u/scottTang

Do you have other controls currently in place?

If you have separate admin accounts with rotating passwords that are checked-in and out of CyberArk and require MFA, your needs will be less.

The highest privilege roles would include Global Administrator, Security Administrator, Privileged Role Administrator, Privileged Authentication Administrator, and Conditional Access Administrator.

Having the Directory Reader role time bound is a stretch

The script should be assigned to devices. It will run using administrator privileges and create a firewall rule for each existing user profile on the computer

Note that it will not create a rule for any future users on the computer, although you can modify the script to do so

Possibly Cloud Application Administrator? Which has this permission

microsoft.directory/applicationPolicies/create

Keep in mind that simply blocking "chromesetup*.exe" can be averted by renaming the file

There's lots of considerations on how to do this, maybe you block all .exe's, or maybe you don't block the installation, but do block chrome.exe from running, blocking the installation file hash (updated with each version?), blocking installation path, etc.

Look into AppLocker as well vs SRP

Looking at the instructions from this (step 4),

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/mobileiron-tutorial#configure-mobileiron-sso

I gather that MobileIron has no way to upload the certificate on its own, but the public certificate from Azure is also included in the federation metadata, so you can upload the updated metadata XML file to update the certificate.

To download the metadata from Azure (step 5)

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/mobileiron-tutorial#configure-azure-ad-sso

My understanding is that the 1st article is for users logging in directly to the Snowflake portal, the other articles are for connecting to Snowflake as a data source through Power BI

This is still horrible for security. A guest VM is only as secure as the host

Windows Server training and courses are still available, even for the retired certifications. There's nothing stopping on-prem admins from learning, you just won't earn a certification.

Course WS-011T00-A: Windows Server 2019 Administration

Course WS-012T00-A: Windows Server 2019 Hybrid and Azure IaaS

Azure AD Password Protection

There's also some community tools https://evotec.xyz/pswindocumentation-audit-active-directory-passwords/

Yes, not sure how this will affect the content of MS-500 (or even AZ-500)

Most gaming headsets have poor microphones, and are generally overpriced because of their "gaming" status. Also, even if the gaming headset provides better audio quality for music, etc., PSTN calls are within a certain frequency and even a $400 headset won't make the call audio much better.

I had an Arctis Pro that I'm no longer using for work calls once I started WFH

Passwordstate can do this. Not a huge fan of the UX, but the support is pretty good

Pluralsight is free for Azure courses

https://www.pluralsight.com/partners/microsoft/azure

https://help.pluralsight.com/help/microsoft-azure-courses

AZ900 is an entry level cert, I would not be paying for any of these platforms just to get that cert, there's plenty of free resources available for it.

You need to set this on the server to allow multiple sessions for 1 account

http://remotedesktoprdp.com/force-single-session-allow-multiple-sessions-per-user

It should actually be

$password = Get-Content C:\password.txt | ConvertTo-SecureString

You can create an Active Setup key at the time the script is deployed

You're being paranoid. But your Teams messages can be reviewed even if you "delete" them. This is for legal and compliance purposes and unlikely to be done otherwise.

IT doesn't care what you spend your work hours doing on your computer, unless you're affecting security, breaking your computer, or HR/legal/your boss has requested it.

Though there is a little bit of overlap between the exams, AZ-104 is focused on Azure and infrastructure, and the M365 is focused on Azure AD/M365/identity. Enterprise Administrator Expert is also an "advanced" cert and has a prerequisite cert (minimum 3 exams total)

You can use Cloud App Security to create an alert for this

GPO's are only for on-prem Active Directory. You can use an MDM to deploy Configuration Service Providers (CSPs) which are similar.

And you can use Autopilot to enroll your devices into your MDM (Airwatch)

You should be able to get a report using the Usage & Analytics feature from the SSPR page

At a deeper level, there's a file here that gets read at the time of each user install

C:\Program Files (x86)\Teams Installer\setup.json

You can edit the autostart settings for a user by editing their file

%LocalAppData%\Microsoft\Teams\setup.json

Looking through the exam outlines for MS-100, 101, and 500 (which all focus around Azure AD and identity management), I don't see any mention of SSO at all, which is probably because Azure AD SAML SSO is incredibly simple