kuma an kama shi a cikin madauki inda Microsoft Authenticator ya nemi ka amince da lamba biyu a cikin ƙa'idar Authenticator na Microsoft wanda a halin yanzu kake ƙoƙarin shiga), dole ne ka sami ɗan adam ** Teamungiyar Kariyar Bayanai ta Microsoft ((.DPT** injiniyan injiniya yana yin Mallakar ɗan haya & Sake saitin Tabbatar da DNS.

Yadda ake tsallake bishiyar wayar AI mai sarrafa kansa ta Microsoft (IVR) cikin minti 2: 1. Kira lambar yanki ** Tallafin Kasuwanci na Microsoft ** (misali, 1-800-865-9408ko1-800-642-7676 a Amurka/Kanada; duba cikakken jerin abubuwan duniya a ƙasa). 2. An tsara bot ɗin murya mai sarrafa kansa don karkatar da daidaitattun kiran kalmar sirri zuwa aka.ms/sspr. Yi amfani da waɗannan ** ainihin jimlolin magana ** a kowane faɗakarwa: - Tambaya ta 1 ("Me kuke kira akai?"): Ka ce a fili: "Kulle asusun Administrator na Duniya." - Sake saitin kalmar sirri ta 2 ("Shin kun gwada Sake saitin kalmar sirri ta Sabis na Kai?"): Ka ce: "Eh, nine Mai Gudanarwa na Duniya tilo akan dan kasuwan kasuwanci kuma babu sauran masu gudanarwa." - Samar da 3 ("Wane samfuri?"): Ce: "Kasuwancin Microsoft 365 / Kasuwancin ID na Entra" kuma nemi "Canja wurin zuwa Ƙungiyar Kariyar Bayanai." 3. Idan itacen wayar ta tsaya akanki fa? Yi amfani da "Trial Tenant Bridge Trick": - Wannan sanannen hanyar wucewar gaggawa ta sysadmin ce lokacin da wayar Microsoft IVR ta ƙi haɗa ku: Je zuwa microsoft.com/microsoft-365/business, Haɓaka kwana 30 kyauta ** Gwaji Microsoft 365 Tenant ** ta amfani da jefarwa temprescue-[yourcompany].onmicrosoft.com suna (yana ɗaukar mintuna 3, babu caji na kwanaki 30). - Shiga ciki admin.microsoft.com A cikin waccan mai haya na gwaji na wucin gadi, danna Taimako> Taimako & Tallafi a cikin kusurwar dama ta ƙasa, sannan buɗe tikitin Tallafin Mai Tsanani-A** yana faɗin: > *"Kungiyar KARE DATA GAGGAWA: Ina buɗe wannan tikitin daga ɗan hayan gada na wucin gadi saboda ni kaɗai ne Mai Gudanar da Haɗin Sama na Duniya [YOURREALDOMAIN.COM / ID na Tenant] kuma an kulle ni gaba ɗaya daga MFA tare da sauran Admins na Duniya. Da fatan za a canja wurin tikitin zuwa Teamungiyar Kariyar Bayanan Microsoft nan da nan."

Hanyar 3: Wuce Ƙungiyar Kariyar Bayanan Microsoft (DPT) Tabbatar da Audit & DNS TXT Kalubale¶

