Operationalizing Microsoft Security Copilot to Reinvent SOC Productivity

Operationalizing Microsoft Security Copilot to Reinvent SOC Productivity

by | Oct 19, 2023 | Technology

This article is contributed. See the original author and article here.

In a Security Operations Center (SOC), time to resolve and mitigate both alerts and incidents are of the highest importance. This time can mean the difference between controlled risk and impact, and large risk and impact. While our core products detect and respond at machine speed, our ongoing mission is to upskill SOC analysts and empower them to be more efficient where they’re needed to engage. To bridge this gap, we are bringing Security Copilot into our industry-leading XDR platform, Microsoft 365 Defender, which is like adding the ultimate expert SOC analyst to your team, both raising the skill bar and increasing efficiency and autonomy. In addition to skilling, we know that incident volumes continue to grow as tools get better at detecting, while SOC resources are scarce, so providing this expert assistance and helping the SOC with efficiency are equally important in alleviating these issues.


 


Security Copilot provides expert guidance and helps analysts accelerate investigations to outmaneuver adversaries at scale. It is important to recognize that not all generative AI is the same. By combining OpenAI with Microsoft’s security-specific model trained on the largest breadth and diversity of security signals in the industry–over 65 trillion to be precise. Security Copilot is built on the industry-transforming Azure OpenAI service and seamlessly embedded into the Microsoft 365 Defender analyst workflows for an intuitive experience.



Streamline SOC workflows


To work through an incident end to end, an analyst must quickly understand what happened in the environment and assess both the risk posed by the issue and the urgency required for remediation. After understanding what happened, the analyst must provide a complete response to ensure the threat is fully mitigated. Upon completion of the mitigation process, they are required to document and close the incident.



When the SOC analyst clicks into an Incident in their queue in the Microsoft 365 Defender portal, they will see a Security Copilot-generated summary of the incident. This summary provides a quick, easy to read overview of the story of the attack and the most important aspects of the incident. Our goal is to help reduce the time to ramp up on what’s happening in the SOC’s environment. By leveraging the incident summary, SOC analysts no longer need to perform an investigation to determine what is most urgent in their environment, making prioritization, understanding impact and required next steps, easy and reducing time to respond.


Figure 1: Microsoft 365 Defender portal showing the Security Copilot-generated incident summary within the Incident pageFigure 1: Microsoft 365 Defender portal showing the Security Copilot-generated incident summary within the Incident page


After verifying the impact and priority of this incident, the analyst begins to review IOCs. The analyst knows that this type of attack usually starts with a targeted attack on an employee and ends with that employee’s credentials being available to the threat actor for the purposes of finding and using financial data. Once the user is compromised the threat actor can live off the land in the organization and has legitimate access to anything that user would normally have access to such as financial account information for the company. This type of compromise must be handled with urgency as the actor will be difficult to track after initial entry and could continue to pivot and compromise other users through the organization. If the targeted organization handles this risk with urgency, they can stop the actor before additional assets/accounts/entities are accessed.



The SOC analyst working on this incident is in the incident summary page and sees that the attack began with a password spray, or the threat actor attempting to access many users with a list of passwords using an anonymous IP address. This must be verified by the analyst to determine urgency and priority of triage. After determining the urgency of this incident, the analyst begins their investigation. In the incident summary, the analyst sees many indicators of compromise including multiple Ips, Cloud Applications, and other emails that may be related to the incident. The analyst sees that Defender disrupt suspended one compromised account and captured additional risk including phishing email identification. In an attempt to cast an organizational-level view, the analyst will investigate these IOCs to see who else interacted with or was targeted by the attacker.



The analyst pivots the hunting experience and sees see another “Security Copilot” button. This will allow the SOC analyst to ask Security Copilot to generate a KQL to review where else in the organization this IOC has been seen. For this example, we use, “Get emails that have ‘sbeavers’ as the sender or receiver in the last 10 days” to generate a KQL query. This reduces the time to produce the query and the need to look up syntax. The analyst now understands there’s another user account that was reached out by the adversary and the SOC needs to validate risk level / check the account state. The “llodbrok” account will be added to the incident by the analyst.


