teant block

Question

The bleeping Computer article advised to block these. Has Microsoft blocked these or done anything about them? Do you advise us to take action and block these in our tenant? We want to block the communion from these external IM'S.

securityadminhelper.onmicrosoft[.]com supportserviceadmin.onmicrosoft[.]com supportadministrator.onmicrosoft[.]com cybersecurityadmin.onmicrosoft[.]com https://www.bleepingcomputer.com/news/security/black-basta-ransomware-poses-as-it-support-on-microsoft-teams-to-breach-networks/

Answer 1

You can block them if you want to, but it takes a minute to spin up a new tenant with a similar name, so it's a futile exercise. User education is the best way to address such attacks, but you can also configure your tenant in a "whitelist" mode, so that only users from designated external domains can communicate with your users. Details are here: https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings