Ifunze hanze ya Google Umwanya cyangwa Microsoft 365 Umujyanama wa Admin: DNS TXT Gufata no Kugarura¶

Kumenya ko isosiyete yawe, ikigo cyamategeko, ibikorwa byubuvuzi, cyangwa udaharanira inyungu bifunze burundu muri ** Google Workspace (admin.google.com) ** cyangwa ** Microsoft 365 / Entra ID (admin.microsoft.com. Hatariho ubuyobozi, ntushobora kongera cyangwa gukuraho abakozi, gusubiramo ijambo ryibanga ryumukoresha ufunze, kuvugurura amakarita yo kwishyuza arangiye mbere ya imeri yikigo cyawe cyose (MX) na SharePoint / Ibikorwa remezo bya Google Drive byahagaritswe, cyangwa kuvanaho ibimenyetso bya ex-admin wibimenyetso. Kubwamahirwe, Google na Microsoft bombi bashiraho imishinga yabo iranga imishinga ishingiye kumyizerere yifatizo: ** uburenganzira bwemewe bwumuntu ukodesha igicu cyumukode wigenga ni icyicaro kigenzura izina ryizina ryemewe rya DNS zone kuri Gerefiye (nka Cloudflare, AWS Route 53, GoDaddy, cyangwa Namecheap) **. Nubwo abadamu ba zeru bashobora kwinjira kandi ibyuma byose YubiKey cyangwa Authenticator byashize, urashobora gukora byihutirwa ** DNS TXT cyangwa CNAME Ikibazo cya nyirubwite Ikibazo cyo gufata ** (haba binyuze muri Google yikora toolbox.googleapps.com/apps/recovery/form umuyoboro, Microsoft's ** Gufata Imbere mu Gihugu (Unmanaged Tenant) ** gutemba, cyangwa itsinda rya Microsoft rishinzwe kurinda amakuru (Microsoft)DPT) Tike yo kugenzura DNS **) kwambura MFA kuri konti ya admin ifunze cyangwa kuzamura konti isanzwe yumukozi kuri Super / Global Administrator wuzuye. Niba uwahoze ari umukozi wangizi cyangwa uwibasiwe nincungu arimo gusohora cyane amafaranga ya banki yibigo cyangwa amakuru yabarwayi mugihe agufunze, hamagara aho utuye nimero yihutirwa (911 muri Amerika na Kanada, 999 mu Bwongereza, 112 mu bihugu by’Uburayi) cyangwa kumenyesha ko bwinjiye muri FBI IC3 / CISA ako kanya. Kubijyanye na domaine, konte, nibintu bibiri byihutirwa, reba ubuyobozi bwacu kuri izina rya domaine gushimuta, DNS yarangiye, no gufata urubuga, igicu kibuza kubuza no gufata amakuru, na ibintu bibiri byemeza terefone nimero yongeye gukoreshwa hamwe na SMS ifunga.

Kora ubu¶

1. ** Shakisha uburyo bwihuse bwo kwinjira mububiko rusange bwa rusange hamwe na DNS Yemewe mbere.yourcompany.com). Reba amazina yawe akora neza (NS inyandiko) ukoresheje dig NS yourcompany.com +short cyangwa whois yourcompany.com. Niba DNS yawe yakiriwe kuri Cloudflare, AWS Route 53, GoDaddy, Namecheap, cyangwa Network Solutions, uwashobora gutangaza ibishya TXT cyangwa CNAME kwandika ku mizi (@) ya domaine yawe ifite urufunguzo rwibanze rwo kwerekana uburenganzira bwa Google na Microsoft.
2. ** Kugenzura niba UMUNTU WESE wongeyeho cyangwa Cloud Solution Provider (CSP / Umugurisha) aracyafite igice. ** Amashyirahamwe menshi yemera ko afite admin "umwe" gusa, akibagirwa ko:
3. Serivisi yo hanze itanga serivisi (MSP) cyangwa ** Gutanga Igicu (CSP) umucuruzi ** (nka Pax8, Ingram Micro, CDW, Sherweb, cyangwa GoDaddy) afite ** Granular Delegated Admin uburenganzira ((GDAP / DAP) ** muri Microsoft 365 cyangwa Google Workspace ukodesha kandi urashobora gusubiramo MFA yawe ya Global Admin mumasegonda 60; CYANGWA
4. Umuyobozi wa kabiri afite inshingano ya ** Yemewe yo Kwemeza Umuyobozi ** muri Microsoft Entra ID (ifite imbaraga zuzuye zo kugarura MFA nijambobanga ndetse no kubayobozi ba Global).
5. ** Niba ufunzwe hanze ya Google Workspace (admin.google.com), gutangiza DNS Yikora TXT/CNAME Admin Recovery Wizard ako kanya. ** Ntugatakaze iminsi ugerageza kugura ijambo ryibanga rya Gmail. Jya kuri admin.google.com, andika aderesi imeyiri ya Super Admin ifunze, kanda ** "Wibagiwe ijambo ryibanga?" **, unyuze hejuru yibisabwa na MFA kugeza igihe sisitemu itanga ** Kugarura Domain Verification **, CYANGWA ujye kuri Google yihariye ** Ifashayobora Umwanya wa Admin Console Recovery ((toolbox.googleapps.com/apps/recovery/form) **. Tanga aderesi ya imeri igezweho kandi wandike umwihariko google-site-verification=... TXT ikimenyetso muri domaine yawe ya DNS.
6. ** Niba ufunzwe muri Microsoft 365 (admin.microsoft.com), fungura "Itsinda rishinzwe kurinda amakuru (DPT). DNS konsole irakinguye kugirango uhite utangaza verisiyo TXT andika amakuru yo kurinda Data injeniyeri.
7. ** Bika ikarita yawe yinguzanyo ikora kandi ntuzigere utanga banki mugihe wugaye. ** Niba inyemezabuguzi ya Google Workspace ya Microsoft ya buri kwezi cyangwa fagitire ya Microsoft 365 ikubise ikarita yinguzanyo yawe mugihe ufunzwe hanze yubuyobozi bwa admin, ** ntugahagarike ikarita cyangwa ngo utange amafaranga **. Gutera isoni kwishura cyangwa kwishyurwa kumupangayi ukora ubucuruzi birashobora gutuma sisitemu yo kurwanya ruswa ihagarika agasanduku k'iposita yose y'abakoresha (550 5.1.1 User Unknown bounces) hanyuma uteganyirize ububiko bwa SharePoint / Drive ububiko bwo gusiba burundu muminsi 30 kugeza 90.

