Utshixiwe ngaphandle kweGoogle Workspace okanye iMicrosoft 365 Admin Console: DNS TXT Takeover and Recovery¶

Ukufumanisa ukuba inkampani yakho, inkampani yomthetho, unyango, okanye ingenzi nzuzo itshixelwe ngokupheleleyo ngaphandle kwe-Google Workspace yayo (admin.google.com)* okanye Microsoft 365 / Entra ID (admin.microsoft.com) umqeshi welifu kuba ekuphela kwakhe UMlawuli oMkhulu okanye uMlawuli weHlabathi uphulukene ne-smartphone yakhe ngeMicrosoft/Google Authenticator MFA imbewu, wayishiya inkampani ngemibandela yobutshaba waza watshintsha igama eliyimfihlo, okanye usweleke ngokungalindelekanga yingxaki ekhoyo yokuqhubeka kweshishini. Ngaphandle kofikelelo lolawulo, awunako ukongeza okanye ukususa abasebenzi, useta kwakhona amagama ayimfihlo omsebenzisi, uhlaziye amakhadi okuhlawula aphelelwayo phambi kwe-imeyile yonke yenkampani yakho (MX) kunye ne-SharePoint/Google Drive iziseko zimisiwe, okanye zirhoxise iithokheni zeseshoni ye-ex-admin ekhohlakeleyo. Ngethamsanqa, bobabini uGoogle kunye neMicrosoft injineli yamaqonga esazisi seshishini labo malunga nesiseko senyaniso ye-cryptographic: *ubunini bokugqibela obusemthethweni bomqeshi we-domain yelifu lequmrhu elilawula indawo enegunya lesizinda seDNS zowuni kwiDomain Registrar (efana ne-AWS Route 53, iGoDaddy) Nokuba ii-admins zero zinokungena kwaye zonke izixhobo zeYubiKey okanye i-Authenticator app imkile, ungenza imeko kaxakeka DNS TXT okanye CNAME Umngeni wokuThatha ubunini beDomain (mhlawumbi nge-automated kaGoogle toolbox.googleapps.com/apps/recovery/form umbhobho, Microsoft's Internal Admin Takeover (Unmanaged Tenant) flow, okanye Iqela leMicrosoft Data Protection (DPT) Itikiti loQinisekiso lwe-DNS) lokuhluba i-MFA kwi-akhawunti yolawulo etshixiweyo okanye ukukhuthaza i-akhawunti ekhoyo yomqeshwa ekhoyo kwi-Super/Global Administrator epheleleyo. Ukuba umqeshwa wangaphambili onobutshaba okanye umhlaseli we-ransomware ukhupha imali yebhanki okanye idatha yesigulana ngelixa ekuvalela ngaphandle, fowunela indawo yakho. amanani kaxakeka (911 eUnited States naseKhanada, 999 e-United Kingdom, 112 kulo lonke elase-European Union) okanye ingxelo ngokungena kwi-FBI IC3 / CISA ngokukhawuleza. Kwisizinda esiyeleleneyo, iakhawunti, kunye nezinto ezimbini zikaxakeka, bona izikhokelo zethu ukuqweqwedisa igama lesizinda, iDNS ephelelwe lixesha, kunye nokuthathwa kwewebhusayithi, Ukuvalwa kweakhawunti yelifu kunye nezibheno zokuthatha idatha, kwaye izinto ezimbini ukuqinisekiswa inombolo yefowuni kwakhona kunye nokuvalwa SMS.

Yenza oku ngoku¶

1. Khusela ufikelelo olukhawulezileyo lokungena kuMbhalisi wakho weNdawo yoLuntu kunye noMamkeli weDNS oGunyaziweyo kuqala. Phambi kokuba uchukumise uGoogle okanye iifomu zokubuyisela iMicrosoft, qinisekisa ukuba ungangena kwindawo yeDNS eGunyaziweyo kwindawo ephambili yenkampani yakho (yourcompany.com). Jonga i-Nameservers esebenzayo (NS iirekhodi) usebenzisa dig NS yourcompany.com +short okanye whois yourcompany.com. Ingaba i-DNS yakho ibanjwe kwi-Cloudflare, i-AWS Route 53, i-GoDaddy, i-Namecheap, okanye i-Network Solutions, nabani na onokupapasha entsha TXT okanye CNAME rekhoda kwingcambu (@) yommandla wakho wedomeyini ibambe isitshixo esikhulu sokungqina ubunini obusemthethweni kuGoogle nakuMicrosoft.
2. ** Phinda uphicothe nokuba LUPHI na ulawulo lwesibini okanye uMboneleli weSisombululo seLifu (CSP / Umthengisi) usenofikelelo oluyinxenye.** Imibutho emininzi ikholelwa ukuba inomlawuli "omnye" kuphela, ilibale ukuba:
3. UMboneleli weNkonzo oLawulwayo wangaphandle (MSP) okanye ** Cloud Solution Provider (CSP) umthengisi** (ofana ne-Pax8, i-Ingram Micro, i-CDW, i-Sherweb, okanye i-GoDaddy) ibambe Amalungelo oLawulo oluThunyiweyo lweGranular (GDAP / DAP) kwiMicrosoft 365 okanye umqeshi weGoogle Workspace kwaye unokuseta ngokutsha iMFA yoLawulo lweGlobal ngemizuzwana engama-60; OKANYE
4. Umphathi wesibini ubambe uMlawuli woQinisekiso oluLungelelweyo indima kwi-ID yeMicrosoft Entra (enamandla apheleleyo okuseta ngokutsha i-MFA kunye neepassword nakwiGlobal Admins).
5. Ukuba itshixiwe ngaphandle kweGoogle Workspace (admin.google.com), sungula i-DNS ezenzekelayo TXT/CNAME IWizadi yoBuyiselo yoLawulo kwangoko. Sukuchitha iintsuku ngokuzama ukusetha kwakhona igama lokugqitha le-Gmail. Yiya e admin.google.com, faka idilesi ye-imeyile yoMlawuli oyiNtloko etshixiweyo, cofa "Ulibele igama eliyimfihlo?", dlula i-MFA ikhuthaza de inkqubo ibonelele **Ukuqinisekiswa kweDomain ukubuyisela **, OKANYE uye ngqo kwi-Google ezinikele Indawo yokusebenzela iFom yoBuyiselo yeConsole yoBuyiselo (toolbox.googleapps.com/apps/recovery/form). Nikezela ngedilesi yesibini ye-imeyile efikelelekayo kwaye uncamathisele eyodwa google-site-verification=... TXT uphawu kwindawo yakho DNS zowuni.
6. Ukuba itshixiwe ngaphandle kweMicrosoft 365 (admin.microsoft.com), vula "iQela loKhuseleko lweDatha (DPT)" Ubungqongqo-Itikiti Lefowuni ngoko nangoko. Ngokungafaniyo noGoogle, iMicrosoft* ayiboneleli* ngenkonzo yewebhu yokusebenzela yoluntu ukuze idlule i-MFA kuMlawuli weHlabathi osele elawulwa ngumqeshi welizwe kuphela. Kufuneka ufowunele Inkxaso yoRhwebo yeMicrosoft (amanani adweliswe kwiTheyibhile yethu yoMmandla ngezantsi), jonga kwilizwi le-AI ngokuthi "Itshixiwe ngaphandle koMlawuli weHlabathi, zero ezinye ii-admins zikhoyo, indlela eya kwiQela lokuKhuselwa kweDatha", kwaye ufumane Inombolo yeCase yokuKhuselwa kweeDijiti ezili-16. Vula i-console yakho ye-DNS ukuze ukwazi ukupapasha ngoko nangoko uqinisekiso TXT rekhoda injineli yoKhuselo lweDatha ikuthumelela ii-imeyile.
7. Gcina ikhadi lakho lokuthenga ngetyala kwaye ungaze ukhuphe imali yokubuyisela ebhankini ngelixa uvaleleke ngaphandle. Ukuba inkampani yakho yenyanga kaGoogle Workspace okanye i-invoyisi yeMicrosoft 365 ibetha ikhadi lakho letyala ngelixa utshixelwe ngaphandle kweconsole yomlawuli, musa ukulivala ikhadi okanye uhlawule umva. Ukudala ihlazo lentlawulo okanye ukubuyisela umva kumqeshi worhwebo osebenzayo kunokubangela iinkqubo ezizenzekelayo zokuchasa ubuqhophololo ukuba zinqunyanyiswe zonke iibhokisi zeposi zabasebenzisi (550 5.1.1 User Unknown iibounces) kwaye ucwangcise iSharePoint/ugcino lweDrive ukuze lucinywe ngokusisigxina kwiintsuku ezingama-30 ukuya kwezingama-90.

Umthi wesigqibo: Ukufumana kwakhona ulawulo lwe-Google Workspace etshixiweyo okanye iMicrosoft 365 yomqeshi¶

flowchart TD
    A["Ukutshixwa ngokupheleleyo koLawulo oluPhezulu oluSole (iNdawo yokuSebenza kaGoogle) okanye iGlobal Admin (Microsoft 365)"] --> B{"Ngaba uthenge iilayisensi zakho ngoMthengisi / MSP (GoDaddy, Pax8, Ingram, CDW)?"}
    B -->|"Ewe: Ithengwe ngoMthengisi / CSP"| C["Ukulungiswa ngokukhawuleza (imizuzu eyi-15): Fowunela uMthengisi / iNkxaso ye-MSP ukusebenzisa uLawulo lwabo oluThunyiweyo (GDAP) API ukuSeta kwakhona uLawulo lwe-MFA okanye ukukhuthaza uMsebenzisi weSibini"]
    B -->|"Hayi: Kuthengwe ngqo kuGoogle okanye kuMicrosoft"| D{"Leliphi iQonga leLifu elitshixiweyo?"}
    D -->|"1. Google Workspace (admin.google.com)"| E["Inyathelo loku-1: Zama ukuFikelela kuLawulo oluSebenzayo ku-admin.google.com -> 'Zama enye indlela' -> 'Qinisekisa nge-Domain Host'"]
    E --> F{"Ngaba ukuqukuqela okuzenzekelayo kwabangela umngeni weDNS?"}
    F -->|"Ewe"| G["Yongeza Unique 'google-site-verification=...' TXT okanye CNAME Record kwi Domain Registrar; UGoogle useta kwakhona uLawulo oluPhezulu phakathi kwe-24-72 Hrs"]
    F -->|"Hayi / Form Loops"| H["Ngenisa iNkxaso-uNcedo loBuyiselo loLawulo kwi-toolbox.googleapps.com/apps/recovery/form + Nyusa uMsebenzisi oMgangatho ngeDNS TXT Ubungqina"]
    D -->|"2. Microsoft 365 / Entra ID (admin.microsoft.com)"| I{"Ngaba lo 'nguMthunzi / yiNtsholongwane' engaLawulwanga ngumqeshi okanye nguMqeshi oLawulwa ngokuGqibeleleyo woRhwebo?"}
    I -->|"Isithunzi / Umqeshi weNtsholongwane (Abasebenzi ababhalise ngePowerBI/Amaqela ovavanyo lwasimahla)"| J["Senze iSelf-Service 'Internal Admin Takeover' ngePowerShell / M365 Wizard usebenzisa uQinisekiso lwe-DNS TXT yangoko"]
    I -->|"Umqeshi oPhetheyo oLawulwayo kwezoRhwebo (uMlawuli weHlabathi oyedwa ulahlekelwe yi-MFA / ekhohlo / wasweleka)"| K["Fowunela iNkxaso yezoRhwebo yeMicrosoft-> Cela 'iQela loKhuseleko lweDatha (DPT)' Ukunyuka -> Dlula iDNS TXT + uPhicotho loBunini beShishini"]