Figure 2: Microsoft Defender Security Portal showing the query assistant within Advanced hunting editorFigure 2: Microsoft Defender Security Portal showing the query assistant within Advanced hunting editor


After identifying all entry vectors and approached users, the SOC analyst shifts focus to the action on targets and what happened next for the incident they are investigating. This incident does not contain a PowerShell IOC, but if the analyst found PowerShell on the “llodbrok” user’s machine, the analyst would be able to click on the PowerShell-related alert and scroll down in the righthand pane to find the evidence component. After the analyst clicks on the PowerShell evidence, they see the “Analyze” button with the Copilot symbols. This will take a command line and turn it into human-readable language. Oftentimes attackers leverage scripts to perform network discovery, elevate privilege, and obfuscate behavior. This script analysis will reduce the time it takes to understand what the command does and respond quickly. Having human-readable scripts is also useful when the analyst is investigating an alert in a language, they are unfamiliar with or haven’t worked with recently.


Figure 3: Microsoft 365 Defender portal showing the Security Copilot-generated script analysis within the Incident pageFigure 3: Microsoft 365 Defender portal showing the Security Copilot-generated script analysis within the Incident page


After the analyst has confirmed these indicators of compromise are legitimate, the next step is to initiate the remediation process. To do this, the analyst navigates back to the Incident page in the Microsoft 365 Defender portal and scrolls down in the right-hand pane. Right below the incident summary, the analyst will see a set of “guided response” recommendations. The SOC analyst has verified the incident IOCs are legitimate and selects the “Classify” dropdown and the option “Compromised Account” to indicate to other analysts this was a true positive of BEC. The SOC analyst also sees ‘quick actions’ they can take to quickly remediate the compromised user’s account, selecting “Reset user password” and “Disable user in Active Directory” and “Suspend user in Microsoft Entra ID.”



In this process, the SOC analyst is assisted by Security Copilot in what actions to take based on past actions taken by the organization in response to similar alerts or incidents in the past. This will improve their abilities from day one, reducing early training requirements.


Figure 4: Microsoft 365 Defender portal showing the guided response within the Incident pageFigure 4: Microsoft 365 Defender portal showing the guided response within the Incident page


Finally, the analyst needs to send a report to their leadership. Reporting and documenting can be a challenge and time-consuming task, but with Security Copilot, the analyst can generate a post-response activity report with the click in seconds and provide partners, customers, and leadership with a clear understanding of the incident and what actions were taken.



Here is how it works: the SOC analyst selects the “Generate incident report” button in the upper right corner of the Incident page or the icon beside the ‘x’ in the side panel. This generates an incident report, that can be copied and pasted, showing the incident title, incident details, incident summary, classification, investigation actions, remediation actions (manual or automated actions from Microsoft 365 Defender or Sentinel) and follow-up actions.


Figure 5: Microsoft 365 Defender portal showing the Security Copilot-generated incident report within the Incident pageFigure 5: Microsoft 365 Defender portal showing the Security Copilot-generated incident report within the Incident page


 


What sets Security Copilot apart


As a part of this effort, our team worked side-by-side with Security Researchers to ensure that we weren’t providing just any response but providing a high-quality output. Today, we are reviewing a few key indicators to inform us of our response quality using clarity, usefulness, omissions, and inaccuracies. These measures are made up of three core areas that our team focused on: lexical analysis, semantic analysis, and human-oriented clarity analysis. There are three core areas that our team focused on: lexical analysis, semantic analysis, and human-oriented clarity analysis. The combination of core areas provides a solid foundation for understanding human comprehension, content similarity, and key insights between the data source and the output. With the help of our quality metrics, we were able to iterate on different versions of these skills and improve the overall quality of our skills by 50%.


 


Quality measurements are important to us as they help ensure we aren’t losing key insights and that all the information is well connected. Our security Researchers and Data Scientists partnered together across organizations to bring a variety of signals across our product stack, including threat intelligence signals, and a diverse range of expertise to our skills. Security copilot has obviated the necessity for labor-intensive data curation and quality assessment prior to model input.