Da zarar injiniyan Ƙwararrun Ƙwararrun Ƙididdiga na Microsoft ya yi iƙirarin shari'ar ku, suna bin ƙaƙƙarfan ƙa'idar tsaro ta aminci kafin su cire MFA daga Admin na Duniya ko haɓaka sabon mai amfani: 1. ** Hujjar Mallakar Kasuwanci & Biyan Kuɗi:** A tanadi waɗannan abubuwa guda huɗu a cikin babban fayil don karantawa ko loda su a farkon kiran: - ** Sunan yanki** (yourcompany.com) daonmicrosoft.com Sunan mai haya (nemo ainihin GUID ɗin ku na ɗan haya a kowane lokaci ba tare da shiga ta ziyartar ba https://login.microsoftonline.com/yourcompany.com/v2.0/.well-known/openid-configuration); - ** Lambobi 4 na ƙarshe da ranar ƙarewar katin kiredit ** akan fayil don lissafin Microsoft (ko lambobin daftarin Kasuwanci na Microsoft na kwanan nan. G0...); - ainihin adireshin titin lissafin kuɗi da lambar waya da aka jera akan Bayanan Ƙungiya na mai haya; kuma - Jami'in ** Lambobin Haɗin Kai / Lasisi na Kasuwanci / Lissafin Amfani ** idan tsohon mai gudanarwa ya kasance ma'aikacin ɗan damfara ne wanda ya sanya nasu wayar hannu akan bayanin martaba. 2. ** Mai ikon DNS TXT Tabbacin rikodi:** - Injiniyan Kariyar Bayanai zai ba ku keɓaɓɓen igiyar tabbatarwa (kamar MS=ms12345678 ko ƙayyadaddun alama) don ƙara azaman TXT rikodin a tushen (@) na yourcompany.com. - Sau ɗaya nslookup -type=TXT yourcompany.com ya tabbatar da rikodin yana raye, injiniyan DPT ya sake saita rajistar Tabbatar da Factor Multi-Factor Global Admin (Require Re-Register MFA) kuma suna fitar da kalmar sirri ta wucin gadi don ku iya shiga ku yi rajistar sabon ƙa'idar Tabbaci da maɓallin FIDO2.

Hanya 4: Sabis na Kai "Mai Gudanar da Ciki" (Idan An Kulle Gidan Gidanku a cikin "Ba a sarrafa / Viral" Inuwa mai haya)¶

Menene idan kuna ƙoƙarin saita Microsoft 365 don yourcompany.com, kuma Microsoft yana nuna kuskure: "yourcompany.com is already being used with another Microsoft 365 organization", saboda shekaru uku da suka wuce wani ma'aikacin bazuwar ya yi rajista don Power BI kyauta, Binciken Ƙungiyoyin Microsoft, ko Fabric asusu na sabis na kai ta amfani da su. @yourcompany.com email aiki? - Saboda wannan dan haya na "inuwa" yana da ** Masu Gudanar da Duniya na Duniya ** (shine ** Mai Kula da Kwayar cuta mara sarrafa **), baku buƙatar kiran Tallafin Microsoft kwata-kwata. - Kuna iya aiwatar da sauri ** Mai Gudanar da Ciki *: 1. Shiga zuwa Microsoft 365 ta amfani da kowane mai aiki @yourcompany.com asusun mai amfani wanda ke cikin waccan ɗan haya mai hoto (ko ƙirƙirar asusun sabis na kai na Power BI kyauta tare da admin@yourcompany.com). 2. Kewaya zuwa https://portal.office.com/admintakeover (ko gudanar da Microsoft Graph PowerShell takeover cmdlet). 3. Microsoft nan da nan ya nuna TXT lambar tabbatarwa (MS=msXXXXXXXX). 4. Manna wancan TXT Yi rikodin cikin DNS mai rejista na yankin ku, danna Tabbatar da ***, kuma Microsoft ** nan take yana haɓaka ku zuwa cikakken Mai Ganar da Duniya na gaba ɗaya. yourcompany.com mai haya a cikin daƙiƙa 60.

Mataki-mataki-mataki-mataki-hannun binciken tsaro na dawowa (Idan maƙiyi tsohon admin ne ya haifar da kullewar)¶

Idan kullewar ku ta faru ne saboda rashin jin daɗi tsohon mai kula da IT, dakatar da ɗan kwangila, ko maharin waje da gangan ya kwace haƙƙin ku ko kuma ya sace asusun Super/Global Admin, dawo da shiga bai isa ba. Jarumin maƙiyi wanda ke da damar Super Admin ko Global Admin na tsawon ko da mintuna 15 yakan shuka "dagewa a bayan gida" don su iya yin shiru a mako mai zuwa ko da kun canza kalmar sirri.