I-Google Workspace vs. Microsoft 365: Ulwakhiwo lokubuyisela umqeshi lwahluka njani¶

Ngelixa bobabini uGoogle kunye noMicrosoft baxhomekeke kwi-*Authoritative DNS TXT Ukuqinisekiswa ** ukubonisa ukuba ngubani ophethe ngokusemthethweni igama lesizinda eliqhotyoshelwe kumqeshi wefu, ukuhamba komsebenzi wabo wokubuyisela ulawulo kwahluke kakhulu. Ukwazi ukuba zeziphi iilevers ezikhoyo kwiqonga ngalinye kuya kongela iintsuku zamatikiti enkxaso yokuphela:

Playbook 1: Ukuhlangula i-Google Workspace Super Admin etshixiweyo (admin.google.com)¶

Ukuba utshixelwe ngaphandle kweakhawunti yakho yoLawulo oluPhezulu lukaGoogle, nokuba ifowuni yakho enoMqinisekisi kaGoogle yaphukile, isitshixo sakho sokhuseleko seFIDO2 silahlekile, ikontraka yeIT eshiyiweyo yatshintsha igama eligqithisiweyo, okanye uyenzile. "Enforce 2-Step Verification" ngaphandle kokubhalisa iakhawunti yomlawuli kuqala, yenza la manyathelo mathathu ngolandelelwano oluchanekileyo:

Indlela A: I-Automated admin.google.com Umngeni woQinisekiso lweDomain (Eyona ikhawulezayo - 1 ukuya kwiiyure ezingama-24)¶

1. Vula i-Incognito / i-browser yefestile yabucala kwikhompyuter ebekwe kwi-ofisi yakho eqhelekileyo okanye kwinethiwekhi yeWi-Fi yasekhaya* (injini yomngcipheko kaGoogle ifumana amanqaku aqhelekileyo e-IP aphezulu) kwaye uye ku https://admin.google.com.
2. Ngenisa idilesi ye-imeyile yoMlawuli oyitshixiweyo (admin@yourcompany.com) kwaye ucofe Okulandelayo.
3. Ukuba uyayazi i-password kodwa uvalwe ngu 2-Step Verification (MFA), faka igama lokugqitha, uze ucofe "Zama enye indlela" emazantsi esikrini se-2FA de ukhuphe zonke iindlela ezingafumanekiyo. Ukuba awulazi igama eliyimfihlo, cofa "Ulibele igama eliyimfihlo?" kwaye ucofe "Zama enye indlela" udlula umyalelo ngamnye ongafumanekiyo.
4. Nje ukuba zonke iinketho ezisemgangathweni zokubuyisela ziphelile kwi-domain ye-Google Workspace yomlawuli omnye, i-injini kaGoogle yokubuyisela i-automated inikezela nge- Domain Ownership Verification screen:
5. Ikwenza ukuba ufake idilesi yeimeyile onokuyijonga ngoku (efana neyakho @gmail.com idilesi okanye idilesi ye-imeyile yomsebenzi osemgangathweni osebenzayo).
6. UGoogle uthumela iimeyile eneyahlukileyo CNAME okanye TXT irekhodi yokuqinisekisa imiyalelo.
7. Ngena kwiphaneli yolawulo yeDNS yombhalisi wesizinda sakho (Cloudflare, Route 53, GoDaddy, Namecheap) kwaye wongeze eyona ichanekileyo. TXT okanye CNAME rekhoda kwingcambu (@) ye yourcompany.com nge TTL yemizuzwana engama-300 (imizuzu emi-5).
8. ** Ingcebiso yePro kubasebenzisi beCloudflare: ** Ukuba ukongeza i CNAME irekhodi yokuqinisekisa ngaphakathi kwe-Cloudflare DNS, cofa i-Orange Cloud icon ukuyijika ibe Grey (DNS Only). Ukuba Cloudflare's Orange Cloud (Proxied) ishiywe yenziwe kuqinisekiso CNAME, I-Cloudflare ibamba umbuzo kwaye ibuyisela i-IPs yommeli we-Cloudflare endaweni yetekeni elindelwe kaGoogle ye-CNAME, ibangela ukuba uqinisekiso lusilele lonke ixesha.

Indlela B: I-Portal yoBuyiselo loBuyiselo lweKhonsoli yeNkxaso (toolbox.googleapps.com/apps/recovery/form)¶

Kuthekani ukuba ilophu yokungena ezenzekelayo ithi nje "Qhagamshelana nomphathi wendawo yakho ukuze ufumane uncedo" (impoxo xa ungum umlawuli wendawo) okanye "uGoogle akakwazanga kuqinisekisa ukuba le akhawunti yeyakho"?