Igiti cyemezo: Kugarura igenzura rya Google Workspace ifunze cyangwa Microsoft 365 ikodesha¶

flowchart TD
    A["Ifungwa ryuzuye rya Admin Admin (Google Workspace) cyangwa Umuyobozi wa Global (Microsoft 365)"] --> B{"Waguze impushya zawe ukoresheje Reseller / MSP (GoDaddy, Pax8, Ingram, CDW)?"}
    B -->|"Yego: Yaguzwe binyuze muri Reseller / CSP"| C["Gukosora Byihuse (Iminota 15): Hamagara Abacuruzi / Inkunga ya MSP kugirango bakoreshe umuyobozi wabo (GDAP) API kugirango basubize Admin MFA cyangwa bazamure Umukoresha wa kabiri"]
    B -->|"Oya: Yaguzwe biturutse kuri Google cyangwa Microsoft"| D{"Nibihe bicu bifunze?"}
    D -->|"1. Umwanya wa Google Umwanya (admin.google.com)"| E["Intambwe ya 1: Gerageza Automatic Admin Recovery Flow kuri admin.google.com -> 'Gerageza ubundi buryo' -> 'Kugenzura hamwe na Domisiyo yakiriye'"]
    E --> F{"Ese Automatic Flow Trigger DNS Ikibazo?"}
    F -->|"Yego"| G["Ongeraho Unique 'google-site-verisiyo = ...' TXT cyangwa CNAME Record kuri Domain Registry; Google Yagaruye Umuyobozi mukuru Muri 24-72"]
    F -->|"Oya / Ifishi"| H["Tanga Inkunga-Ifashwa na Admin Kubona kuri toolbox.googleapps.com/apps/recovery/form + Teza imbere Umukoresha usanzwe ukoresheje DNS TXT Icyemezo"]
    D -->|"2. Microsoft 365 / Indangamuntu ya Entra (admin.microsoft.com)"| I{"Uyu ni 'Igicucu / Virusi' Umupangayi udacungwa cyangwa umukode wuzuye ukodeshwa?"}
    I -->|"Igicucu / Gukodesha Virusi (Abakozi biyandikishije binyuze kuri PowerBI / Amakipe yubusa)"| J["Kora Kwikorera-Kwikorera 'Imiyoborere Yimbere' ukoresheje PowerShell / M365 Wizard Ukoresheje DNS TXT Yihuse"]
    I -->|"Umupangayi wuzuye wubucuruzi ukodeshwa (Sole Global Admin yatakaje MFA / ibumoso / yapfuye)"| K["Hamagara Inkunga y'Ubucuruzi ya Microsoft -> Saba 'Itsinda Ririnda Data (DPT)' Escalation -> Genda DNS TXT + Igenzura rya nyir'ubucuruzi"]

Google Workspace na Microsoft 365: Uburyo abubatsi bakodesha batandukanye¶

Mugihe Google na Microsoft zombi zishingiye kuri ** DNS yemewe TXT Kugenzura ** kwerekana uwatunze byemewe nizina rya domaine yometse kubakodesha, ibikorwa byabo byo kugarura ubuyobozi biratandukanye cyane. Kumenya leveri zibaho kuri buri platform bizagukiza iminsi yamatike yingoboka yanyuma:

Igitabo gikinirwaho 1: Kurokora Google Umwanya ufunze Super Admin (admin.google.com)¶

Niba ufunzwe kuri konte yawe yonyine ya Google Workspace Super Admin, niba kubera ko terefone yawe hamwe na Google Authenticator yacitse, urufunguzo rwumutekano wibikoresho bya FIDO2 rwatakaye, rwiyemezamirimo wa IT wagiye ahindura ijambo ryibanga, cyangwa urabishoboye "Enforce 2-Step Verification" utabanje kwiyandikisha kuri konte ya admin, kora izi ntambwe uko ari eshatu zikurikiranye:

Uburyo A: Byikora admin.google.com Ikibazo cyo Kugenzura Imiterere (Byihuta - Amasaha 1 kugeza 24)¶

1. Fungura idirishya rya Incognito / Private mushakisha kuri mudasobwa iherereye ku biro byawe bisanzwe ** cyangwa murugo Wi-Fi umuyoboro ** (moteri ya risque ya Google itanga IP subnets zimenyerewe hejuru) hanyuma ujye kuri https://admin.google.com.
2. Injira aderesi imeri ya Super Admin ifunze (admin@yourcompany.com) hanyuma ukande ** Ibikurikira **.
3. Niba uzi ijambo ryibanga ariko uhagaritswe na ** 2-Intambwe yo Kugenzura (MFA) **, andika ijambo ryibanga, hanyuma ukande ** "Gerageza ubundi buryo" ** hepfo ya ecran ya 2FA kugeza urangije uburyo bwose butaboneka. Niba utazi ijambo ryibanga, kanda ** "Wibagiwe ijambo ryibanga?" ** hanyuma ukande ** "Gerageza ubundi buryo" ** ushize buri kibazo kidashoboka.
4. Amahitamo yose yo kugarura ibintu amaze kurangira kumurongo umwe wa Google Workspace domaine, moteri yo kugarura imashini ya Google yerekana ecran ya ** Domain Ownership Verification **:
5. Iragusaba kwinjiza aderesi imeri ya ** ushobora kugenzura ubu (nkumuntu ku giti cye @gmail.com aderesi cyangwa aderesi ya imeri isanzwe y'abakozi).
6. Google yohereje imeri ifite umwihariko **CNAME cyangwa TXT kugenzura inyandiko ** amabwiriza.
7. Injira muri domaine yawe ya DNS igenzura (Cloudflare, Umuhanda wa 53, GoDaddy, Namecheap) hanyuma wongereho neza TXT cyangwa CNAME kwandika ku mizi (@) ya yourcompany.com hamwe na ** TTL yamasegonda 300 (iminota 5) **.
8. ** Impanuro kubakoresha Cloudflare: ** Niba wongeyeho a CNAME kugenzura inyandiko imbere muri Cloudflare DNS, ** kanda igishushanyo cya Orange Cloud kugirango uhindure Icyatsi (DNS Only) **. Niba Cloudflare ya Orange Igicu (Proxied) isigaye ishoboye kuri verisiyo CNAME, Cloudflare ihagarika ikibazo kandi igasubiza IP ya Cloudflare aho kuba intego ya Google iteganijwe na CNAME, bigatuma igenzura rinanirwa buri gihe.

Uburyo B: Inkunga-Ifashwa na Admin Umujyanama wo Kugarura (toolbox.googleapps.com/apps/recovery/form)¶

Byagenda bite se niba ibyuma byinjira byikora byonyine bivuze * "Menyesha umuyobozi wa domaine kugirango agufashe" * (birasekeje iyo ** uri ** umuyobozi wa domaine) cyangwa * "Google ntishobora kugenzura ko iyi konti ari iyanyu" *?

Koresha Google yihariye, itemewe ** Umwanya wumwanya wa Admin Konti yo Kugarura Konti **: 1. Fungura https://toolbox.googleapps.com/apps/recovery/form muri mushakisha yawe. 2. Injira ** Google Workspace izina ryibanze ryibanze ** (urugero, yourcompany.com) no kuzuza CAPTCHA. 3. Hitamo uburyo bwihutirwa: - Saba ijambo ryibanga / 2FA gusubiramo konte ya Super Admin ifunze; CYANGWA - ** Basabwe niba uwahoze ari admin yanga / wapfuye: ** Hitamo uburyo bwo ** kumenyekanisha konti isanzwe y'abakoresha kuri domaine yawe (you@yourcompany.com) kuri Super Administrator **. 4. Tanga aderesi ya imeri ikora ya kabiri aho ushobora kwakira amatike agezweho. 5. Sisitemu ya Google ihita itanga Tike Yerekana Tike kandi ikohereza imeri idasanzwe **TXT agaciro kanditse ** (imiterere nka google-site-verification=rXOxyZ... cyangwa google-workspace-recovery=...). 6. Tangaza ibyo TXT andika muri domaine rusange ya DNS, genzura neza uhereye kuri terminal ko ibaho kwisi yose ukoresheje:

dig TXT yourcompany.com @8.8.8.8 +short

Igitabo gikinirwaho 2: Kurokora Microsoft 365 ifunze / Entra ID Umuyobozi wisi yose (admin.microsoft.com)¶