Ka aiwatar da wannan tsaftar maki 5 a cikin mintuna 30 na farko na komawa cikin na'ura wasan bidiyo da aka kwato:

1. ** Bincika Sabbin Shugabannin Sabis da Aka Ƙirƙira, Ayyukan OAuth na Kasuwanci, da Kalmomin Shafi:**
2. ** A cikin Microsoft Entra ID (entra.microsoft.com):**** Je zuwa Identity > Applications > Enterprise applications kuma App registrations. Tsara ta ** Ƙirƙirar Kwanan Watan . Babban mai sarrafa ɗan damfara zai ƙirƙiri ɓoyayyiyar Rijistar App da aka baiwa RoleManagement.ReadWrite.DirectorykoDirectory.ReadWrite.All** Izinin aikace-aikacen Microsoft Graph API tare da Sirrin Abokin ciniki na watanni 24. Ko da kun goge asusun mai amfani na ɗan damfara, rubutun Python ɗin su na iya amfani da Sirrin Abokin Ciniki daga gida don haɓaka sabon mai amfani da bayan gida zuwa Global Admin yau da dare. Share duk wani Rajistar App da ba a gane ba ko Sirrin Abokin ciniki nan take.
3. ** A cikin Google Workspace (admin.google.com):**** Je zuwa Security > Access and data control > API controls > Manage Domain Wide Delegation. Bincika kowane ** ID na abokin ciniki na Sabis na Sabis na Google Cloud** wanda aka baiwa ** Wakilin Yanki (Domain-Wide Delegation)https://www.googleapis.com/auth/admin.directory.user** kuma share duk wasu ayyukan Google Cloud da ba a gane su ba ko alamun OAuth.
4. Duba Alakar Abokan Hulɗa (GDAP / DAP) da Saitunan Shiga Masu Hayar Haɓaka:
5. A cikin Microsoft 365 Admin Center, kewaya zuwa Settings > Partner relationships. Tabbatar cewa ɗan kwangilar ɗan damfara bai haɗa hanyar sadarwar Abokin Hulɗa na Microsoft na kansu ba (MPN) asusu a matsayin wakili na Cloud Solution Provider tare da GDAP Haƙƙin Admin na Duniya.
6. A cikin Microsoft Entra ID, duba External Identities > Cross-tenant access settings kuma Users > All users (tace don User type == Guest tare da Matsayin Jagoranci da aka sanya) don tabbatar da babu na waje @gmail.com ko @outlook.com An ba mai amfani baƙo shiru a matsayin Babban Mai Gudanarwa na Duniya ko Matsayin Mai Gudanar da Matsayi Mai Gatacce.
7. ** Cire Dokokin Gudanar da Saƙon da aka ɓoye/Masu Fitowa da Aiwatarwa ta atomatik:**
8. Duba Exchange Admin Center > Mail flow > Rules (a cikin Microsoft 365) ko Apps > Google Workspace > Gmail > Routing (a cikin Google Workspace) don kowane ƙa'idodin sufuri na masu haya wanda ke shiru BCC ko tura saƙon imel na zartarwa, hanyoyin sake saitin kalmar sirri, ko daftarin canja wurin waya zuwa adireshin waje.
9. ** Shake Duk Alamomin Wartsakewa Mai Aiki da Kukis ɗin Zama Mai Faɗin Haya:**
10. Canza kalmar sirri ta mai amfani a cikin mahallin gajimare ba koyaushe yana kashe alamun wartsakewa na OAuth ko Ci gaba da kimantawa ba (CAE) zaman kan kwamfutocin da aka riga aka tabbatar. Kai tsaye danna "Sake zaman / Fita daga duk zaman" akan asusun admin ɗin da aka daidaita sannan a juya krbtgt / Azure AD SSO Kerberos decryption key idan Azure AD Connect / Entra Connect ana tura sync hybrid akan-gidaje.
11. ** Kunna "Aminci Amincewa / Amincewa da Jam'iyyu da yawa" da Fadakarwa akan Ayyukan Matsala:**
12. Shirya faɗakarwar imel nan take da faɗakarwar saƙon gidan yanar gizo ta SMS a cikin Google Workspace Admin Audit Logs ko Microsoft Entra ID Gata Gudanar da Shaida (PIM) ta yadda kowane Super/Global Admin ya sami faɗakarwa ba tare da bata lokaci ba a duk lokacin da aka ƙara mai amfani zuwa aikin gudanarwa ko duk lokacin da aka gyara saitunan MFA.

