Using OneDrive for Business with Encryption

Microsoft provides subscribers to Office 365 unlimited cloud storage via OneDrive for Business, but it is not possible to encrypt the data in the cloud storage using the available resources. Only a few tools in this area can help with encrypting data. For example, you can use the Boxcryptor tool [5] to encrypt data using AES-256 and RSA. The data is encrypted with a password and a keyfile. If the file is lost, users won't be able to access their encrypted files. The file is stored locally and should be backed up.

A new drive is available in Explorer after logging on. Boxcryptor encrypts all data copied here. Settings can be activated and adjusted via the Boxcryptor icon context menu in the tray area of the taskbar next to the clock. The different cloud storage is connected here and activated for Boxcryptor. Data can be encrypted in the Boxcryptor drive via the context menu of encrypted files. This is useful is users want to share files via OneDrive (Figure 3).

Figure 3: You can encrypt files in OneDrive for Business using Boxcryptor.

Multifactor Authentication in Office 365

As well as email encryption, security also plays an essential role when logging on to Office 365 web services. Companies can protect particularly security critical user accounts from hacker attacks and incorrect logins by using multifactor authentication (MFA) in Office 365 (Figure 4). To begin, click Active Users in the users and groups section in the Office 365 Admin Center. Here, you'll see all the created users on the right-hand side. The Set Multi-factor authentication requirements option is in the top section. As soon as the user logs on to the Office 365 portal the next time, he or she will receive a message saying that multifactor authentication has been activated and needs to be set up.

Figure 4: Using multifactor authentication, you can increase security for users in Office 365.

As part of the setup, users can decide what kind of multifactor authentication they want to use. In a new window, you have the option to choose between mobile phone, telephone, and a mobile app. Users can also define whether they want to be called for the login or receive a text message containing a login code. The most convenient login is certainly the phone call because they only need to press the # key.

When using a mobile app, Office 365 automatically sends an authentication request to the smart phone app after the password has been entered. If you open this request, you just need to confirm the login. Even using the correct username and password wouldn't be enough for an attacker without this confirmation. Users can make changes in the user settings of their account and, for example, customize their phone number and other settings of the multifactor authentication.

Companies that use Microsoft Azure in parallel with Office 365 can expand their MFA function using Azure Active Directory Premium. This includes options to customize the appearance of the login page, reset passwords, or make this function available to users.

Office 365 PowerShell and Exchange

When Office 365 and Exchange are used in parallel, it may be useful to utilize the commands from the Exchange Management Shell in PowerShell with the Office 365 cmdlets. To do this, first save the Office 365 login data in a variable:

$cred = Get-Credential

Next, create a new PowerShell session that establishes a connection to Office 365 and Exchange Management Shell:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $cred -Authentication Basic -AllowRedirection

If you stored this data in the variable too, import it using

import-PSSession $Session

Then, you can manage local Exchange servers in a common PowerShell session and your Office 365 subscription.