 


You’ll be able to read more about how we performed quality validation in future posts.


 


Share your feedback with us


We could not talk about a feature without also talking about how important your feedback is to our teams. Our product teams are constantly looking for ways to improve our product experience, and listening to the voices of our customers is a crucial part of that process SOC analysts can provide feedback to Microsoft through each of the skill’s User Interface (UI) components (as shown below). Your feedback will be routed to our team and will be used to help influence the direction of products. We use this constant pulse check via your feedback, and a variety of other signals to monitor how we’re doing.


Picture6.png


Security Copilot is in Early Access now, but to sign up here to receive updates on Security Copilot and the use of AI in Security. To learn more about Microsoft Security Copilot, visit the website.


 


Getting started



  1. Analyze scripts and codes with Security Copilot in Microsoft 365 Defender | Microsoft Learn

  2. Summarize incidents with Security Copilot in Microsoft 365 Defender | Microsoft Learn

  3. Create incident reports with Security Copilot in Microsoft 365 Defender | Microsoft Learn

  4. Use guided responses with Security Copilot in Microsoft 365 Defender | Microsoft Learn

  5. Microsoft Security Copilot in advanced hunting | Microsoft Learn


 


Learning more



 

Microsoft Entra ID Beginner’s Tutorial (Azure Active Directory)

Microsoft Entra ID Beginner’s Tutorial (Azure Active Directory)

by | Oct 18, 2023 | Technology

This article is contributed. See the original author and article here.

Simplify and improve security for sign-in experiences with Microsoft Entra ID, the new name for Azure Active Directory. Microsoft Entra ID is a unified identity provider to sign into your non-Microsoft services, like Google, AWS, Salesforce, and ServiceNow.


 


Main.png


See how it’s used to manage service licensing for Microsoft 365, Office 365, Enterprise Mobility + Security, and Microsoft Purview. It features unique capabilities like conditional access, passwordless authentication, Single Sign-on, and Dynamic Groups. Perform the most common day-to-day tasks, like adding and editing user accounts, options for groups and what each do, as well as managed identities, role assignment, admin units, and additional core capabilities.


 


Jeremy Chapman, director of Microsoft 365 and a long-time endpoint management and directory services admin, explains the setup and configuration.


 


 


Just one email address to remember.


 


pic1.png


 


Access ALL your work services and apps. Enhanced security with multi-factor authentication and Conditional Access. Take a tour of Microsoft Entra ID.


 


 


Go beyond password-only authentication.


 


pic2.png


 


It just isn’t safe. Choose from multiple authentication strengths — like FIDO2 keys, Windows Hello, biometric sign-in & Microsoft’s Authenticator app. See the Microsoft Entra admin center.


 


 


Single Sign-On across devices and apps.


 


pic3.png


 


Microsoft Entra ID integrates with device management. Get started.


 


 


Watch our video here:


 


 


 



 



QUICK LINKS:


 


00:00 — Simplify identity management 
01:05 — Consolidate identity services
02:52 — Admin experience 
05:09 — Conditional Access 
05:39 — Manage user accounts 
07:09 — Edit users 
08:16 — Dynamic Groups 
10:22 — Admin Roles & Admin Units 
11:45 — Single Sign-On 
12:34 — Wrap up


 


 


Link References


 


For more information, check out https://aka.ms/EntraDocs


 


 


Unfamiliar with Microsoft Mechanics?


 


As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.



 


 


Keep getting this insider knowledge, join us on social:


 










Video Transcript:


 


-Imagine being able to use the same sign-in credentials to securely access all of your online services for work, not only the ones hosted by Microsoft, but even other cloud apps and service providers just using your work email address and without needing to remember your passwords. Well, all of that is possible with Microsoft Entra ID. As a common identity and access management solution, its primary job is to help you prove you are who you say you are. And once that’s verified, which is a process called authentication, you can access services that you have permissions to use, which we refer to as authorization. 