Sebenzisa uGoogle ozinikeleyo, ongagunyaziswanga Indawo Yokusebenzela yoBuyiselo lweAkhawunti yeAkhawunti: 1. Vula https://toolbox.googleapps.com/apps/recovery/form kwibhrawuza yakho. 2. Ngenisa eyakho iGoogle Workspace ephambili igama lesizinda (umzekelo, yourcompany.com) kwaye ugcwalise iCAPTCHA. 3. Khetha eyona ndlela yonxunguphalo: - Okanye cela igama lokugqitha/2FA ukuseta ngokutsha kwiakhawunti etshixiweyo yoLawulo Oluphezulu; OKANYE - Iyacetyiswa ukuba umlawuli wangaphambili unobutshaba/uswelekile: Khetha ukhetho loku ukukhuthaza iakhawunti yomsebenzisi eqhelekileyo kwindawo yakho (you@yourcompany.com) kuMlawuli oMkhulu. 4. Nika idilesi ye-imeyile yoqhagamshelwano yesibini esebenzayo apho unokufumana uhlaziyo lwetikiti. 5. Inkqubo kaGoogle ivelisa kwangoko iNombolo yeReferensi yetikiti kwaye ikuthumelele i-imeyile ekhethekileyo TXT ixabiso lokurekhoda (ifomathwe njenge google-site-verification=rXOxyZ... okanye google-workspace-recovery=...). 6. Papasha oko TXT rekhoda kwindawo yakho ye-DNS kawonke-wonke, qinisekisa ngokuthe ngqo kwi-terminal ukuba iphila kwihlabathi jikelele ngokuqhuba:

dig TXT yourcompany.com @8.8.8.8 +short

I-Playbook 2: Ukuhlangula iMicrosoft 365 etshixiweyo / i-ID ye-Entra yoMlawuli weGlobal (admin.microsoft.com)¶

Ukuvalwa kweMicrosoft 365 kunzima kunokuvalwa kweGoogle Workspace ukuba awuwazi amajelo onyukayo, kuba inkqubo yefowuni yangaphambili yeMicrosoft izama ukuxelela abafowunayo ukuba "ngena kwiZiko loLawulo ukuze uvule itikiti lenkxaso", ukwenza iluphu xa uvaleleke ngaphandle kweZiko loLawulo.

Nazi iindlela ezine ezichanekileyo zobugcisa kunye nenkqubo ** zokuphuma ku-Microsoft 365 Global Admin lockout:

Umendo 1: "Umlawuli ofihlakeleyo wesibini" & .onmicrosoft.com Ukujonga okudlulayo (Jonga oku kuQala kwiMizuzu emi-5)¶

Ngaphambi kokuba uhlale ubambe kunye neQela loKhuseleko lweDatha likaMicrosoft, jonga izinto ezintathu ezihlangula iipesenti ezingama-40 zabaqeshi be-M365 "abavalelwe ngaphandle" kwangoko: 1. Ngaba iseva ye-SSO / Federation eyaphukileyo (Okta, Duo, Cisco, ADFS) ukutshixela ngaphandle? - Xa udibanisa yourcompany.com kuMboneleli weSazisi womntu wesithathu (IdP) kunye nesa satifikethi se-IdP siphelelwa okanye sikutshixe ngaphandle, ungene njenge admin@yourcompany.com ikuthumela kwakhona kwi-IdP eyaphukileyo. - Ulungiso olukhawulezileyo: Wonke umqeshi weMicrosoft 365 unendawo yokubuyisela umva yelifu kuphela ephela ngo @yourtenant.onmicrosoft.com. Yiya ku https://entra.microsoft.com, uhlobo admin@yourtenant.onmicrosoft.com (okanye nayiphi na igama lomsebenzisi loLawulo lweGlobal ekhoyo kwi .onmicrosoft.com indawo), kwaye ungene. .onmicrosoft.com Ii-akhawunti ZIHLALA zigqitha kwiqela lesithathu kwi-SAML/WS-Fed federation kwaye iqinisekise ngokuthe ngqo ngokuchasene ne-ID ye-Microsoft Entra. 2. Ngaba nawuphi na umsebenzi we-IT ubambe indima "yoMlawuli woQinisekiso oluLungelelekileyo"? - Iinkampani ezininzi zinika umphathi we-IT uMlawuli woQinisekiso oluLungelelweyo indima ngaphandle kokubenza babe nguMlawuli opheleleyo weGlobal. Kwi-ID ye-Microsoft Entra, UMlawuli woQinisekiso oneNgcaciso unemvume epheleleyo esemthethweni yokuseta kwakhona amagama ayimfihlo KWAYE urhoxise/ufune kwakhona i-MFA yoMlawuli weHlabathi. 3. Ngaba uthenge nelayisensi ENYE ngoMthengisi we-CSP (GoDaddy, Pax8, Sherweb, Ingram, CDW, Rackspace)? - Jonga ingxelo yekhadi lakho letyala. Ukuba ityala lakho likaMicrosoft 365 livela kwiqabane kunokuba lisuka ngqo MICROSOFT*G..., fowunela idesika yenkxaso yeqabane ngoku. Nokuba bakuthengise kuphela $ 6 Exchange Online ilayisenisi, ukuba GDAP (Granular Delegated Admin Privileges) ubudlelwane busebenza kwiziko lakho le-Partner Centre, injineli yabo inokusetha kwakhona i-MFA yoLawulo lwe-Global phantsi kwemizuzu emi-3.

Umendo 2: Ufikelelwa njani kwi "Microsoft Data Protection Team (DPT)" Xa ii-Zero Admins zinokungena¶

Ukuba uthenga ngokuthe ngqo kuMicrosoft kwaye ekuphela koMlawuli weGlobal utshixelwe ngaphandle ngokupheleleyo (ifowuni yoQinisekiso elahlekileyo, okanye ibanjwe kuthungelwano apho iMicrosoft Authenticator ikucela ukuba uvumele inombolo enedijithi ezi-2 ngaphakathi kweMicrosoft Authenticator app ozama ukungena kuyo ngoku), kufuneka ** kufuneka** ube nomntu Iqela leMicrosoft Data Protection (DPT) injineli yenza uBunini boMqeshi & noQinisekiso lwe-DNS yokuSeta kwakhona.

