Know Your Stack:
Microsoft Defender for Endpoint

And here we go. We're back at it again, everyone. Welcome to Defender for Business, part four of our series. I feel the need to say hello in many languages purely because last time I realized we had so many different places. So, hello, bonjour, ciao, bonjouro

I think this is I don't think this is going to work out, Jesse. There's so many nihow, marhaba, salam, whatever I can think of.

Oh, wow. You actually did have quite some languages there.

I tried my best. I tried my best there. Thank you for coming on everyone. It's your favorite inforcer architects Jazzy and red one in the game.

We have one note taker that is really persistent. Jazzy

Should we let him in? Should we let we like AI? We like

Jesse's fellow notetaker. We'll let you in.

Welcome, Jesse's not taker. You're absolutely in.

Oh, it even dropped something in the chat.

There we go.

Oh, that's awesome.

We are we don't we don't discriminate. We take all AIS on board and we love humans, AIs alike for when the uprising comes, we need to make sure we're nice to them, right?

Really? You don't discriminate? Are you sure about that? I'm not sure, man.

Are you telling me that if you talk to a chatbot and you know that it's AI, you talk to it in the exact same way as

Hey, I say please and thank you to burn credits every single time. That has probably cost us as a humanity millions of dollars.

Can you can you imagine all the energy, gas, fossil fuels burnt because of people saying thank you and please?

Well, that's not why we're here today. We're actually here today to talk about Defender for Business.

Let's do some quick intros again. Maybe there's some couple pe people joining in today that are new that haven't seen the other episodes. Why are you laughing, Jazzy?

Because you added something to my to mine and you know I added something to yours.

I did not add anything in your introduction.

I do know for a fact that you've locked multiple tenants out. So yeah

Only demo tenants only because I was trying to break them. Thank you very much.

Sure thing. Sure thing.

Microsoft fanboy out here. Absolutely love Microsoft. If you haven't joined us in previous calls, you will be happy to know that my whole life revolves around Microsoft. I definitely speak about Microsoft during wedding parties and engagements and wherever I am, somehow find a way to put Microsoft in there.

Yesterday I have officially or unofficially become the IT support for my in-laws because my mother-in-law, I kid you not, called me and asked me to remotely troubleshoot their CCTV at their store. And it was a struggle. But what I did realize is that if you FaceTime, you can now take control of their phone. So locally, yeah, it blew my mind, mate. It absolutely blew my mind. Mother-in-law facetimed me. Yeah. IOS FaceTimed me and I was able she was able to share a screen.

I was able to control her screen on her iPhone and go through the browser to access the backend web portal of the CCTV system. It worked. It ace. Absolutely.

Are you telling me that FaceTime is now a phishing attack vector as well where people will ask you to take over the

Absolutely. And that it's becoming easier for people to get fished now, isn't it?

Okay, fair enough.

Yeah, been in the MSP space my whole life. I know how to manage multiple tenants at a time. I like the chaos. I can't do internal IT. I don't know how to manage just the one tenant and I have never locked multiple tenants out. That's red putting stuff in without me actually saying anything.

I mean you've put something in my intro as well. But yeah, my name is Ray Bulite. I'm based in the Netherlands. Worked for an MSP myself as well. So I worked in a model work team there. So I did a lot of in projects and defender projects. So Jazzy put in my slide has never locked a tenant out allegedly. I can say what the worst thing is that I did with conditional access.

So I was working for a client and I was trying to make a session policy in defender cloud apps via conditional access and then somehow it locked all of the guest users out of Dynamics 365 specifically just Dynamics 365. I'm not sure why that happened. So yeah I just got a call the next day like hey we have like 50 guest users trying to log in right now and it's not working. So, I'm happy I figured that one out in a couple of minutes and I was able to get them back to working.

What about you? What's your actual worst thing that you can think? To be really honest with you, I think the worst thing I've probably ever done is I messed up a conditional access policy for compliant devices for Macs where I didn't realize that you need to for the other browsers because obviously people don't have just Safari or Edge, they've got Chrome and others that you need to deploy other policies to make sure that it can see the device compliant, send out different config to the max

And then every time because it doesn't auto select a certificate that's part of your Mac OS to prove that you know your device is compliant, you've got the Microsoft asserts in there and things like that. That was probably the worst thing I did. All I did went into condition access, turned it off, told them to wait half an hour, prompts should stop, and they should be able to access M365 again. And I'm pretty sure I traled that.

I don't know what happened there.

Was that a P2 or was it a P1 or

Was it not that bad?

It wasn't that bad. The user definitely felt like it was a P1, but

The user always feels like it's a P1. What are you talking about?

I just pressed the button and turned it off and it worked out.

I am sure that if there is one thing that everybody here can agree on since it's just MSPs, it's that end users always think it's a P1 in their case.

Every single time.

Every single time. All right. So, what we will cover today is we will talk about Defender for Endpoint. We will talk about what capabilities are in defender for business specifically.

So defender for business is included in business premium. Since this webinar series is specifically focused on business premium, we are going to be talking about defender for business. Going to talk about what it replaces and also how you onboard it and then how you configure it. We're also going to talk about what capabilities there are, what kind of remediation actions you can take yourself as an admin within the Defender for business. So, let's first talk about what you've actually got within the Fenderful Business.

But first, why is it good enough? And there's something I want to talk about here because I'm not sure about you Jazzy, but there if there is one component that MSPs will most likely refer to a non-Microsoft solution, it's usually the EDR solution. So, you will hear

Yeah, you will hear SentinelOne a lot. You will hear sofas every now and then or crowdstrike maybe I don't know but for some reason it feels like the EDR solution for Microsoft a lot of MSPs will revert to SentinelOne and

I get that sentiment though right it's because we've always had AV as being a built-in antivirus right Windows Defender was built in or started being deployed out as part of Windows and we always felt like it wasn't the solution for EDR we need a third party solution for EDR but it's grown ever since And it's had a lot of input come into it, a lot of R&D money spent on getting where Microsoft is today purely because of also how many Microsoft devices are out there, right?

You have such a large estate, they can actually do the signal develop they can actually develop based off the signals they're receiving.

Yeah. And what I'd like to emphasize here, I feel like a lot of MSPs or engineers or maybe even consultants within MSPs, they have a feeling that Defender for Endpoint or Defender in general isn't good enough based on a feeling they had maybe 10 years ago. So, in this part of the series, we actually have some animations. So, we're upgrading, Jazzy.

Oh, yeah. Last episode of the season.

Last episode. And we figured out animations in PowerPoint. So what I did, I basically overlaid all of the gardener quadrant visuals from the past couple of years from 2016 up until 2026 and I've looked at the actual position of the Defender or Microsoft in the Gartner Quadrant and you can see how from 2016 to 2017 and then 2022 even that was the top that Microsoft achieved. Moving back to a little bit back in 2026 and 24.

But the main premises here or the main the emphasis I want to I want to give here is Microsoft now is a leader in the space just like CrowdStrike and just like SentinelOne. Every single platform you will find in the leader space there in the visual is a good platform. SentinelOne is a good platform. CrowdStrike is a good platform. The only variable here is how have you configured it. So if you've configured Microsoft defender for endpoint perfectly, it will be better than for instance crowd strike but then configured incorrectly.

So all of these choices are a good choice. But now the question becomes hey I am already in the Microsoft ecosystem. I'm already in a Microsoft tenant. I'm using all of the other capabilities there. So it might just be a logical step to move towards defender for endpoints. If there are any MSPs here in the call that are using SentinelOne for a very specific reason, I would love to actually hear it cuz yeah, I'm just very curious why that is the case.

Yeah, some more some more information on that timeline that I showed. There's a timeline in the bottom of the page as well. You can see some of the developments that have taken place. For defender for endpoint you can see that defender for business for instance has launched in 2022 and we will specifically talk about defender for business in the next couple of next couple of slides. Do you have anything to add here Jesse?

No spot on. No I think I completely agree with you. And we I think ultimately we realized that if we do have third parties being deployed out and third party EDR products being deployed out we just make sure that we figured out what capabilities are in defender for business or defender for endpoint and consolidate our stack if we need to and for example here three labs not one vendor so independent labs have tested and compared all these products and not Microsoft so if you Look at it.

It's ultimately being scored quite well, isn't it? Isn't it red? Isn't that the idea behind this?

Yeah. So, these are just three independent labs that have tested Defender as well. The other platforms has al have also been tested that are in the leader space and they've performed well as well. The only emphasis here is Defender is good enough and especially if configured correctly. So some more arguments. Why is Defender good enough? The same engine.

The engine is already installed on Windows endpoints the AV engine and the level of protection is actually exactly the same for consumer editions and for enterprise editions and even defender for business it's just the EDR component then that's put on top of the AV the middle the middle argument that you can see more than the endpoint what I'd like to emphasize there again it integrates with the Defender XDR and all of the compon components that you already have within business premium.

So if you're moving to business premium, it's actually a wider scope of just thinking about the fact that you can phase out SentinelOne because it's also email security and it's also cloud application sec security for instance. And yeah, one agent, one invoice makes it makes it easier. You have one portal to go to and one source of truth for all of your alerts and incidents. Honestly, every time you look at an MSP's bill, it just is the invoices are crazy having to keep track of everything you're paying for, everything you're charging for, those missed line items in certain invoices.

It can get a bit, you know, sprawly and it's so much easier to start consolidating purely for the overheads of billing sometimes, right? That's how I feel about it. But in terms of the enterprise grade that you already get, Defender for Business is like right in the middle. You get some of the capabilities from endpoint plan one, Microsoft Endpoint Plan 2 as well. And I love how they for SMBs, they fit it perfectly in the center.