Microsoft 365 ifunga biragoye kuruta Google Workspace ifunga niba utazi inzira nyayo yo kuzamuka, kubera ko sisitemu ya terefone ya mbere ya Microsoft igerageza kubwira abahamagarira * "kwinjira mu kigo cya Admin kugira ngo ufungure itike yo kugoboka" *, ugakora uruziga iyo ufungiwe hanze y’ikigo cya Admin.

Dore ** inzira enye zubuhanga nuburyo bukurikizwa ** kugirango ucike muri Microsoft 365 Ifungwa rya Admin Global:

Inzira ya 1: "Umuyobozi Wihishe Secondary Admin" & .onmicrosoft.com Kugenzura Bypass (Reba Ibi Banza mu minota 5)¶

Mbere yo kwicara hamwe nitsinda rishinzwe kurinda amakuru ya Microsoft, banza ugenzure ibintu bitatu bikiza 40 ku ijana byabapangayi "bafunze" M365 aho: 1. ** Ese seriveri ya SSO / Federasiyo yamenetse (Okta, Duo, Cisco, ADFS) kugufunga? ** - Iyo uhuza yourcompany.com kubandi bantu batanga indangamuntu (IdP) kandi ko icyemezo cya IdP kirangiye cyangwa kigufunga, winjira nkuko admin@yourcompany.com kukuyobora kuri IdP yamenetse. - ** Gukosora ako kanya: ** Buri mukode wa Microsoft 365 afite igicu kavukire-cyonyine gishobora gusubira muri @yourtenant.onmicrosoft.com. Jya kuri https://entra.microsoft.com, andika admin@yourtenant.onmicrosoft.com (cyangwa ikindi kintu cyose ukoresha izina rya Admin ukoresha kuri .onmicrosoft.com indangarugero), hanyuma winjire. **.onmicrosoft.com KONTI BURUNDI uzenguruke igice cya gatatu SAML / WS-Federasiyo ya federasiyo ** hanyuma wemeze neza kurwanya Microsoft Entra ID. 2. ** Hoba hari abakozi ba IT bafite uruhare "Umuyobozi wihariye wo kwemeza"? ** - Ibigo byinshi biha umuyobozi wa IT inshingano ya ** Yemewe yo Kwemeza Umuyobozi ** atabagize Umuyobozi wuzuye wisi. Muri Microsoft Entra ID, umuyobozi wa ** ufite uburenganzira bwo kwemeza afite uburenganzira bwuzuye bwo gusubiramo ijambo ryibanga KANDI gukuraho / kongera gusaba MFA kumuyobozi wisi yose **. 3. ** Waguze uruhushya rumwe KUMWE ukoresheje CSP Umucuruzi (GoDaddy, Pax8, Sherweb, Ingram, CDW, Rackspace)? ** - Reba ikarita yinguzanyo yawe. Niba fagitire ya Microsoft 365 ituruka kumufatanyabikorwa aho guturuka MICROSOFT*G..., hamagara ameza yingoboka yabafatanyabikorwa nonaha. Nubwo bakugurisha gusa $ 6 Uruhushya rwo Guhana Kumurongo, niba umubano wabo wa ** GDAP (Granular Delegated Admin Privileges) ** ukorana mukigo cyawe cyabafatanyabikorwa, injeniyeri wabo arashobora gusubiramo MFA yawe ya Global Admin muminota 3.

Inzira ya 2: Nigute wagera "Ikipe yo Kurinda Data Data Microsoft (DPT) "Iyo Abayobozi ba Zeru bashobora kwinjira¶

Niba uguze bitaziguye muri Microsoft kandi umuyobozi wawe wenyine wa Global Administrator arafunzwe burundu (yatakaye terefone ya Authenticator, cyangwa yafatiwe mu cyuho aho Microsoft Authenticator igusaba kwemeza numero 2 yimibare iri muri porogaramu ya Microsoft Authenticator urimo ugerageza kwinjira), ugomba ** ugomba kugira itsinda ryumuntu ** Microsoft rishinzwe kurinda amakuru (Microsoft)DPT) ** injeniyeri akora ** Nyirubukode & DNS Kugenzura **.