Ungagqitha njani kumthi wefowuni we-AI weMicrosoft (IVR) kwimizuzu emi-2: 1. Fowunela ingingqi inombolo yeMicrosoft Commercial Support (umzekelo, 1-800-865-9408 okanye 1-800-642-7676 e-US/Canada; bona uluhlu olupheleleyo lwehlabathi ngezantsi). 2. I-automated voice bot icwangciswe ukuba ijike iminxeba eyimfihlo esemgangathweni aka.ms/sspr. Sebenzisa la mabinzana athethiweyo kanye kumyalelo ngamnye: - I-Prompt 1 ("Ufowunela ntoni?"): Yitsho ngokucacileyo: "Ukuvalwa kwe-akhawunti yoMlawuli weHlabathi." - I-Prompt 2 ("Ngaba ukhe wazama ukuSeta kwakhona igama lokugqithisa leSelf-Service?"): Yithi: "Ewe, ndim ndedwa uMlawuli weHlabathi kumqeshi weshishini lorhwebo kwaye kukho iqanda labanye abalawuli." - Ukwazisa 3 ("Yeyiphi imveliso?"): Yithi: "Microsoft 365 Business / Entra ID Commercial" kwaye ucele "Ukutshintshela kwiQela lokuKhusela iDatha." 3. Kungathini ukuba umthi wefowuni usakuxhoma? Sebenzisa i "Trial Tenant Bridge Trick": - Le yeyona ndlela yongxamiseko eyaziwayo ye-sysadmin xa ifowuni yeMicrosoft IVR yala ukukuqhagamshela: Yiya ku. microsoft.com/microsoft-365/business, vula isithuba sasimahla seentsuku ezingama-30 Isilingo Microsoft 365 Umqeshi usebenzisa indawo yokulahla temprescue-[yourcompany].onmicrosoft.com igama (kuthatha imizuzu emi-3, akukho ntlawulo yeentsuku ezingama-30). - Ngena admin.microsoft.com ngaphakathi kweso silingo somqeshi wexeshana, cofa ** Inkxaso > Uncedo & neNkxaso ** kwikona esezantsi ekunene, kwaye uvule i-*Bungqongqo-A Itikiti leNkxaso yoLawulo ** elichaza: > "UKUKHUSUKA KWEQELA LOKUKHUSELA IDATHA EZIXHAMISEKILEYO: Ndivula eli tikiti kumqeshi webhulorho wexeshana kuba ndim ndedwa uMlawuli weHlabathi wemveliso yomqeshi [YOURREALDOMAIN.COM / ID yoMqeshi] kwaye nditshixelwe ngokupheleleyo ngaphandle kwe-MFA kunye nezinye ii-Global Admins zero. Nceda uthumele eli tikiti kwiQela leMicrosoft Data Protection ngoko nangoko."

Umendo 3: Ukugqithisa iQela leMicrosoft Data Protection (DPT) uQinisekiso loPhicotho & DNS TXT Umngeni¶

Nje ukuba iNjineli yeQela loKhuseleko lweDatha yeMicrosoft ibange ityala lakho, balandela umthetho ongqongqo wokhuseleko we-zero-trust ngaphambi kokuba bahlube i-MFA kuMlawuli wakho weHlabathi okanye bakhuthaze umsebenzisi omtsha: 1. Ubungqina boShishino kunye noBunini beeBhili: Gcina ezi zinto zine zilungile kwifolda ukuze ukwazi ukuzifunda okanye uzilayishe kumnxeba wokuqala: - Yakho Igama leDomain (yourcompany.com) kunye **onmicrosoft.com Igama lomqeshi ** (fumana i-ID yakho ye-ID yoMqeshi nanini na ngaphandle kokungena ngokundwendwela https://login.microsoftonline.com/yourcompany.com/v2.0/.well-known/openid-configuration); - amanani ama-4 okugqibela kunye nomhla wokuphelelwa kwekhadi letyala kwifayile ye-Microsoft billing (okanye iinombolo ze-Invoyisi zoRhwebo zakutshanje zikaMicrosoft G0...); - I echanekileyo idilesi yesitalato yokuhlawula kunye nenombolo yefowuni edweliswe kwiProfayili yoMbutho womqeshi; kwaye - Esemthethweni Amanqaku okuBandakanywa / iLayisensi yoShishino / iBhilyokuSebenza ** ukuba umlawuli wangaphambili wayengumqeshwa okhohlakeleyo obeke ifowuni yakhe kwiprofayili. 2. I-DNS egunyazisiweyo TXT Ingxelo yobungqina: - Injineli yoKhuseleko lweDatha iya kukunika umtya wokuqinisekisa owahlukileyo (onje MS=ms12345678 okanye umqondiso wemeko ethile) ukongeza njenge **TXT irekhodi ** kwingcambu (@) ye yourcompany.com. - Kanye nslookup -type=TXT yourcompany.com iqinisekisa ukuba irekhodi liyaphila, injineli ye-DPT iphinda imisele i-Global Admin's Multi-Factor Authentication registration (Require Re-Register MFA) kwaye ikhupha igama lokugqitha lexeshana ukuze ukwazi ukungena kwaye ubhalise i-app entsha yoMqinisekisi kunye nesitshixo seFIDO2.

