{"id":343,"title":"Azure AD Security Defaults: K\u00fc\u00e7\u00fck ve Orta \u00d6l\u00e7ekli \u0130\u015fletmeler \u0130\u00e7in Kritik G\u00fcvenlik Kalkan\u0131","content":"<p>Bu makalede, Microsoft 365 Y&ouml;netim alan\u0131n\u0131zda&nbsp;<strong>G&uuml;venlik Varsay\u0131lanlar\u0131n\u0131 nas\u0131l etkinle\u015ftirip devre d\u0131\u015f\u0131&nbsp;<\/strong>b\u0131rakaca\u011f\u0131n\u0131z\u0131 g&ouml;sterece\u011fiz. Microsoft 365'teki G&uuml;venlik Varsay\u0131lanlar\u0131,&nbsp;<strong>&ccedil;ok fakt&ouml;rl&uuml; kimlik<\/strong>&nbsp;do\u011frulamay\u0131 uygulayarak ve&nbsp;<strong>eski kimlik do\u011frulama y&ouml;ntemlerini engelleyerek<\/strong> hesap korumas\u0131n\u0131 art\u0131ran &ouml;nceden yap\u0131land\u0131r\u0131lm\u0131\u015f ayarlard\u0131r &ndash; t&uuml;m kullan\u0131c\u0131lar i&ccedil;in temel ve etkili g&uuml;venlik sa\u011flar.<\/p>\n<p>Microsoft Azure Active Directory'nin sundu\u011fu Security Defaults (G&uuml;venlik Varsay\u0131lanlar\u0131) &ouml;zelli\u011fi, modern siber tehdit ortam\u0131nda organizasyonlar\u0131n temel g&uuml;venlik ihtiya&ccedil;lar\u0131n\u0131 kar\u015f\u0131layan kritik bir koruma katman\u0131d\u0131r. &Ouml;zellikle Premium lisanslara sahip olmayan k&uuml;&ccedil;&uuml;k ve orta &ouml;l&ccedil;ekli i\u015fletmeler i&ccedil;in tasarlanan bu &ouml;zellik, ekran\u0131n\u0131zda g&ouml;rd&uuml;\u011f&uuml;n&uuml;z gibi tek bir d&uuml;\u011fmeyle aktifle\u015ftirilebilen, ancak arkas\u0131nda g&uuml;&ccedil;l&uuml; g&uuml;venlik mekanizmalar\u0131 bar\u0131nd\u0131ran bir &ccedil;&ouml;z&uuml;md&uuml;r.<\/p>\n<h2>Security Defaults Nedir ve Neden Kritik?<\/h2>\n<p>G&ouml;rselde dikkat &ccedil;eken k\u0131rm\u0131z\u0131 &ccedil;er&ccedil;eveli alan, organizasyonunuzun g&uuml;venlik durumunu g&ouml;steren en kritik noktad\u0131r. \"Enabled (recommended)\" se&ccedil;ene\u011fi, Microsoft'un t&uuml;m organizasyonlara \u015fiddetle tavsiye etti\u011fi g&uuml;venlik seviyesini temsil eder. E\u011fer bu ayar \"Disabled\" durumundaysa, organizasyonunuz %99.9 oran\u0131nda engellenebilecek g&uuml;venlik tehditlerine kar\u015f\u0131 savunmas\u0131z durumdad\u0131r.<\/p>\n<h3>Microsoft'un \u0130statistiklerine G&ouml;re Kritik Ger&ccedil;ekler<\/h3>\n<p>Microsoft'un g&uuml;venlik raporlar\u0131na g&ouml;re:<\/p>\n<ul>\n<li><strong>%99.9<\/strong> oran\u0131nda hesap g&uuml;venli\u011fi ihlali MFA ile &ouml;nlenebilir<\/li>\n<li><strong>%80<\/strong> oran\u0131nda veri s\u0131z\u0131nt\u0131s\u0131 zay\u0131f veya &ccedil;al\u0131nan kimlik bilgileri nedeniyle ger&ccedil;ekle\u015fir<\/li>\n<li>Legacy authentication kullanan sistemler <strong>%67<\/strong> daha fazla sald\u0131r\u0131ya maruz kal\u0131r<\/li>\n<\/ul>\n<p><a href=\"..\/..\/..