** Nigute ushobora kurenga igiti cya terefone ya Microsoft cyikora ()IVR) mu minota 2: ** 1. Hamagara akarere ** Inkunga yubucuruzi ya Microsoft ** numero (urugero, 1-800-865-9408 cyangwa 1-800-642-7676 muri Amerika / Kanada; reba urutonde rwisi yose hepfo). 2. Ijwi ryikora ryikora ryateguwe kugirango rihindure ijambo ryibanga risanzwe kuri aka.ms/sspr. Koresha iyi ** interuro ivugwa neza kuri buri kibazo: - * Banza 1 ("Urahamagarira iki?"): * Vuga neza: ** "Ifungwa rya konti ya Global Administrator." ** - . - * Bimenyesha 3 ("Niki gicuruzwa?"): * Vuga: ** "Microsoft 365 Ubucuruzi / Entra ID Ubucuruzi" ** hanyuma usabe ** "Kohereza mumurwi urinda amakuru." ** 3. ** Byagenda bite mugihe igiti cya terefone kigikumanitse? Koresha "Ikigeragezo cya Tenant Bridge Trick": ** - Nibisanzwe bizwi cyane bya sysadmin bypass mugihe terefone ya Microsoft IVR yanze kuguhuza: Jya kuri microsoft.com/microsoft-365/business, kuzunguruka iminsi 30 yubusa ** Ikigeragezo Microsoft 365 Tenant ** ukoresheje guta temprescue-[yourcompany].onmicrosoft.com izina (bifata iminota 3, nta kwishyurwa iminsi 30). - Injira admin.microsoft.com imbere muri kiriya gikode cyigihe gito, kanda ** Inkunga> Ubufasha & Inkunga ** mugice cyiburyo cyiburyo, hanyuma ufungure ** Severity-A Tike yo Gushyigikira Admin ** ivuga: >> *

Inzira ya 3: Gutsinda Ikipe yo Kurinda Data Microsoft (DPT) Kugenzura Igenzura & DNS TXT Ikibazo¶

Iyo injeniyeri ya Microsoft ishinzwe kurinda amakuru amaze gusaba ikibazo cyawe, bakurikiza protocole yumutekano itajegajega mbere yo kwambura MFA umuyobozi wawe wa Global cyangwa kuzamura umukoresha mushya: 1. ** Ubucuruzi & Billing nyirubwite Icyemezo: ** Gumana ibi bintu bine mububiko kugirango ubashe gusoma cyangwa kubishyira kumuhamagaro wambere: - Izina ryawe rya ** **yourcompany.com) na **onmicrosoft.com Izina ryabapangayi ** (shakisha indangamuntu yawe nyayo yo gukodesha igihe icyo aricyo cyose utiriwe usura https://login.microsoftonline.com/yourcompany.com/v2.0/.well-known/openid-configuration); - ** imibare 4 yanyuma nitariki yo kurangiriraho ikarita yinguzanyo ** kuri dosiye yo kwishyuza Microsoft (cyangwa nimero ya fagitire yubucuruzi ya Microsoft iherutse G0...); - ** aderesi nyayo yo kwishura kumuhanda na nimero ya terefone ** yanditse kurutonde rwumupangayi; na - Official ** Ingingo zo Kwishyira hamwe / Uruhushya rwubucuruzi / Umushinga w’ingirakamaro ** niba uwahoze ari umuyobozi yari umukozi wikigoryi washyize terefone yabo igendanwa. 2. ** DNS yemewe TXT Icyemezo cyanditse: ** - Injeniyeri yo Kurinda Data izaguha umugozi wihariye wo kugenzura (nka MS=ms12345678 cyangwa urubanza rwihariye) kugirango wongere nka **TXT kwandika ** ku mizi (@) ya yourcompany.com. - Rimwe nslookup -type=TXT yourcompany.com yemeza ko ibyanditswe ari bizima, injeniyeri ya DPT yongeye kugarura Global Admin's Multi-Factor Authentication kwiyandikisha (Require Re-Register MFA) kandi itanga ijambo ryibanga ryigihe gito kugirango ubashe kwinjira hanyuma wandike porogaramu nshya ya Authenticator nurufunguzo rwa FIDO2.

Inzira ya 4: Kwikorera wenyine "Gufata Imiyoborere Yimbere" (Niba Domisiyo yawe Ifunze muri "Igicungamutungo / Virusi" Igicucu)¶

Byagenda bite niba ugerageza gushiraho Microsoft 365 ya yourcompany.com, na Microsoft yerekana ikosa: "yourcompany.com is already being used with another Microsoft 365 organization", kubera ko hashize imyaka itatu umukozi udasanzwe yiyandikishije kuri Power BI kubuntu, Microsoft Amakipe ya Microsoft, cyangwa konti yo kwikorera wenyine akoresheje konti yabo @yourcompany.com imeri y'akazi? - Kuberako uwo "igicucu" ukodesha afite ** zeru Abayobozi Bakuru b'isi ** (ni ** Umukoresha wa virusi idakoreshwa **), ntabwo ** ukeneye ** guhamagara Microsoft na gato. - Urashobora gukora ako kanya ** Gufata Admin Imbere **: 1. Injira muri Microsoft 365 ukoresheje ibikorwa byose @yourcompany.com konte yumukoresha ibaho muri iyo nzu ikodesha virusi (cyangwa gukora konte yubuntu ya BI kubuntu wenyine admin@yourcompany.com). 2. Kujya kuri https://portal.office.com/admintakeover (cyangwa ukoreshe Microsoft Graph PowerShell ifata cmdlet). 3. Microsoft ihita yerekana **TXT kode yo kugenzura (MS=msXXXXXXXX) **. 4. Shyira ibyo TXT andika muri DNS yumubitsi wawe DNS, kanda ** Kugenzura **, hanyuma Microsoft ** ihite iguteza imbere kuri Global Administrator wuzuye ** muri byose yourcompany.com umukode mu masegonda 60.