Umendo 4: Ukuzisebenzela "UkuThatha uLawulo lwaNgaphakathi" (Ukuba iDomain yakho itshixiwe "Kungalawulwayo / iViral" yeShadow Tenant)¶

Kuthekani ukuba uzama ukuseta iMicrosoft 365 yourcompany.com, kwaye iMicrosoft ibonisa impazamo: "yourcompany.com is already being used with another Microsoft 365 organization", kuba kwiminyaka emithathu eyadlulayo umsebenzi ongaqhelekanga wabhalisela i-Power BI yasimahla, iMicrosoft Teams Exploratory, okanye iakhawunti yokuzenzela iFabric usebenzisa @yourcompany.com imeyile yomsebenzi? - Ngenxa yokuba eso "sithunzi" umqeshi une zero Global Administrators (yinto I-Viral Tenant engaLawulwanga), awufuni*** ukufowunela iNkxaso yeMicrosoft konke konke. - Unokwenza oko nangoko Ulawulo lwangaphakathi lokuThatha: 1. Sayina ungene kuMicrosoft 365 usebenzisa nayiphi na esebenzayo @yourcompany.com Iakhawunti yomsebenzisi ekhoyo kuloo mqeshi wentsholongwane (okanye wenze i-akhawunti yenkonzo ye-Power BI yasimahla nge admin@yourcompany.com). 2. Yiya ku-https://portal.office.com/admintakeover (okanye sebenzisa iMicrosoft Graph PowerShell takeover cmdlet). 3. UMicrosoft ubonisa kwangoko TXT ikhowudi yokuqinisekisa (MS=msXXXXXXXX). 4. Ncamathelisa oko TXT rekhoda kwi-DNS yombhalisi wedomeyini yakho, cofa Qinisekisa, kwaye iMicrosoft ** ikunyusele ngoko nangoko kuMlawuli opheleleyo weGlobal** wayo yonke yourcompany.com umqeshi kwimizuzwana engama-60.

Inyathelo ngenyathelo emva kophicotho lokhuseleko (Ukuba ukutshixwa kubangelwe ngumlawuli onobutshaba okanye ukuthotywa)¶

Ukuba ukuvalwa kwakho ngaphandle kwenzeke ngenxa yokuba owayesakuba ngumlawuli we-IT owayenganelisekanga, uqhawulo-msebenzi wekontraka, okanye umhlaseli wangaphandle uye wahlutha amalungelo akho ngabom okanye waqweqwedisa iakhawunti yoLawulo lwe-Super/Global, ukuphinda ufumane imvume yokungena akwanelanga. Umdlali weqonga onobutshaba obenofikelelo kwiSuper Admin okanye kwiGlobal Admin nakwimizuzu eli-15 uhlala etyala "ukuzingisa ngasemva" ukuze baphinde bathule baphinde balawule kwiveki ezayo nasemva kokuba utshintshe igama eliyimfihlo.

Yenza oku kuzingisa kwamanqaku ama-5 kwimizuzu engama-30 yokuqala yokungena kwakhona kwikhonsoli yakho efunyenweyo:

1. Phicotha iiNqununu zeNkonzo ezisandula ukuYilwa, ii-Apps ze-OAuth zeShishini, kunye namagama okugqithisa we-App:
2. Kwi-ID yeMicrosoft Entra (entra.microsoft.com): Yiya ku Identity > Applications > Enterprise applications kwaye App registrations. Hlela nge Umhla wokudala. Umlawuli ophucukileyo uya kudala uBhaliso losetyenziso olufihliweyo olunikezelweyo RoleManagement.ReadWrite.Directory okanye Directory.ReadWrite.All Iimvume zesicelo ze-Microsoft Graph API ezineMfihlo yoMthengi weenyanga ezingama-24. Nokuba ucima iakhawunti yomsebenzisi yomlawuli okhohlakeleyo, iskripthi sabo sePython sinokusebenzisa loo Mfihlo yoMthengi ukusuka ekhaya ukukhuthaza umsebenzisi omtsha wasemva kwiGlobal Admin namhlanje ebusuku. Cima naluphi na uBhaliso lwe-App olungaziwayo okanye iiMfihlo zabaThengi ngoko nangoko.
3. KuGoogle Workspace (admin.google.com): Yiya ku Security > Access and data control > API controls > Manage Domain Wide Delegation. Jonga yonke I-ID yoMthengi kwi-akhawunti yeLifu likaGoogle ethe yanikwa iDomain-Wide delegation (https://www.googleapis.com/auth/admin.directory.user) kwaye ucime naziphi na iiprojekthi zeLifu likaGoogle ezingaziwayo okanye iithokheni ze-OAuth.
4. Jonga uBudlelwane baMaqabane (GDAP / DAP) kunye neSetingi zokuFikelela kuMqeshisi:
5. KwiZiko loLawulo leMicrosoft 365, yiya ku Settings > Partner relationships. Qinisekisa ukuba unokontraka okhohlakeleyo khange adibanise eyabo iMicrosoft Partner Network (MPN) iakhawunti njengoMboneleli weSisombululo seLifu othunyiweyo nge GDAP Amalungelo olawulo lwehlabathi.
6. Kwi-ID yeMicrosoft Entra, jonga External Identities > Cross-tenant access settings kwaye Users > All users (uhluzo lwe User type == Guest kunye neMisebenzi yoLawulo eyabelweyo) ukuqinisekisa ukuba akukho bangaphandle @gmail.com okanye @outlook.com Umsebenzisi weendwendwe wabelwa ngokuthe cwaka njengoMlawuli weHlabathi okanye indima yoMlawuli weNdawo eNgcono.
7. Coca iMithetho yeNdlela eNgenelweyo eNgaphakathi/eNgaphandle eNgaphandle kunye noThutho oluzenzekelayo:
8. Khangela Exchange Admin Center > Mail flow > Rules (kwiMicrosoft 365) okanye Apps > Google Workspace > Gmail > Routing (kwindawo yokusebenzela kaGoogle) kuyo nayiphi na imithetho yothutho ethe cwaka BCC okanye uqondise kwakhona ii-imeyile zesigqeba, iilinki zokuseta kwakhona igama-mfihlo, okanye ii-invoyisi zokudlulisela ngocingo kwidilesi yangaphandle.
9. Rhoxisa zonke iiTokens zokuhlaziya ezisebenzayo kunye neeSeshini zeKuki umqeshi oBanzi:
10. Ukutshintsha igama eligqithisiweyo lomsebenzisi kubume belifu akusoloko kubulala ngoko nangoko iithokheni zokuvuselela i-OAuth okanye uVavanyo loFikelelo oluQhubekayo (CAE) iiseshini kwiilaptops esele ziqinisekisiwe. Cofa ngokuthe gca "Hoxisa iiseshoni / Phuma kuzo zonke iiseshini" kwi-akhawunti yolawulo esetyenzisiweyo kwaye ujikelezise krbtgt / Azure AD SSO Kerberos decryption isitshixo ukuba Azure AD Connect / Entra Connect Ungqamaniso oluxubileyo lubekwe kwindawo.
11. Vumela "uMvumo woLawulo / ukuVunywa kwamaQela amaninzi" kunye noKwazisa ngezabelo zendima:
12. Qwalasela i-imeyile ekhawulezileyo kunye nesaziso se-SMS sewebhu ngaphakathi Ii-Google Workspace Admin Audit Logs okanye Microsoft Entra ID Privileged Identity Management (PIM) ukuze wonke Super/Global Admin ifumana isilumkiso ngoko nangoko ngaphandle-of-band nanini na umsebenzisi wongezwa indima yolawulo okanye nanini na iisetingi MFA zilungiswa.

Iinombolo zengingqi zikaxakeka kunye neeprothokholi ze-arhente¶

Imibuzo ebuzwa qho¶

Kutheni le nto iMicrosoft's Data Protection Team ngamanye amaxesha ithatha i-5 ukuya kwiintsuku ze-10 ukuvula i-Global Admin xa ndikwazi ukubonisa ukuba ndingumnikazi we-DNS ngoku?¶

Ngenxa yokuba abaqeshi bezorhwebo be-Microsoft 365 bahlala bebamba iibhiliyoni zeedola kwipropathi yobukrelekrele, igunya locingo lwebhanki, kunye nedatha ye-HIPAA/GDPR, abahlaseli bobunjineli bezentlalo bahlala bezama ukukhohlisa iiarhente zenkxaso ukuba zisete kwakhona i-MFA yoLawulo lweHlabathi. Ngenxa yoko, i-Microsoft ithintela ukusetwa ngokutsha kweGlobal MFA okungavunywanga kwiyunithi encinci, ekhethekileyo yeTier-3 ebizwa **Iqela loKhuselo lweDatha (`DPT`)**. Ngelixa ulindile emgceni we-DPT: (1) phinda ufowunele kanye ngemini ubhekisa **Inombolo yeCase enedijithi ezili-16**, (2) cela i-arhente yomgca wangaphambili ukuba imakishe itikiti njenge **"Business Critical - Total Admin Lockout with Zero Backup Admins (Severity A)"**, kunye (3) ukuba une Account Executive, Cloud Solution Provider (`CSP`), okanye ikhontrakthi yeNkxaso eManyeneyo, bacele ukuba bangenise ngaphakathi **"CritSit" (Imeko eCritical)** ukunyuka kwinombolo yetyala lakho, eliqhelekileyo linciphisa ixesha lokuphendula le-DPT phantsi kweeyure ezingama-24.

Kuthekani ukuba owayesakuba ngumqeshwa we-IT wasitshixa ngaphandle kwe-ZOBINI iMicrosoft 365/Google Workspace KUNYE ne-Domain Registrar yethu (GoDaddy / Cloudflare)?¶

Ukuba umqeshwa omkileyo okanye ikontraka ibhalisiwe `yourcompany.com` phantsi kokungena kwabo okanye bakutshixe ngaphandle koMbhalisi wakho weDomain (GoDaddy, Namecheap, Cloudflare, Network Solutions), kufuneka **ufumane kwakhona iakhawunti yoBhaliso lweDomain kuqala**, kuba awukwazi ukupapasha iGoogle/Microsoft DNS `TXT` irekhodi ngaphandle kofikelelo lombhalisi. Yonke iregistra evunyiweyo ye-ICANN ine- **Domain Ownership / Account Recovery Dispute Portal** (umzekelo, iGoDaddy's `Account Recovery & Change of Update Request`). Ngenisa: (1) yenkampani yakho **Amanqaku okuBandakanywa / Ileta ye-IRS EIN / uBhaliso lweShishini**, (2) ikopi ye-ID yakho ye-ID yeFoto kaRhulumente ** njengegosa loshishino, kunye (3) **ikhadi letyala lenkampani okanye iziteyitimenti zebhanki ** ebonisa ukuba inkampani yakho ihlawule ukubhaliswa kwesizinda kunye nemirhumo yokuhlaziya. Umbhalisi uya kudlulisela i-domain kwi-akhawunti entsha yenkampani ngaphakathi kwe-48 kwiiyure ze-96, ikuvumela ukuba ushicilele i-DNS. `TXT` Rekhoda kwaye ubuyisele iGoogle Workspace okanye iMicrosoft 365 ngoko nangoko emva koko.

Ndisifumana njani i-ID yam yeMicrosoft Entra "ID yoMqeshi" (GUID) ukuba wonke umntu utshixiwe ngaphandle kwesango?¶

Xa ufowunela iQela loKhuseleko lweDatha yakwaMicrosoft, eneempawu zakho ezingama-36 kanye **I-ID yoMqeshi GUID** (`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) ikhawulezisa indlela yetikiti ngokukhawuleza. Nokuba akukho mntu kwinkampani yakho onokungena, isiphelo semetadata ye-OpenID ye-Microsoft isesidlangalaleni kuyo yonke isizinda sehlabathi. Vula nasiphi na isikhangeli sewebhu kwaye uye ku: `https://login.microsoftonline.com/YOURDOMAIN.COM/v2.0/.well-known/openid-configuration` (ukutshintsha `YOURDOMAIN.COM` ngegama lesizinda senkampani yakho). Kumbhalo we-JSON ovela kwisikrini, jonga i-URL yokuqala emva koko `"token_endpoint"`: ikhowudi yealphanumeric enamagama angama-36 emva koko `login.microsoftonline.com/` yeyona nto yakho **Isazisi seMicrosoft Entra Tenant**.