 


-So today, I’m going to walk you through all the fundamentals of Microsoft Entra ID, what it is and how it works. First, as a user to access services even from non-Microsoft clouds, like Google, Salesforce, AWS, and others. Then if you’re an identity admin, I’ll walk through the basics with a focus on users, groups, and roles. And the good news is if you’re familiar with Azure Active Directory, Microsoft Entra ID is its new name. And while there are a few new updates, it’s going to look pretty familiar. 


 


-So let’s start by looking at why you would even consolidate identity services into a single provider. And there are really quite a few reasons. First, it’s not easy to remember all the different logins that you use to access multiple apps and services. And related to that, the reality is many people will reuse their username and password across different services. 


 


-So when one of those services gets hacked and leaks your credentials, without you even knowing it, adversaries will use those leaked credentials to access other services. And what if you’re one of the responsible ones, and you don’t reuse passwords or you make a point of setting up second factor of authentication whenever possible? Well, that’s one step better from a security point of view, but for the organizations you work for, it would still mean that they need to manage each service that you’re accessing separately, for everything from account creation, changes associated with your identity, password resets, and more. 


 


-So if you could just have one username and a unified system to log into all your work services, where it’s more secure with two factors of authentication, works with passwordless login so you don’t need to remember multiple passwords, just your email address. It assesses sign-in risk in real-time. Like if someone from another country has stolen your credentials and is trying to use your account, so it can block them. You can get to all of your assigned web or line of business apps from one central location instead of managing this yourself with lots of browser bookmarks and favorites. And for IT and your help desk, all of this can be managed in one place. Doesn’t that sound like a better option? And that’s what Microsoft Entra ID is all about. Multi-cloud identity and access management, enabling secure access to your work applications and protecting your identity, which then in turn helps protect the information and services you use. 


 


-Now let’s switch gears to the identity admin experience and a few important things you should know about before you get started. These will become prerequisites and dependencies as you work with core capabilities. So I’ll start in the Microsoft Entra Admin Center. You can get to it by navigating to entra.microsoft.com. By the way, for Microsoft Cloud services like Microsoft 365 or Intune, an instance of Microsoft Entra is set up behind the scenes for your organization automatically. And even though the same information is presented in these different admin experiences, you can make changes in any of these locations to the same shared backend service. 


 


-For today though, I’ll keep things simple and I’ll do everything from the Microsoft Entra Admin Center. First, and as I mentioned before, with things like Google, Salesforce, and AWS services, you can manage identities for non-Microsoft services in addition to those offered by Microsoft. In enterprise applications, you can see that my environment has quite a few of these already set up. In most cases, there is a one-time operation to set each of these up where you’ll configure Microsoft Entra ID as the identity provider for that app or service, its integration details, and which users or groups can access it. 


 


-Next, if you currently have an on-premises directory service like Active Directory, you can configure it within hybrid management to work directly with Microsoft Entra ID to synchronize services from basic topologies to even more advanced ones. Then of course, as shown and mentioned, you’ll use Microsoft Entra to manage identities. Now these can be users, they can also be devices, then groups that can consist of users, devices, and managed identities. And these managed identities can include applications or other resources like a cloud-hosted virtual machine. 


 


-In protections, you’ll find authentication methods, which you’ll want to use for multifactor authentication. That’s because password-only authentication is not safe or recommended and Microsoft Entra ID makes it simple to standardize on more secure passwordless multifactor sign-ins. And Microsoft Entra supports multiple authentication methods, including biometric sign-in options with Windows Hello for Business, FIDO2 security keys, as well as mobile phones with the Authenticator app, along with other options that go beyond basic authentication using just passwords. 


 


-And another major benefit of Microsoft Entra ID is its ability to assess risk in real-time using Conditional Access. So here, we base access decisions on user risk level, the IP location, where the sign-in attempt is coming from, whether the device trying to sign in is compliant, and the applications. After that, as you sign into those services, conditional access can decide to allow, block, or require additional authentication strength based on the controls that you set for granting access. So now you know a few of the core capabilities. 