\/microsoft-365-icin-guvenlik-varsayilanlarini-nasil-etkinlestirir-veya-devre-disi-birakilir\" target=\"_blank\" rel=\"noopener\">Microsoft 365 i&ccedil;in G&uuml;venlik Varsay\u0131lanlar\u0131n\u0131 Nas\u0131l Etkinle\u015ftirir veya Devre D\u0131\u015f\u0131 B\u0131rak\u0131l\u0131r<\/a><\/p>\n<h2>Security Defaults'un Sa\u011flad\u0131\u011f\u0131 Koruma Katmanlar\u0131<\/h2>\n<h3>1. Evrensel Multi-Factor Authentication (MFA) Zorunlulu\u011fu<\/h3>\n<p>Security Defaults etkinle\u015ftirildi\u011finde, t&uuml;m kullan\u0131c\u0131lar i&ccedil;in MFA zorunlu hale gelir. Bu &ouml;zellik:<\/p>\n<pre><code class=\"language-powershell\"># MFA durumunu kontrol etme scripti\nConnect-MsolService\nGet-MsolUser -All | Select-Object DisplayName, UserPrincipalName, \n    @{Name=\"MFA Status\"; Expression={\n        if($_.StrongAuthenticationRequirements.State){\n            $_.StrongAuthenticationRequirements.State\n        } else {\n            \"Disabled\"\n        }\n    }}\n<\/code><\/pre>\n<p><strong>Uygulama Senaryolar\u0131:<\/strong><\/p>\n<ul>\n<li>\u0130lk 14 g&uuml;n i&ccedil;inde kullan\u0131c\u0131lar MFA kay\u0131t s&uuml;recini tamamlamal\u0131d\u0131r<\/li>\n<li>Azure Portal, Microsoft 365 Admin Center gibi kritik portallara eri\u015fimde an\u0131nda MFA istenir<\/li>\n<li>Kullan\u0131c\u0131 deneyimini bozmadan g&uuml;venlik sa\u011flan\u0131r<\/li>\n<\/ul>\n<h3>2. Y&ouml;netici Hesaplar\u0131 \u0130&ccedil;in Katmanl\u0131 G&uuml;venlik<\/h3>\n<p>Admin hesaplar\u0131 i&ccedil;in &ouml;zel g&uuml;venlik gereksinimleri:<\/p>\n<table>\n<thead>\n<tr>\n<th>Admin Rol&uuml;<\/th>\n<th>MFA Gereksinimi<\/th>\n<th>Ek G&uuml;venlik<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Global Administrator<\/td>\n<td>Her oturumda<\/td>\n<td>Risk tabanl\u0131 eri\u015fim kontrol&uuml;<\/td>\n<\/tr>\n<tr>\n<td>Security Administrator<\/td>\n<td>Her oturumda<\/td>\n<td>Ko\u015fullu eri\u015fim<\/td>\n<\/tr>\n<tr>\n<td>Exchange Administrator<\/td>\n<td>Her oturumda<\/td>\n<td>Privileged Identity Management &ouml;nerisi<\/td>\n<\/tr>\n<tr>\n<td>User Administrator<\/td>\n<td>Her oturumda<\/td>\n<td>Just-in-time eri\u015fim &ouml;nerisi<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>3. Legacy Authentication'\u0131n Tamamen Engellenmesi<\/h3>\n<p>Legacy (Basic) Authentication protokolleri engellendi\u011finde:<\/p>\n<pre><code class=\"language-powershell\"># Legacy authentication kullan\u0131m\u0131n\u0131 tespit etme\n$startDate = (Get-Date).AddDays(-30)\n$endDate = (Get-Date)\n\nSearch-UnifiedAuditLog -StartDate $startDate -EndDate $endDate `\n    -ResultSize 5000 -Operations \"UserLoggedIn\" | \n    Where-Object {$_.AuditData -like \"*ClientInfoString*\"}\n<\/code><\/pre>\n<p><strong>Engellenen Protokoller:<\/strong><\/p>\n<ul>\n<li>POP3<\/li>\n<li>IMAP4<\/li>\n<li>SMTP AUTH<\/li>\n<li>Exchange ActiveSync (EAS)<\/li>\n<li>Exchange Web Services (EWS)<\/li>\n<li>PowerShell without modern