Lambobin gaggawa na yanki da ka'idojin hukumar¶

Tambayoyin da ake yawan yi¶

Me yasa Teamungiyar Kariyar Bayanai ta Microsoft wani lokaci suna ɗaukar kwanaki 5 zuwa 10 don buɗe Admin na Duniya lokacin da zan iya tabbatar da cewa na mallaki DNS a yanzu?¶

Saboda masu haya na Microsoft 365 na kasuwanci galibi suna riƙe biliyoyin daloli a cikin dukiyar ilimi, ikon waya na banki, da bayanan HIPAA/GDPR, masu kai hare-haren injiniyan zamantakewa akai-akai suna ƙoƙarin yaudarar wakilan tallafi don sake saita MFA na Admin na Duniya. Sakamakon haka, Microsoft yana ƙuntata MFA Admin Global mara inganci zuwa ƙaramar rukunin Tier-3 na musamman da ake kira ** Teamungiyar Kariyar Bayanai (`DPT`)**. Yayin jira a cikin jerin gwanon DPT: (1) kira baya sau ɗaya kowace rana kuna yin la'akari da lambar Case mai lamba 16 **, (2) tambayi wakilin layi na gaba don yiwa tikitin alama a matsayin **"Mahimmancin Kasuwanci - Jimlar Kulle Admin tare da Admins Ajiyayyen Ajiyayyen (Mai tsanani A)"**, da (3) idan kuna da Babban Asusun Microsoft, Magani na girgije.`CSP`), ko kwangilar Haɗin Kai, tambaye su su ƙaddamar da ciki **"CritSit" (Yanayin Mahimmanci)** haɓaka akan lambar shari'ar ku, wanda yawanci yana yanke lokacin amsa DPT zuwa ƙasa da awanni 24.

Me zai faru idan dan damfara tsohon ma'aikacin IT ya kulle mu daga BOTH Microsoft 365/Google Workspace DA Registrar Domain mu (GoDaddy / Cloudflare)?¶

Idan ma'aikaci ko ɗan kwangila da ya rasu ya yi rajista `yourcompany.com` a ƙarƙashin shiga nasu ko kuma sun kulle ku daga magatakardan yankinku (GoDaddy, Namecheap, Cloudflare, Solutions Network), dole ne ku **dole ne da farko dawo da asusun magatakarda na Domain**, saboda ba za ku iya buga Google/Microsoft DNS ba. `TXT` rikodin ba tare da samun damar mai rejista ba. Kowane mai rejista na ICANN da aka amince da shi yana da keɓancewar ** Wurin Mallakar Mallaka / Rigimar Rigimar Asusu** (misali, GoDaddy's `Account Recovery & Change of Update Request`). Submitaddamar da: (1) **Labarun Haɗin Kai / Wasiƙar IRS EIN / Rajistan Kasuwanci **, (2) kwafin ** ID ɗin Hoton Gwamnati ** a matsayin jami'in kamfani, da (3) ** katin kiredit na kamfani ko bayanan banki ** yana nuna cewa kamfanin ku ya biya rajistar yanki da kuɗaɗen sabuntawa. Mai rejista zai canza yankin zuwa sabon asusun kamfani a cikin sa'o'i 48 zuwa 96, yana ba ku damar buga DNS. `TXT` yi rikodin kuma mayar da Google Workspace ko Microsoft 365 nan da nan bayan.

Ta yaya zan sami Microsoft Entra ID na "ID na Tenant" (GUID) idan kowane mutum ɗaya yana kulle daga tashar?¶

Lokacin da kuka kira Ƙungiyar Kariyar Bayanai ta Microsoft, tare da ainihin haruffa 36 ** GUID ID na haya *** (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) yana hanzarta fitar da tikitin da sauri. Ko da babu wani a cikin kamfanin ku da zai iya shiga, Microsoft's OpenID Connect metadata ƙarshen ƙarshen jama'a ne ga kowane yanki a duniya. Bude kowane mai binciken gidan yanar gizo kuma kewaya zuwa: `https://login.microsoftonline.com/YOURDOMAIN.COM/v2.0/.well-known/openid-configuration` (maye gurbin `YOURDOMAIN.COM` tare da sunan yankin kamfanin ku). A cikin rubutun JSON da ke bayyana akan allo, duba URL na farko bayan haka `"token_endpoint"`: lambar haruffan haruffa 36 nan da nan `login.microsoftonline.com/` shine ainihin ku ** Microsoft Entra Tenant ID**.

