Disabling SharePoint Online Site Creation for Users with Powershell

A friendly newer feature of SharePoint Online is that users can create their own SharePoint site without admin interaction. Note that this is different from restricting Office 365 group creation, this option lives under their SharePoint landing page. To disable this functionality in the web you can just do it via the SharePoint admin center (Settings > Site Creation), but the PowerShell method is harder to find.

The cmdlet you are looking for is: Set-SPOTenant -DisplayStartASiteOption $false

You must of course already be connected to SPO, whcih is out of scope of this post, see Here

Hardening the Fortinet Single Sign On Agent Account

The Fortinet Single Sign On Agent (FSSO Agent) allows your Fortigate to map IPs to users which is useful/needed for web and other filtering policies. The agent gets installed somewhere (usually a domain controller) and then polls for logon events and keeps a database updated. This works fine, except that it wants to use a domain admin account for everything. If you are working in a hardened environment and want to restrict service account access then there are a few hoops to jump through, so here they are. This guide is not intended for getting your FSSO Agent integrated with your Fortigate, it is just talking about how to get it working with a hardened non-admin account.

Pre-Setup

In my environment we have group policies that make it so domain admins cannot login to workstations. We also deny interactive logon to service accounts. Ideally we don't want the FSSO account to be a domain admin anyways, so we won't be doing that. However, for the initial setup, this is needed. So to start i created a user called FSSO and added it to the following groups: Domain Users, Domain Admins, Service Accounts, and Event Log Readers. Note that Service Accounts is not a built-in group, that is one i created. You can skip this if your environment doesn't require it.

Installation

1. Download the FSSO Agent from support.fortinet.com, this install was done with FSSO_Setup_5.0.0295_x64.exe
2. Install the FSSO Agent on a domain controller. When prompted for Simple vs Advanced for your directory naming/structure, i use Advanced, but that is up to you and is out of scope of this post.
3. Do not use the DC agent, use the option for Polling Mode with sub-option for Check Windows Security Event Logs

Adjustments

1. Remove the FSSO account from the Domain Admins group
2. Grant the FSSO account full control over the directory C:\Program Files (x86)\Fortinet\FSAE
3. Grant the FSSO account full control over registry keys: HKLM\SOFTWARE\WOW6432Node\Fortinet\FSAE and HKLM\SOFTWARE\Fortinet\FSAE