auth<\/li>\n<\/ul>\n<h3>4. Riskli Giri\u015flere Kar\u015f\u0131 Otomatik Koruma<\/h3>\n<p>Security Defaults, Azure AD Identity Protection'\u0131n temel &ouml;zelliklerini i&ccedil;erir:<\/p>\n<ul>\n<li><strong>Impossible travel detection<\/strong>: Fiziksel olarak imkans\u0131z lokasyon de\u011fi\u015fiklikleri<\/li>\n<li><strong>Anonymous IP detection<\/strong>: Tor, VPN veya proxy kullan\u0131m\u0131<\/li>\n<li><strong>Malware linked IP<\/strong>: Bilinen k&ouml;t&uuml; ama&ccedil;l\u0131 IP adreslerinden eri\u015fim<\/li>\n<li><strong>Unfamiliar sign-in properties<\/strong>: Al\u0131\u015f\u0131lmad\u0131k cihaz veya lokasyon<\/li>\n<\/ul>\n<h2>Conditional Access vs Security Defaults: Hangisini Se&ccedil;meli?<\/h2>\n<h3>Security Defaults Kullan\u0131m Senaryolar\u0131<\/h3>\n<p>\u2705 <strong>Security Defaults tercih edilmeli:<\/strong><\/p>\n<ul>\n<li>Azure AD Free veya Office 365 lisanslar\u0131 kullan\u0131yorsan\u0131z<\/li>\n<li>500'den az kullan\u0131c\u0131n\u0131z varsa<\/li>\n<li>Basit ama etkili g&uuml;venlik istiyorsan\u0131z<\/li>\n<li>IT ekibiniz s\u0131n\u0131rl\u0131 kaynaklara sahipse<\/li>\n<li>H\u0131zl\u0131 ve kolay implementasyon gerekiyorsa<\/li>\n<\/ul>\n<h3>Conditional Access'e Ge&ccedil;i\u015f Senaryolar\u0131<\/h3>\n<p><strong>Conditional Access tercih edilmeli:<\/strong><\/p>\n<ul>\n<li>Azure AD Premium P1\/P2 lisans\u0131n\u0131z varsa<\/li>\n<li>Gran&uuml;ler kontrol gerekiyorsa<\/li>\n<li>Farkl\u0131 kullan\u0131c\u0131 gruplar\u0131 i&ccedil;in farkl\u0131 politikalar gerekiyorsa<\/li>\n<li>&Ouml;zel uygulamalar i&ccedil;in spesifik kurallar tan\u0131mlamak istiyorsan\u0131z<\/li>\n<\/ul>\n<h2>Security Defaults'tan Conditional Access'e Ge&ccedil;i\u015f Yol Haritas\u0131<\/h2>\n<h3>Ad\u0131m 1: Mevcut Durumu De\u011ferlendirme<\/h3>\n<pre><code class=\"language-powershell\"># Security Defaults durumunu kontrol et\nConnect-AzureAD\n$securityDefaults = Get-AzureADDirectorySettingTemplate | \n    Where-Object {$_.DisplayName -eq \"Security Defaults\"}\n\nif($securityDefaults){\n    Write-Host \"Security Defaults template found\" -ForegroundColor Green\n    $settings = Get-AzureADDirectorySetting | \n        Where-Object {$_.DisplayName -eq \"Security Defaults\"}\n    $settings.Values\n}\n<\/code><\/pre>\n<h3>Ad\u0131m 2: Conditional Access Politikalar\u0131n\u0131 Haz\u0131rlama<\/h3>\n<p>Ge&ccedil;i\u015f &ouml;ncesinde olu\u015fturulmas\u0131 gereken minimum politikalar:<\/p>\n<h4>1. MFA Zorunlulu\u011fu Politikas\u0131<\/h4>\n<pre><code class=\"language-json\">{\n  \"displayName\": \"Require MFA for all users\",\n  \"state\": \"enabled\",\n  \"conditions\": {\n    \"users\": {\n      \"includeUsers\": [\"All\"]\n    },\n    \"applications\": {\n      \"includeApplications\": [\"All\"]\n    }\n  },\n  \"grantControls\": {\n    \"builtInControls\": [\"mfa\"]\n  }\n}\n<\/code><\/pre>\n<h4>2. Legacy Authentication Engelleme<\/h4>\n<pre><code class=\"language-json\">{\n  \"displayName\": \"Block legacy authentication\",\n  \"state\": \"enabled\",\n  \"conditions\": {\n    \"users\": {\n      \"includeUsers\": [\"All\"]\n    },\n    \"clientAppTypes\": [\"exchangeActiveSync\", \"other\"]\n  },\n  \"grantControls\": {\n    \"builtInControls\": [\"block\"]\n  }\n}\n<\/code><\/pre>\n<h4>3. Admin Hesaplar\u0131 \u0130&ccedil;in Ek G&uuml;venlik<\/h4>\n<pre><code class=\"language-powershell\"># Admin hesaplar\u0131 i&ccedil;in Conditional Access politikas\u0131\nNew-AzureADMSConditionalAccessPolicy -DisplayName \"Admins require MFA\" `\n    -State \"Enabled\" `\n    -Conditions @{\n        Users = @{\n            IncludeRoles = @(\n                \"62e90394-69f5-4237-9190-012177145e10\", # Global Admin\n                \"194ae4cb-b126-40b2-bd5b-6091b380977d\"  # Security Admin\n            )\n        }\n        Applications = @{\n            IncludeApplications = \"All\"\n        }\n    } `\n    -GrantControls @{\n        BuiltInControls = @(\"Mfa\", \"CompliantDevice\")\n        Operator = \"OR\"\n    }\n<\/code><\/pre>\n<h3>Ad\u0131m 3: Test ve Pilot Uygulama<\/h3>\n<pre><code class=\"language-powershell\"># Pilot grup olu\u015fturma\n$pilotGroup = New-AzureADGroup -DisplayName \"CA_Pilot_Users\" `\n    -MailEnabled $false `\n    -SecurityEnabled $true `\n    -MailNickName \"CAPilot\"\n\n# Kullan\u0131c\u0131lar\u0131 pilot gruba ekleme\n$testUsers = Get-AzureADUser -Top 10\nforeach($user in $testUsers){\n    Add-AzureADGroupMember -ObjectId $pilotGroup.ObjectId `\n        -RefObjectId $user.ObjectId\n}\n<\/code><\/pre>\n<h3>Ad\u0131m 4: Security Defaults'u Devre D\u0131\u015f\u0131 B\u0131rakma<\/h3>\n<p>\u26a0\ufe0f <strong>UYARI<\/strong>: Bu ad\u0131m sadece t&uuml;m Conditional Access politikalar\u0131 test edildikten sonra yap\u0131lmal\u0131d\u0131r!<\/p>\n<pre><code class=\"language-powershell\"># Security Defaults'u devre d\u0131\u015f\u0131 b\u0131rakma\n$templateId = (Get-AzureADDirectorySettingTemplate | \n    Where-Object {$_.DisplayName -eq \"Security Defaults\"}).Id\n\n$settings = New-Object Microsoft.Open.AzureAD.Model.DirectorySetting\n$settings.DisplayName = \"Security Defaults\"\n$settings[\"IsEnabled\"] = \"false\"\n\nSet-AzureADDirectorySetting -Id $settings.Id -DirectorySetting $settings\n<\/code><\/pre>\n<h2>Risk Tabanl\u0131 Eri\u015fim Politikalar\u0131 Olu\u015fturma<\/h2>\n<h3>Kullan\u0131c\u0131 Risk Politikas\u0131<\/h3>\n<pre><code class=\"language-powershell\"># Y&uuml;ksek riskli kullan\u0131c\u0131lar i&ccedil;in parola s\u0131f\u0131rlama zorunlulu\u011fu\n$userRiskPolicy = @{\n    DisplayName = \"High risk users must reset password\"\n    State = \"Enabled\"\n    Conditions = @{\n        UserRiskLevels = @(\"High\")\n        