Za a sake saita Global Admin ko Super Admin ta hanyar DNS TXT tabbaci yana share kowane imel, fayilolin OneDrive, ko takaddun Google Drive?¶

A'a. Ko Google Workspace DNS Admin flow ko na Microsoft Data Protection Team MFA/sake saitin kalmar sirri ya taɓa byte ɗaya na bayanan akwatin saƙon mai amfani, Shafukan SharePoint, manyan fayilolin OneDrive, Taɗi na Ƙungiyoyi, ko takaddun Google Drive. A zahiri, idan kun zaɓi zaɓi don ** haɓaka daidaitaccen asusun ma'aikaci na yanzu zuwa Super Admin / Global Admin ** (maimakon sake saita kalmar wucewar ma'aikaci), akwatin gidan waya da fayilolin ma'aikacin da ya tafi ya kasance gaba ɗaya ba a taɓa su ba kuma ana kiyaye su don gano doka yayin da sabon admin ɗin ku da aka haɓaka ke ɗaukar cikakken ikon na'urar wasan bidiyo.

Me zai faru idan muka kafa manufar shiga cikin Sharadi na Microsoft wanda ya toshe DUK masu amfani da gangan (ciki har da Admins na Duniya) ta hanyar buƙatar na'urar Intune mai yarda ko takamaiman adireshin IP?¶

Wannan ana kiransa ** Kulle Kulle Kai Tsaye**, kamar lokacin da mai gudanarwa ya ƙirƙiri manufar samun dama ga Sharadi. `"All Users"` kuma `"All Cloud Apps"` tare da iko wanda ba zai iya gamsuwa ba (kamar buƙatar na'urar Haɗaɗɗen Azure AD ko kewayon IP na VPN da ya ƙare) kuma ya manta don bincika `"Exclude Emergency Access Accounts"` akwati. Domin tsarin yana toshe kowane admin a login, ko da sanin kalmar sirrinku da samun wayar MFA ɗinku mai aiki ba zai bari ku shiga ba. Hanyar ceton ku kawai shine kiran ** Tallafin Kasuwanci na Microsoft **, haɓaka zuwa ** Teamungiyar Kariyar Data**, wuce DNS. `TXT` Tabbatar da ikon mallakar, kuma tambayi injiniyan DPT don gudanar da kayan aikin su na baya don ** musaki manufar Samun Sharadi mai laifi ** akan mai haya.

Jagora masu alaƙa¶

• Satar sunan yanki, ƙarewar DNS, da karɓar gidan yanar gizo
• Haramta asusun Cloud: Google, Apple, da Microsoft sun yi kira ga kulle kulle
• Lambar tantancewar abubuwa biyu an sake yin fa'ida ta mai ɗauka da kulle SMS
• Kulle mai sarrafa kalmar sirri, babban asarar kalmar sirri, da dawo da vault

Tushen da jagorar hukuma¶

• Taimakon Mai Gudanarwa na Google Workspace & Takardun Tsaro: Mayar da damar Mai Gudanarwa zuwa Asusun Google Workspace ɗin ku (admin.google.com), Taimako-Taimakawa DNS TXT/CNAME Tabbatarwa (toolbox.googleapps.com/apps/recovery/form), da Mafi Kyawun Ayyuka don Babban Administrator Break-Glass Accounts.
• Microsoft Koyi (ID ɗin Microsoft Entra ID / Microsoft 365 Takardun): * Sarrafa Asusun Samun Gaggawa a cikin Microsoft Entra ID, Yi Mai Gudanar da Ciki na Cikin Gida akan Jagorar da Ba a sarrafa ta Tabbacin TXT na DNS, da Ƙarfafa Kulle MFA Mai Gudanarwa na Duniya ta Ƙungiyar Kariyar Bayanai*.
• Cibiyar Tsaro ta Yanar Gizo da Hukumar Tsaro ta Lantarki (CISA, Amurka): Tsarin Fasahar Fasahar Tsaro na Cloud da CISA ScubaGear Baselines don Microsoft 365 da Google Workspace Resilience Resilience.
• Cibiyar Ƙididdiga da Fasaha ta Ƙasa (NIST): * Buga na Musamman 800-63B (Sharuɗɗan Shaida na Dijital: Tabbatarwa da Gudanar da Rayuwar Rayuwa, Maida Factor Authenticator)*.
• Kamfanonin Intanet don Sunaye da Lambobi (ICANN): Hakkoki da Hakki na Masu Rijista da Ka'idojin Tabbatar da Tabbatar da Sunan Yanki.