Uya kusetha kwakhona i-Global Admin okanye i-Super Admin nge-DNS TXT Ukuqinisekisa ukucima naziphi na ii-imeyile, iifayile ze-OneDrive, okanye amaxwebhu kaGoogle Drive?¶

Hayi. Ayiyiyo iGoogle Workspace DNS Admin Recovery flow okanye iMicrosoft Data Protection Team MFA/password reset ukubamba ibyte enye yedatha yemeyile yomsebenzisi, iisayithi zeSharePoint, iifolda zeOneDrive, Amaqela encoko, okanye amaxwebhu kaGoogle Drive. Enyanisweni, ukuba ukhetha ukhetho ** ukukhuthaza i-akhawunti yomsebenzi osemgangathweni okhoyo kwi-Super Admin / i-Global Admin ** (kunokusetha kwakhona igama eligqithisiweyo lomqeshwa elishiyiweyo), ibhokisi yeposi yomqeshwa oshiyiweyo kunye neefayile zihlala zingachukunyiswanga ngokupheleleyo kwaye zigcinelwe ukufunyanwa ngokusemthethweni ngelixa umlawuli wakho osanda kunyuswa ethatha ulawulo olupheleleyo lwe-console.

Kuthekani ukuba simisela umgaqo-nkqubo we-Microsoft Entra Conditional Access ovale ngempazamo BONKE abasebenzisi (kuquka ii-Global Admins) ngokufuna isixhobo esithobelayo se-Intune okanye idilesi ethile ye-IP?¶

Oku kubizwa ngokuba yi **Conditional Access Self-Lockout**, njengaxa umlawuli esenza umgaqo-nkqubo woFikelelo ngokoMqathango ekujoliswe kuwo. `"All Users"` kwaye `"All Cloud Apps"` ngolawulo olungenakwaneliswa (njengokufuna iHybrid Azure AD isixhobo esiDityanisiweyo okanye uluhlu lwe-IP ephelelwe lixesha lwe-VPN) kwaye ulibale ukujonga `"Exclude Emergency Access Accounts"` ibhokisi. Kuba umgaqo-nkqubo uvalela wonke umlawuli ekungeneni, kwanokwazi igama eliyimfihlo kunye nefowuni yakho yeMFA esebenzayo akuyi kukuvumela ukuba ungene. Indlela yakho yokuhlangula kuphela kukufowunela **iMicrosoft Commercial Support**, uye kwi **Iqela loKhuseleko lweDatha**, ugqithise iDNS `TXT` ukuqinisekiswa kobunini, kwaye ucele injineli ye-DPT ukuba iqhube isixhobo sayo sangaphakathi sangaphakathi ukuvala umgaqo-nkqubo woFikelelo oluKhuselekileyo** kumqeshi wakho.

Izikhokelo ezinxulumeneyo¶

• Ukuqweqwediswa kwegama lesizinda, iDNS ephelelwe lixesha, kunye nokuthathwa kwewebhusayithi
• Ukuvalwa kweakhawunti yelifu: uGoogle, iApple, kunye nezibheno zokutshixa zeMicrosoft
• Inombolo yefowuni yongqinisiso lwezinto ezimbini iye yaphinda yasetyenziswa ngumthuthi kunye nokuvalwa kweSMS
• Ukuvalwa komphathi wegama lokugqithisa, ukulahleka kwegama eliyimfihlo, kunye nokubuyisela i-vault

Imithombo kunye nezikhokelo ezisemthethweni¶

• UNcedo loMlawuli weNdawo yokuSebenza kaGoogle kunye noxwebhu loKhuseleko: Buyisela kwakhona uMlawuli ufikelelo kwiAkhawunti yakho yeGoogle Workspace (admin.google.com), i-DNS eNcedayo TXT/CNAME Ukuqinisekisa (toolbox.googleapps.com/apps/recovery/form), kunye neZenzo eziNgcono zoLawulo oluPhezulu lweeAkhawunti zeGlasi.
• I-Microsoft Funda (i-Microsoft Entra ID / Microsoft 365 Documentation): Lawula iiAkhawunti zoFikelelo oluNgxamisekileyo kwi-ID ye-Microsoft Entra, Yenza i-Internal Admin Takeover kuluhlu olungaLawulwanga ngoQinisekiso lwe-DNS TXT, kunye neGlobal Administrator MFA Lockout Escalation ngeQela lokuKhusela iDatha.
• I-Cybersecurity kunye ne-Arhente yoKhuseleko lweZiseko (i-CISA, eUnited States): I-Cloud Security Technical Reference Architecture kunye ne-CISA ScubaGear Baselines for Microsoft 365 kunye ne-Google Workspace Resilience.
• Iziko leSizwe leMigangatho kunye neTeknoloji (NIST): * Ushicilelo oluKhethekileyo lwe-800-63B (Izikhokelo zeSazisi seDijithali: uQinisekiso kunye noLawulo loBomi, ukuBuyiselwa koQinisekiso lwe-Multi-Factor) *.
• I-Intanethi ye-Intanethi yaMagama aBelweyo kunye namanani (ICANN): Amalungelo oBhaliso kunye neemfanelo kunye neeProtokholi zoQinisekiso lweGama leDomain.