Intambwe ku yindi nyuma yubugenzuzi bwumutekano nyuma yo gukira (Niba gufunga byatewe na ex-admin wanga cyangwa ubwumvikane)¶

Niba gufunga kwawe kwarabaye kubera ko uwahoze ari umuyobozi wa IT atishimiye, umushoramari wahagaritswe, cyangwa uwagabye igitero cyo hanze yakwambuye nkana uburenganzira bwawe cyangwa akanyaga konti ya Super / Global Admin, gusa kugarura kwinjira ntabwo bihagije. Umukinnyi wanga ufite Super Admin cyangwa Global Admin yinjira muminota 15 akenshi atera ** "gutsimbarara inyuma" ** kugirango bashobore kugarura bucece icyumweru gitaha na nyuma yo guhindura ijambo ryibanga nyamukuru.

Kora iyi ngingo 5 yo gutsimbarara mugihe cyiminota 30 yambere yo gusubira muri konsole yawe yagaruwe:

1. ** Kugenzura Abayobozi bashya ba serivise bashya, porogaramu ya OAuth, hamwe nijambobanga rya porogaramu: **
2. ** Muri Microsoft Entra ID (entra.microsoft.com): ** Jya kuri Identity > Applications > Enterprise applications na App registrations. Gutondekanya na ** Itariki Yashyizweho **. Admin wa rogue admin azashiraho Kwiyandikisha kwa App byihishe byemewe RoleManagement.ReadWrite.Directory cyangwa Directory.ReadWrite.All Microsoft Graph API uruhushya rwo gusaba hamwe n amezi 24 yibanga ryabakiriya. Nubwo wasiba konti yumukoresha wa rogue, inyandiko yabo ya Python irashobora gukoresha iryo banga ryabakiriya kuva murugo kugirango uzamure umukoresha mushya winyuma kuri Global Admin iri joro. Siba iyandikwa rya porogaramu ritamenyekanye cyangwa Amabanga y'abakiriya ako kanya.
3. ** Muri Google Umwanya wa Google (admin.google.com): ** Jya kuri Security > Access and data control > API controls > Manage Domain Wide Delegation. Kugenzura buri ** Google Igicu Konti ya Serivisi Yabakiriya ID ** yahawe ** Intumwa-Yagutse (https://www.googleapis.com/auth/admin.directory.user) ** no gusiba imishinga yose ya Google Cloud itamenyekanye cyangwa ibimenyetso bya OAuth.
4. ** Reba umubano w'abafatanyabikorwa (GDAP / DAP) hamwe na Cross-Tenant Igenamiterere: **
5. Muri Microsoft 365 Admin Centre, jya kuri Settings > Partner relationships. Menya neza ko rwiyemezamirimo udahwitse atigeze ahuza umuyoboro wabo bwite wa Microsoft (MPN) konte nkuherejwe na Cloud Solution Provider hamwe GDAP Uburenganzira bwa Admin ku isi.
6. Muri Microsoft Entra ID, reba External Identities > Cross-tenant access settings na Users > All users (gushungura User type == Guest hamwe na Directory Inshingano) kugenzura niba nta hanze @gmail.com cyangwa @outlook.com umukoresha wumukoresha yahawe bucece umuyobozi wisi cyangwa uruhare rwumuyobozi wihariye.
7. ** Sukura Amabanga Yihishe / Yasohokanye Amabaruwa yo Kwohereza no Kwohereza-Imodoka: **
8. Reba Exchange Admin Center > Mail flow > Rules (muri Microsoft 365) cyangwa Apps > Google Workspace > Gmail > Routing (muri Google Workspace) kumategeko yose yo gukodesha-gukodesha atuje BCC cyangwa ohereza imeri nyobozi, ijambo ryibanga-gusubiramo amahuza, cyangwa inyemezabuguzi zoherejwe kuri aderesi yo hanze.
9. ** Kuraho Byose Bikora Kuruhura Tokens hamwe na Cookies Yumukode-Mugari: **
10. Guhindura ijambo ryibanga ryumukoresha mubicu ntibishobora guhita byica OAuth ikora ibimenyetso bishya cyangwa Isuzuma rihoraho (CAE) amasomo kuri mudasobwa zigendanwa zemewe. Kanda neza ** krbtgt / Azure AD SSO Kerberos urufunguzo rwibanga niba Azure AD Connect / Entra Connect Hybrid sync yoherejwe kubibanza.
11. ** Gushoboza "Kwemeza Ubuyobozi / Kwemeza Amashyaka menshi" no Kumenyesha Inshingano: **
12. Hindura imeri ako kanya hamwe na SMS webhook imenyesha imbere ** Google Umwanya Wumuyobozi Wumwanya wo Kugenzura Ibitabo ** cyangwa ** Microsoft Entra ID ID Yihariye yo gucunga Indangamuntu (PIM) ** kugirango buri Super / Global Admin yakire ako kanya hanze ya bande igihe cyose umukoresha yongerewe mubikorwa byubuyobozi cyangwa igihe cyose igenamiterere rya MFA ryahinduwe.