 


-Let’s look at a few of the basics that you’ll need to know when running the service on a day-to-day basis. And then once you have an instance of Microsoft Entra ID running, the most common tasks you’ll have is to manage user accounts. So here, you can see that I already have a few users added, but I’ll add another to show you how that process works. And immediately, you’ll see that I have options for users both internal to my organization and external to my organization. 


 


-When you get started, you’ll typically want to add internal users as members of your organization. The user principle name, often referred to as a UPN, is normally the same as an email address and you can use whatever standard construct you have in place. So I’ll use first initial and last name. The display name then is usually the fully spelled out first and last name. And even though ultimately, this account will be used with passwordless multifactor authentication later, we’ll let the system generate a password. Then in properties, you’ll input all the user’s details, and these are important to fill in because you’ll need them later for filtering and dynamic grouping that I’ll show you in a moment. 


 


-So now I have all their details inputted. Then next in assignments, I can manually add this user account to an existing group. So I’ll do that here. And the same is true for adding roles, as I scroll down this list of built-in roles, you’ll see they can be pretty specialized with lots of administrator roles. Now for many user types, you won’t need to define a role. You can add them later if you want to, but for my case, I’ll just close this out and I’ll create the user account. And now we have our new user, and what’s often just as common for managing users is editing them. 


 


-So I’m going to click into this user account. Right on the top, you’ll find some of the most common tasks for editing properties, deleting the account, resetting the password, or revoking the sessions that the selected user is currently logged into. And this will come in handy if a user, say, reports a lost or stolen device. On the left, you’ll find the applications that each user has assigned to them. Importantly, Microsoft Entra ID is often also used for license assignment with Microsoft services. And here, you can see the top level products. 


 


-And if I click into assignments, you can even control access to lots of the underlying apps and services within each of those top level product plans. This allows you to curate exactly which app experiences users have access to, so it’s not all or nothing. Then in devices, you can see which devices and the details for each device that this user has joined to Microsoft Entra. And for each user account, you can access a full set of audit logs with different events related to their identity, as well as detailed sign-in logs to see which apps they’ve recently signed into, along with their locations. Okay, so now with our users configured, let’s dig into how you’d group them together using groups. These can comprise of users, other groups, devices, and also managed identities. 


 


-In fact, here, you can see a few different groups and types spanning Microsoft 365, distribution, and security groups. These are all based on roles, devices, locations, and more. So I’ll create a new group, and you’ll see that these can be security groups, or Microsoft 365 groups. And I’ll explain what each one of them does and we’ll start with security groups. So you’ll see from these controls that security groups are simply a logical grouping of objects in the directory. As I click into members, you’ll also see these can be users, other groups, devices, and enterprise applications. And that’s it. 


 


-Conversely though, if I back out of the process and start a Microsoft 365 group, you’ll see the difference here is that it provisions a shared set of resources, like a shared inbox, and calendar in Exchange as indicated here. And behind the scenes, it’s also creating a SharePoint document library along with a few other Microsoft 365 resources. Then for member types, this time, you’ll only see users which can be people or things like meeting rooms. And something else that you can set up for both users and devices are Dynamic Groups. 


 


-Now, pay attention as I change the membership type here from assigned, where you or others will manually assign members as is indicated at the bottom, to dynamic in this case. And you’ll see that members down below just change to add dynamic query. Now this is super useful because it will automatically enroll, or conversely unenroll users or devices into groups based on their individual properties. In this case, I want to group everyone from the city where the value equals, and then I’ll type Bellevue and save it. Now go ahead and name my group Bellevue Users and hit create. And that takes a moment to provision the group and its underlying services. Then if I open up the group, you’ll see that in members, it’s already found and added three people already working in the city of Bellevue automatically. So now let’s move into something a bit more admin-focused and how you and your fellow admins can manage resources using admin roles.