Users = @{\n            IncludeUsers = \"All\"\n        }\n    }\n    GrantControls = @{\n        BuiltInControls = @(\"PasswordChange\", \"Mfa\")\n        Operator = \"AND\"\n    }\n}\n<\/code><\/pre>\n<h3>Oturum Risk Politikas\u0131<\/h3>\n<pre><code class=\"language-powershell\"># Riskli oturumlar i&ccedil;in MFA zorunlulu\u011fu\n$signInRiskPolicy = @{\n    DisplayName = \"Medium and high risk sign-ins require MFA\"\n    State = \"Enabled\"\n    Conditions = @{\n        SignInRiskLevels = @(\"Medium\", \"High\")\n        Users = @{\n            IncludeUsers = \"All\"\n        }\n    }\n    GrantControls = @{\n        BuiltInControls = @(\"Mfa\")\n    }\n}\n<\/code><\/pre>\n<h2>Password Protection Ayarlar\u0131n\u0131n Optimize Edilmesi<\/h2>\n<h3>Azure AD Password Protection Yap\u0131land\u0131rmas\u0131<\/h3>\n<pre><code class=\"language-powershell\"># &Ouml;zel yasakl\u0131 parola listesi olu\u015fturma\n$bannedPasswords = @(\n    \"Sirket2024\",\n    \"Password123\",\n    \"Admin2024\",\n    \"Ankara06\"\n)\n\n# Custom banned password list g&uuml;ncelleme\nSet-AzureADPasswordProtectionCustomBannedPasswordList `\n    -CustomBannedPasswords $bannedPasswords\n\n# Password protection ayarlar\u0131n\u0131 etkinle\u015ftirme\n$settings = @{\n    EnableBannedPasswordCheck = $true\n    EnableBannedPasswordCheckOnPremises = $true\n    BannedPasswordCheckMode = \"Enforced\"\n}\n<\/code><\/pre>\n<h3>Parola Politikas\u0131 En \u0130yi Uygulamalar\u0131<\/h3>\n<table>\n<thead>\n<tr>\n<th>Politika<\/th>\n<th>&Ouml;nerilen De\u011fer<\/th>\n<th>A&ccedil;\u0131klama<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Minimum uzunluk<\/td>\n<td>12 karakter<\/td>\n<td>NIST 800-63B standard\u0131<\/td>\n<\/tr>\n<tr>\n<td>Karma\u015f\u0131kl\u0131k<\/td>\n<td>Devre d\u0131\u015f\u0131<\/td>\n<td>Uzunluk ve MFA yeterli<\/td>\n<\/tr>\n<tr>\n<td>Ge&ccedil;erlilik s&uuml;resi<\/td>\n<td>S\u0131n\u0131rs\u0131z<\/td>\n<td>Sadece risk durumunda de\u011fi\u015ftir<\/td>\n<\/tr>\n<tr>\n<td>Ge&ccedil;mi\u015f kontrol&uuml;<\/td>\n<td>Son 24 parola<\/td>\n<td>Tekrar kullan\u0131m\u0131 engelle<\/td>\n<\/tr>\n<tr>\n<td>Account lockout<\/td>\n<td>10 deneme<\/td>\n<td>Brute force korumas\u0131<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u0130zleme ve Raporlama<\/h2>\n<h3>Sign-in Logs Analizi<\/h3>\n<pre><code class=\"language-powershell\"># Son 7 g&uuml;nl&uuml;k ba\u015far\u0131s\u0131z giri\u015f denemeleri\n$startDate = (Get-Date).AddDays(-7).ToString(\"yyyy-MM-dd\")\n$failedSignIns = Get-AzureADAuditSignInLogs -Filter \"status\/errorCode ne 0 and createdDateTime ge $startDate\"\n\n$failedSignIns | Group-Object UserPrincipalName | \n    Select-Object Name, Count | \n    Sort-Object Count -Descending | \n    Export-Csv \"FailedSignIns_Weekly.csv\"\n<\/code><\/pre>\n<h3>MFA Kullan\u0131m Raporu<\/h3>\n<pre><code class=\"language-powershell\"># MFA registration durumu raporu\nConnect-MgGraph -Scopes \"Reports.Read.All\"\n\n$report = Get-MgReportAuthenticationMethodUserRegistrationDetail\n$report | Select-Object UserPrincipalName, \n    IsMfaCapable, \n    IsMfaRegistered, \n    IsPasswordlessCapable | \n    Export-Excel \"MFA_Status_Report.xlsx\"\n<\/code><\/pre>\n<h2>Kullan\u0131c\u0131 E\u011fitimi ve Change Management<\/h2>\n<h3>Kullan\u0131c\u0131 Bilgilendirme E-posta \u015eablonu<\/h3>\n<pre><code class=\"language-html\">\n\n\n    \n\n\n    <\/code><\/pre>\n<div class=\"container\">\n<div class=\"header\">\n<h2>&Ouml;nemli G&uuml;venlik G&uuml;ncellemesi<\/h2>\n<\/div>\n<div class=\"content\">\n<p>Say\u0131n &Ccedil;al\u0131\u015fan\u0131m\u0131z,<\/p>\n<p>Kurumsal g&uuml;venli\u011fimizi art\u0131rmak i&ccedil;in <strong>Security Defaults<\/strong> &ouml;zelli\u011fini aktifle\u015ftiriyoruz. Bu de\u011fi\u015fiklik <strong>[Tarih]<\/strong> itibar\u0131yla devreye girecektir.<\/p>\n<div class=\"warning\"><strong>\u26a0\ufe0f &Ouml;nemli:<\/strong> T&uuml;m kullan\u0131c\u0131lar i&ccedil;in Multi-Factor Authentication (MFA) zorunlu olacakt\u0131r.<\/div>\n<h3>Yapman\u0131z Gerekenler:<\/h3>\n<div class=\"steps\">\n<ol>\n<li>&nbsp;<\/li>\n<li>Microsoft Authenticator uygulamas\u0131n\u0131 telefonunuza indirin<\/li>\n<li>&nbsp;<\/li>\n<li>aka.ms\/mfasetup adresinden MFA kayd\u0131n\u0131z\u0131 tamamlay\u0131n<\/li>\n<li>&nbsp;<\/li>\n<li>Test giri\u015fi yaparak kurulumun do\u011fru oldu\u011fundan emin olun<\/li>\n<li>&nbsp;<\/li>\n<\/ol>\n<\/div>\n<h3>S\u0131k Sorulan Sorular:<\/h3>\n<ul>\n<li>&nbsp;<\/li>\n<li><strong>MFA her giri\u015fte mi istenecek?<\/strong><br>Hay\u0131r, g&uuml;venilir cihazlarda 14 g&uuml;nde bir istenecektir.<\/li>\n<li>&nbsp;<\/li>\n<li><strong>Telefonum yoksa ne yapmal\u0131y\u0131m?<\/strong><br>IT departman\u0131 ile ileti\u015fime ge&ccedil;erek alternatif y&ouml;ntemler hakk\u0131nda bilgi al\u0131n.<\/li>\n<li>&nbsp;<\/li>\n<\/ul>\n<p>Sorular\u0131n\u0131z i&ccedil;in: it-support@sirket.com<\/p>\n<\/div>\n<\/div>\n<pre><code class=\"language-html\">\n\n\n<\/code><\/pre>\n<h2>Troubleshooting ve Yayg\u0131n Sorunlar<\/h2>\n<h3>Sorun 1: MFA Kayd\u0131 Yapamayan Kullan\u0131c\u0131lar<\/h3>\n<pre><code class=\"language-powershell\"># MFA sorunlu kullan\u0131c\u0131lar\u0131 tespit etme\n$problemUsers = Get-MgUser -All | Where-Object {\n    $_.StrongAuthenticationMethods.Count -eq 0\n}\n\n# Ge&ccedil;ici MFA bypass (sadece acil durumlar i&ccedil;in)\n$user = Get-AzureADUser -ObjectId \"user@domain.com\"\nSet-MsolUser -UserPrincipalName $user.UserPrincipalName `\n    -StrongAuthenticationRequirements @()\n<\/code><\/pre>\n<h3>Sorun 2: Legacy Application Uyumluluk<\/h3>\n<pre><code class=\"language-powershell\"># Legacy authentication kullanan uygulamalar\u0131 tespit etme\n$legacyApps = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) `\n    -EndDate (Get-Date) -Operations UserLoggedIn -ResultSize 5000 |\n    Where-Object {$_.AuditData -match \"ClientInfoString.*Outlook\/15.0\"}\n\n# App password olu\u015fturma (ge&ccedil;ici &ccedil;&ouml;z&uuml;m)\n# Not: Security Defaults aktifken app password kullan\u0131lamaz\n<\/code><\/pre>\n<h3>Sorun 3: Conditional Access &Ccedil;ak\u0131\u015fmalar\u0131<\/h3>\n<pre><code class=\"language-powershell\"># &Ccedil;ak\u0131\u015fan politikalar\u0131 tespit etme\n$policies = Get-AzureADMSConditionalAccessPolicy\n$conflicts = @()\n\nforeach($policy in $policies){\n    if($policy.State -eq \"Enabled\"){\n        $conflicts += [PSCustomObject]@{\n            PolicyName = $policy.DisplayName\n            Users = $policy.Conditions.Users.IncludeUsers\n            Apps = $policy.Conditions.Applications.IncludeApplications\n            Controls = $policy.GrantControls.BuiltInControls\n        }\n    }\n}\n\n$conflicts | Format-Table -AutoSize\n<\/code><\/pre>\n<h2>Performans Metrikleri ve KPI'lar<\/h2>\n<h3>G&uuml;venlik KPI Dashboard<\/h3>\n<pre><code class=\"language-powershell\"># G&uuml;venlik metrikleri toplama\nfunction Get-SecurityMetrics {\n    $metrics = @{\n        Date = Get-Date\n        TotalUsers = (Get-AzureADUser -All $true).Count\n        MFAEnabledUsers = (Get-MsolUser -All | Where-Object {$_.StrongAuthenticationMethods.Count -gt 0}).Count\n        AdminAccounts = (Get-AzureADDirectoryRole | Get-AzureADDirectoryRoleMember).Count\n        DisabledLegacyAuth = (Get-AzureADPolicy | Where-Object {$_.DisplayName -like \"*Legacy*\"}).Count\n        FailedSignIns24h = (Get-AzureADAuditSignInLogs -Filter \"createdDateTime ge $(Get-Date).AddDays(-1) and status\/errorCode ne 0\").Count\n    }\n    \n    # MFA coverage hesaplama\n    $metrics.MFACoverage = [math]::Round(($metrics.MFAEnabledUsers \/ $metrics.TotalUsers) * 100, 2)\n    \n    return $metrics\n}\n\n# Dashboard HTML olu\u015fturma\n$metrics = Get-SecurityMetrics\n$dashboardHTML = @\"\n\n\n    \n    \n\n\n    <\/code><\/pre>\n<h1>Azure AD Security Dashboard<\/h1>\n<pre><code class=\"language-powershell\">\n    <\/code><\/pre>\n<div class=\"metric-card\">\n<div class=\"metric-value\">$($metrics.MFACoverage)%<\/div>\n<div class=\"metric-label\">MFA Coverage<\/div>\n<\/div>\n<pre><code class=\"language-powershell\">\n    <\/code><\/pre>\n<div class=\"metric-card\">\n<div class=\"metric-value\">$($metrics.FailedSignIns24h)<\/div>\n<div class=\"metric-label\">Failed Sign-ins (24h)<\/div>\n<\/div>\n<pre><code class=\"language-powershell\">\n\n\n\"@\n\n$dashboardHTML | Out-File \"SecurityDashboard.html\"\n<\/code><\/pre>\n<h2>Gelecek Planlama ve Yol Haritas\u0131<\/h2>\n<h3>3 Ayl\u0131k G&uuml;venlik Geli\u015ftirme Plan\u0131<\/h3>\n<p><strong>1. Ay - Temel G&uuml;venlik:<\/strong><\/p>\n<ul>\n<li>\u2705 Security Defaults aktifle\u015ftirme<\/li>\n<li>\u2705 MFA enrollment kampanyas\u0131<\/li>\n<li>\u2705 Legacy authentication envanteri<\/li>\n<\/ul>\n<p><strong>2. Ay - \u0130leri Seviye Koruma:<\/strong><\/p>\n<ul>\n<li>\u2b1c Conditional Access pilot<\/li>\n<li>\u2b1c Risk-based policies<\/li>\n<li>\u2b1c Privileged Identity Management<\/li>\n<\/ul>\n<p><strong>3. Ay - Optimizasyon:<\/strong><\/p>\n<ul>\n<li>\u2b1c Zero Trust modeline ge&ccedil;i\u015f<\/li>\n<li>\u2b1c Passwordless authentication pilot<\/li>\n<li>\u2b1c Advanced threat analytics<\/li>\n<\/ul>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p>Security Defaults, Microsoft'un sundu\u011fu &uuml;cretsiz ancak son derece etkili bir g&uuml;venlik &ccedil;&ouml;z&uuml;m&uuml;d&uuml;r. G&ouml;rselinizdeki \"Enabled (recommended)\" se&ccedil;ene\u011fi, organizasyonunuzun g&uuml;venlik duru\u015funu an\u0131nda iyile\u015ftirecek kritik bir ad\u0131md\u0131r.<\/p>\n<p><strong>Acil Aksiyon &Ouml;nerileri:<\/strong><\/p>\n<ol>\n<li><strong>Hemen kontrol edin<\/strong>: Azure Portal'da Security Defaults durumunuzu kontrol edin<\/li>\n<li><strong>Risk de\u011ferlendirmesi yap\u0131n<\/strong>: Legacy application kullan\u0131m\u0131n\u0131z\u0131 tespit edin<\/li>\n<li><strong>Kullan\u0131c\u0131lar\u0131 bilgilendirin<\/strong>: MFA kayd\u0131 i&ccedil;in e\u011fitim materyalleri haz\u0131rlay\u0131n<\/li>\n<li><strong>Test edin<\/strong>: Pilot grupta uygulayarak sorunlar\u0131 &ouml;nceden tespit edin<\/li>\n<li><strong>Aktifle\u015ftirin<\/strong>: T&uuml;m haz\u0131rl\u0131klar tamamland\u0131ktan sonra Security Defaults'u etkinle\u015ftirin<\/li>\n<\/ol>\n<p>Unutmay\u0131n: %99.9 oran\u0131nda hesap g&uuml;venli\u011fi ihlali, Security Defaults ile &ouml;nlenebilir. Bu basit ama g&uuml;&ccedil;l&uuml; &ouml;zelli\u011fi kullanmamak, organizasyonunuzu gereksiz risklere maruz b\u0131rakmak anlam\u0131na gelir.<\/p>\n<hr>\n<p><em>Bu makale, Azure AD Security Defaults ve Conditional Access &ouml;zellikleri i&ccedil;in haz\u0131rlanm\u0131\u015ft\u0131r. T&uuml;m PowerShell scriptleri test ortam\u0131nda denenmelidir.<\/em><\/p>","excerpt":"Bu makalede, Microsoft 365 Y\u00f6netim alan\u0131n\u0131zda\u00a0G\u00fcvenlik Varsay\u0131lanlar\u0131n\u0131 nas\u0131l etkinle\u015ftirip devre d\u0131\u015f\u0131\u00a0b\u0131rakaca\u011f\u0131n\u0131z\u0131 g\u00f6sterece\u011fiz","created_at":"2025-11-25 19:39:35","updated_at":"2026-09-07 22:58:22","category_id":6,"view_count":490,"reading_time":10,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-25 16:39:00","featured_image":"a226c400d55cb75185ac75e15292feb6.png","slug":"azure-ad-security-defaults-kucuk-ve-orta-olcekli-isletmeler-icin-kritik-guvenlik-kalkani","category_name":"Sistem","category_slug":"sistem"}