Inomero zihutirwa zo mukarere hamwe na protocole yikigo¶

Ibibazo bikunze kubazwa¶

Ni ukubera iki itsinda rya Microsoft ririnda Data Data rimwe na rimwe bifata iminsi 5 kugeza 10 kugirango ufungure Admin wa Global mugihe nshobora kwerekana ko ntunze DNS kurubu?¶

Kubera ko abapangayi ba Microsoft 365 bakodesha bafite amamiliyaridi y’amadolari mu mutungo w’ubwenge, ubuyobozi bw’insinga za banki, hamwe n’amakuru ya HIPAA / GDPR, abibasiye imibereho y’imibereho bakunze kugerageza gushuka abaterankunga kugira ngo basubize MFA y’umuyobozi w’isi. Kubera iyo mpamvu, Microsoft igabanya umuyobozi wa Global MFA itemewe MFA igaruka ku gice gito, cyihariye cya Tier-3 cyiswe ** Itsinda rishinzwe kurinda amakuru (`DPT`) **. Mugihe utegereje kumurongo wa DPT: (1) hamagara inshuro imwe kumunsi werekana numero yawe ya ** 16 yimibare yimibare **, (2) saba umukozi wimbere gushira akamenyetso kuri tike nka ** "Business Critical - Total Admin Lockout hamwe na Zero Backup Admin (Severity A)" **, na (3) niba ufite umuyobozi wa konti ya Microsoft, utanga igisubizo cya Cloud (`CSP`.

Byagenda bite se niba umugizi wa nabi wahoze ari umukozi wa IT yadufungiye muri BYINSHI Microsoft 365 / Google Workspace NA Gerefiye wa Domain (GoDaddy / Cloudflare)?¶

Niba umukozi wagiye cyangwa rwiyemezamirimo yiyandikishije `yourcompany.com` munsi yo kwinjira kwabo cyangwa kugufunga muri Gerefiye yawe (GoDaddy, Namecheap, Cloudflare, Network Solutions), ugomba ** kubanza kugarura konte yumubitsi wa Domain **, kuko udashobora gutangaza Google / Microsoft DNS `TXT` iyandikwa idafite abanditsi. Buri mwanditsi wemewe na ICANN afite ** yihariye nyirubwite / Urubuga rwo kugarura amakimbirane ** (urugero, GoDaddy's `Account Recovery & Change of Update Request`). Tanga: (1) Isosiyete yawe ** Ingingo zishyirwaho / IRS EIN Ibaruwa / Kwiyandikisha mubucuruzi **, (2) kopi yindangamuntu yawe ya ** ** nkumuyobozi wibigo, na (3) ** ikarita yinguzanyo yibigo cyangwa ibyemezo bya banki ** byerekana ko isosiyete yawe yishyuye kwandikisha domaine hamwe namafaranga yo kuvugurura. Umwanditsi mukuru azohereza domaine kuri konti nshya yisosiyete mugihe cyamasaha 48 kugeza 96, ikwemerera gutangaza DNS `TXT` andika kandi usubize Google Workspace cyangwa Microsoft 365 ako kanya nyuma.

Nabona nte indangamuntu ya Microsoft Entra "Tenant ID" (UBUYOBOZI) niba buri muntu afunzwe hanze?¶

Iyo uhamagaye itsinda rya Microsoft rishinzwe kurinda amakuru, ufite inyuguti-nyayo 36-nyobora ** UMUYOBOZI W'UBUKode ** (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) yihutisha itike yo kugenda cyane. Nubwo ntamuntu numwe mubisosiyete yawe ushobora kwinjira, Microsoft ya OpenID ihuza metadata iherezo ni rusange kuri buri domeni kwisi. Fungura urubuga urwo arirwo rwose hanyuma uyohereze kuri: `https://login.microsoftonline.com/YOURDOMAIN.COM/v2.0/.well-known/openid-configuration` (gusimbuza `YOURDOMAIN.COM` hamwe nizina rya sosiyete yawe). Mu nyandiko ya JSON igaragara kuri ecran, reba URL yambere cyane nyuma `"token_endpoint"`: inyuguti 36 yinyuguti ya kode nyuma `login.microsoftonline.com/` nukuri kwawe ** Microsoft Entra Tenant ID **.

