MC847884 Check I OS 16 Mobile Outlook Users Due To Out Of Support In Sep 2024

Query

// MC847884 - Check iOS 16 mobile outlook users due to out of support in Sep 2024

// With iOS 18 releasing in mid September, the minimum supported iOS version would be iOS 17 as over time, Outlook for iOS on iOS 16 devices will eventually stop synchronizing email and calendar data. Do you know how many of your organization users are impacted by this new iOS released ? Use the below KQL to determine the list of impacted users.

SigninLogs
| where TimeGenerated > ago(90d)
| where ResultType == "0"
| extend OS = tostring(DeviceDetail.operatingSystem)
| where OS contains "Ios 16."
| where AppDisplayName == "Outlook Mobile"
| distinct UserPrincipalName, OS

// MITRE ATT&CK Mapping

// Based on the query, the following MITRE ATT&CK techniques are relevant:

// T1078 - Valid Accounts:
// The query focuses on successful sign-ins, which involves the use of valid accounts1.
// T1071.001 - Application Layer Protocol: Web Protocols:
// Since the query filters for the Outlook Mobile app, it involves web protocols for communication2.
// T1087 - Account Discovery:
// By identifying distinct user principal names, the query aligns with account discovery techniques3.
// T1201 - Password Policy Discovery:
// Although not directly related, successful sign-ins can imply adherence to password policies4.

Explanation

This query is designed to identify users within an organization who are using the Outlook Mobile app on devices running iOS 16. The context is that iOS 16 will no longer be supported for Outlook synchronization after September 2024, following the release of iOS 18. The query helps determine which users might be affected by this change.

Here's a breakdown of the query:

Data Source: The query uses the SigninLogs table, which contains records of user sign-ins.
Time Frame: It looks at sign-in records from the past 90 days.
Successful Sign-ins: It filters for successful sign-ins, indicated by ResultType == "0".
Operating System: It specifically targets devices running iOS 16 by checking if the operating system details contain "Ios 16."
Application: It focuses on sign-ins to the "Outlook Mobile" app.
Output: The query returns a distinct list of users (identified by UserPrincipalName) and their operating system details.

The query also maps to several MITRE ATT&CK techniques, indicating its relevance to security practices:

T1078 - Valid Accounts: It deals with successful sign-ins using valid accounts.
T1071.001 - Application Layer Protocol: Web Protocols: Involves communication through web protocols as it pertains to the Outlook Mobile app.
T1087 - Account Discovery: Identifies distinct user accounts, aligning with account discovery techniques.
T1201 - Password Policy Discovery: While not directly related, successful sign-ins suggest compliance with password policies.

In summary, this query helps identify users who might face issues with Outlook synchronization due to the upcoming end of support for iOS 16, allowing organizations to plan for necessary updates or communications.