 


-So I’m going to move into roles and admins. And if you’re familiar with the concept of role-based access control, or RBAC, this is how you can right-size admin level permissions to only the things that you need to access. Of course, it’s a huge risk if you just give everyone global admin rights, especially if you have a larger IT team. So these roles can pinpoint permissions based on the resources that each admin needs to manage. So now if I jump back over to a user like Christie here, in assigned roles, I can add one, and now she can perform that function. So now let’s talk about admin units, which are another way to restrict permissions in a role, similar to an organizational unit, if you’re familiar with Active Directory, for example, to certain departments, regions, or other segments in your organization. 


 


-Let show you an example. So here, I’m going to create a new admin unit. Now I’ll give it a name, Help Desk. And this restricted management control is important because it means the tenant level admins won’t simply inherit this role if you don’t want them to. Then I’ll assign roles, and I’ll pick a Teams administrator in this case, which will allow these users that I’ll pick next to manage Microsoft Teams settings. So now I’ll pick a few people working as Microsoft Teams admins. And from there, I can create it. Again, just those people that I defined have access to manage the Teams service. And one more component I’ll touch on today is how Microsoft Entra integrates with device management. 


 


-So as I mentioned before, device state can be used to assess sign-in risk in real-time with Conditional Access. And it also works to enable single sign-on with something called Microsoft Entra join, so that as you sign into your device running Windows, and now even macOS, that single sign-on can transfer to local and web apps you use to access work resources. You can enable this from device settings, and importantly, require multi-factor authentication be used to register or join devices with Microsoft Entra. 


 


-And by the way, all of this works seamlessly with Microsoft Intune and other endpoint management tools as you use those to manage the broader tasks of device management from provisioning, to app distribution, and device configuration. 


 


-So those are a few of the core concepts to manage users, groups, applications, and devices. Now to learn more, check out aka.ms/EntraDocs. And keep following Microsoft Mechanics for latest tech updates. And thanks for watching.


 




Microsoft Teams Premium: The smart place to work is also a smart investment

Microsoft Teams Premium: The smart place to work is also a smart investment

by | Oct 18, 2023 | AI, Business, Hybrid Work, Microsoft 365, Teams Premium, Technology

This article is contributed. See the original author and article here.

In a 2023 commissioned Total Economic Impact™ study, Forrester Consulting found that Teams Premium helped organizations save time, improve security, and reduce costs—all contributing to a projected return on investment (ROI) of 108 to 360 percent over three years. Today, we’re excited to share new advanced collaboration capabilities that help you meet the challenges of the new way of work.

The post Microsoft Teams Premium: The smart place to work is also a smart investment appeared first on Microsoft 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Known issue: Incorrect count for onboarded Microsoft Defender for Endpoint devices report

Known issue: Incorrect count for onboarded Microsoft Defender for Endpoint devices report

by | Oct 17, 2023 | Technology

This article is contributed. See the original author and article here.

We were recently alerted to an issue where devices onboarded to Microsoft Defender for Endpoint are not properly reflected in the Microsoft Intune admin center report for devices with/without the Defender for Endpoint sensor. We’ve identified a bug that is causing incorrect counts for the number of devices onboarded to Defender for Endpoint and are working on a fix that is expected to be released later this year. The report is located under Endpoint security > Microsoft Defender for Endpoint and on the connector page.


 


Note: This is a reporting bug only. It does not impact onboarding to Defender for Endpoint.


 


A screenshot highlighting the Devices with/without Microsoft Defender for Endpoint sensor report in Endpoint security.A screenshot highlighting the Devices with/without Microsoft Defender for Endpoint sensor report in Endpoint security.


 


Temporary workaround



As a temporary workaround, check for the Defender for Endpoint onboarding status in the Antivirus agent status report under Reports > Microsoft Defender Antivirus. Look for the columns for MDE Onboarding Status and MDE Sense Running State for more information.


 


We’ll update this post when the fix has rolled out or as more information becomes available. If you have any questions, let us know though comments on this post, or by tagging @IntuneSuppTeam on Twitter.

E-Documents as a Global Solution for Business Central

E-Documents as a Global Solution for Business Central

by | Oct 17, 2023 | Dynamics 365, Microsoft 365, Technology

This article is contributed. See the original author and article here.