Uzasubizamo Admin wa Global cyangwa Super Admin ukoresheje DNS TXT kugenzura gusiba imeri iyo ari yo yose, dosiye ya OneDrive, cyangwa Google Drive?¶

Oya. Yaba Google Workspace DNS Admin yo kugarura imiyoborere cyangwa itsinda rya Microsoft rishinzwe kurinda amakuru MFA / gusubiramo ijambo ryibanga bikora kuri byte imwe yamakuru yamakuru yumukoresha wubutumwa, imbuga za SharePoint, ububiko bwa OneDrive, ibiganiro byamakipe, cyangwa inyandiko za Google Drive. Mubyukuri, niba uhisemo uburyo bwo kuzamura ** kumenyekanisha konti isanzwe yumukozi kuri Super Admin / Global Admin ** (aho gusubiramo ijambo ryibanga ryumukozi wagiye), agasanduku k'iposita k'umukozi hamwe na dosiye biguma bidakorwa neza kandi bikabikwa kugirango bivumburwe byemewe n'amategeko mugihe umuyobozi wawe mushya wazamuye agenzura neza konsole.

Bite ho mugihe dushizeho politike ya Microsoft Entra Conditional Access yahagaritse kubwimpanuka abakoresha BOSE (harimo na ba Admin ba Global) dusaba igikoresho cya Intune cyujuje cyangwa aderesi ya IP yihariye?¶

Ibi byitwa ** Kwisanzura Kwinjira-Kwifungisha **, nkigihe iyo admin yashizeho politike yo kwinjira igamije intego `"All Users"` na `"All Cloud Apps"` hamwe nigenzura ridashobora kunyurwa (nko gusaba Hybrid Azure AD Yinjiye igikoresho cyangwa intera ya VPN yarangiye) akibagirwa kugenzura `"Exclude Emergency Access Accounts"` agasanduku. Kuberako politiki ibuza buri admin kwinjira, ndetse no kumenya ijambo ryibanga no kugira terefone yawe ya MFA ikora ntibizakwemerera. Inzira yawe yonyine yo gutabara ni uguhamagara ** Inkunga yubucuruzi ya Microsoft **, ukazamuka kuri ** Team Data Protection Team **, unyuze DNS `TXT` kugenzura nyirubwite, hanyuma usabe injeniyeri ya DPT gukoresha igikoresho cyimbere cyimbere kugirango ** uhagarike politiki yicyaha yo kugerwaho ** kumupangayi.

Kuyobora¶

• Kwiba izina rya domaine, DNS yarangiye, no gufata urubuga
• Guhagarika konti yibicu: Google, Apple, na Microsoft bifunga
• Inomero zibiri zo kwemeza numero ya terefone yongeye gukoreshwa nuwitwaye hamwe na SMS ifunga
• Umuyobozi wibanga ryibanga, gutakaza ijambo ryibanga, no kugarura ububiko

Inkomoko nubuyobozi¶

• Google Workspace Umuyobozi Ushinzwe Ubufasha & Umutekano Inyandiko: * Kugarura Umuyobozi Kubona Konti Yawe Yumwanya wa Google (admin.google.com), Inkunga-Ifashwa DNS TXT/CNAME Kugenzura (toolbox.googleapps.com/apps/recovery/form), hamwe nuburyo bwiza bwa super Administrator Kumena-Ikirahure Konti *.
• Microsoft Wige (Microsoft Entra ID / Microsoft 365 Inyandiko): * Gucunga Konti Yihutirwa Yihutirwa muri Microsoft Entra ID, Kora Ubuyobozi bwimbere mu Gihugu butayoborwa ukoresheje DNS TXT Verification, hamwe na Global Administrator MFA Lockout Escalation ukoresheje Itsinda ririnda Data *.
• Ikigo gishinzwe umutekano wa Cyber ​​n’Ibikorwa Remezo (CISA, Amerika): * Igicu cyumutekano wibikoresho bya tekinike yububiko hamwe na CISA ScubaGear Baseline ya Microsoft 365 hamwe na Google Workspace Tenant Resilience *.
• Ikigo cy'igihugu gishinzwe ubuziranenge n'ikoranabuhanga (NIST): * Itangazwa ryihariye 800-63B (Amabwiriza y'Indangamuntu ya Digital: Kwemeza no gucunga ubuzima, Gukoresha Multi-Factor Authenticator Recovery) *.
• Isosiyete ya enterineti ishinzwe amazina n'imibare (ICANN): * Uburenganzira bwo kwiyandikisha n'inshingano hamwe na domeni yo kugenzura kugenzura amazina *.