Business Central 2023 release wave 2 introduces a new global feature – Electronic Documents. Microsoft has crafted this as a foundational framework, providing a robust base for catering to localized requirements. This innovative approach allows Microsoft to efficiently deliver tailored localization apps for some countries. Furthermore, partners can leverage this model to craft their custom localizations. Given the unique e-document formats and distinct integration services prevalent in various countries, these localization apps are indispensable.

diagram

Why did Microsoft deliver it?

Before we delve into the world of E-Documents within Business Central, let’s acquaint you with an important new acronym – CTC, which stands for Continuous Transaction Control. This term signifies the imperative ‘real-time’ invoicing reporting and validation mandated by authorities. CTC encompasses a suite of digital control mechanisms to enhance tax collection and curb tax fraud. Electronic Invoicing stands as a key component of CTC, a model increasingly embraced by numerous countries.

We can easily conclude – this approach will become mandatory in many countries if it hasn’t already. The prospect of different solutions for each country poses challenges. Hence, we’ve developed one global extendable solution as an app, simplifying support for diverse countries.

Exploring the Scope of E-Invoicing Models

Understanding the landscape of E-invoicing can initially seem straightforward – creating an electronic file and transmitting it. However, the reality is more intricate. E-invoicing encompasses various models, including the 2-corner, 3-corner, and 4-corner frameworks. Each country retains autonomy to determine its preferred approach. Moreover, even in non-mandatory scenarios, businesses often opt for E-invoicing to streamline communication.

Our solution encompasses all the corner models mentioned here and facilitates additional messaging capabilities between access points, providing a comprehensive E-documents framework.

diagram

How do E-Documents Operate in Sales and Purchases?

E-Documents in Business Central facilitate seamless interaction in both sales and purchase processes. It’s a two-way system, enabling the transmission of electronic sales documents to customers while also receiving electronic documents from vendors. These electronic documents have their own distinct lifecycles, which may not always align with invoice timelines. To accommodate this, we’ve introduced a new entity, the E-Document, linked with the original document in Business Central. This entity hosts a unique information set, including statuses, logs, and potential error notifications or warnings.

Once the system is configured, posting a sales document triggers the automatic creation of an E-Document. Depending on your setup, it’s promptly dispatched to the designated service. You gain complete visibility into its status and can take additional actions as needed.

In the case of incoming purchase electronic documents, you have the flexibility to upload them to Business Central manually. However, if your access-point provider provides a document delivery service, you can configure a Job Queue for automated downloads and E-Documents creation. Here’s the magic: if you’ve mapped vendors’ items with yours through item-references or G/L accounts and there are no errors, the system will effortlessly generate purchase invoices with all the essential details. Your task? Just review and post them.

How to Expand This Functionality?

This framework has been created to speed up your productivity when building electronic invoicing applications by taking care of all the infrastructure work, like subscribing to different posting routines, writing custom mapping logic, logging, error handling, and running jobs in the background.

The framework is designed to improve your productivity in developing electronic invoicing applications. It handles essential infrastructure tasks such as subscribing to various posting routines, custom mapping logic, managing logs, handling errors, and running background jobs. This empowers you to direct your attention towards the specific electronic invoicing logic, including:

  • Exporting/Importing documents from Business Central to the local format mandated by the authority.
  • Establishing seamless integration with the authority’s endpoint for sending and receiving electronic documents.

To create your local E-Document:

  1. Create a new extension adding dependency to the E-Document Core application.
  2. Implement a document interface based on the specification mandated by the local authority, using designated endpoints for the sales: Check, Create, and CreateBatch, and GetBasicInfo and PrepareDocument when you expect to receive documents.
  3. Implement an integration interface to send/receive documents to the local authority automatically.
  4. Enhance user experience by implementing a setup wizard that gathers all necessary configuration details and obtains customer consent for data transmission. This streamlined process ensures a smoother onboarding experience for users.
diagram, schematic

More details with examples how to extend existing E-Document Core application can be found here.

The post E-Documents as a Global Solution for Business Central appeared first on Microsoft Dynamics 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.