It's such a cool way to do it that you get a lot of the EDR, the automated investigation, the tab protection, web content filtering that you'd probably be using third party tools maybe for and bundle it in Business Premium. Absolutely brilliant. Absolutely brilliant. And there are obviously some capabilities that you need plan two for. But that's more when you start increasing your security of stay and want to protect it further and make full use of it.

You can still look at plan two as well.

Yeah. And for all the people on the call that are not experts on Microsoft licensing, you'll probably get there since you're working for an MSP and you will be an expert in licensing. But just be aware of the fact that usually if you want to have P even P1, it's only included in E3 already. And then all of those P2 capabilities, you actually need E5 for that as well. So and those are included in Defender for Business.

So yeah, I mean it's a it's a pretty good deal from like a perspective of P1 and P2. Just coming back on the SentinelOne argument. I saw some people in the chat saying that there's a some SOC capabilities within SentinelOne. Could you tell us what the SOC actually does and how far that support extends and what you actually get there that you don't get with defender for endpoint? I know SOC is not necessarily included in defender for endpoint or defender for business, but there is a lot of automation capabilities.

I'm just I'm curious what the SOC adds on top of the automation capabilities that SentinelOne for instance also might have. Let's see. There are some limitations though. So if you're thinking about defender for business there is a cap just like with business premium 300 users is the cap because they're just focusing on smaller businesses no enterprise businesses. Five devices per user should be more than enough especially in the SMB market.

Users usually don't have more than five devices. And yeah, service cost extra, but I'm I could argue that for the SMB space, not a lot of service will probably be in scope anyway. The license trap is one that's actually quite important and Jezy and I were talking about it today. They did change this up a little bit because now you can have a mix of P1 and P2 licenses but you cannot have a mix of defender for business licenses and for instance P2 licenses.

So you need to either go full in or is it full in English you need to go full in

Full in on the Defender for business or you need to go full in or allin that was all in. You're native in English and you're telling me to finish that sentence so I can say all in. I was I said yes and I was like, oops. Maybe I should have told him it's all in. Full in just sounded right.

I'm not mad. I'm just I'm disappointed. That's all.

It's probably better. I don't want to see you mad.

So go all in on either one of both.

Yeah, absolutely. We do Red and I did have some different memories of it. I feel like I've deployed Defender for Business before and tried to convert it to a P2 and it did work. But you'd have to have all the users on the licensing, but we did we can leave a little link where it shows the licensing trap in there. I think it's in the previous slide anyway when you receive the deck.

Click the link, look at the licenses and see the strategy there. And the thing endpoint stack does absorb is third party AV and EDR solutions that you may have vulnerability scanning which is a very important one to highlight those CVS and make sure you've got software inventory and see what's out of date on your devices that you've deployed out and web content filtering which is usually also you know levied off to a different product but we can do web filtering category based blocking and even custom indicators as you may have seen in defense for cloud apps in our previous episode as well.

There's lots of good stuff we can do within edr already today with defender for business.

Yeah and just so oh sorry Jazzy but just so you guys know we will actually do some demos in this presentation as well. So I will go to the in portal and the defender portal in just a bit and we will show you how to configure most things. Jesse I'm really curious how you would answer the question that we have in the chat.

So a question about consolidating it all sounds good but in 2026 is it a good idea to have everything on all of those services under one roof. So do you want to consolidate all Microsoft 365? How would you answer that one? I'm curious. I see it as in some terms of capability. I completely understand having all of your eggs in one basket is kind of a dangerous attempt to have, especially if we're going with one vendor.

But I also look at the capabilities and the response rates of any breakages that happen with Microsoft, right, with any support issues that happen and anything that does stop working or we have outages, Microsoft has come back in a good frame of time. So the recovery hasn't taken so long. And if you are combining with Microsoft, you essentially are, especially for things like, you know, defender for Office 365 or your Defender suite.

Basically, you're looking at one person that can skill up on and become expert on one platform. It makes an MSP's hiring process easier as well, you know, and the other issue that I always have is I feel like when we start inheriting tools or tools we're not confident in, you lack configuration, right? You end up having a configuration drift. So if I have defender for office 365 and I've standard across standardized across all my customers and then there's one or two customers that have a different third party to I don't know Mcast proof point or whatever it's harder to maintain those I feel because a we may not be an expert b we won't we won't always be logging into those portals and trying to maintain them and baselining them whereas you know with inforcer obviously you're baselining everything and on top of that you're focused on one ecosystem so I do understand both sides of the argument.

It's very hard for me to not appreciate that, you know, we are going to have outages in Microsoft. Things are going to fail. But I've seen a history of good results at the end of it. That's how I feel about it

To be honest. For the past years, all I've worked on were environments that were consolidated into Microsoft 365. So Defender for Endpoint, Defender for Cloud Apps, Defender for Office, blahy blah. I have never seen a catastrophic event so far that actually made me unable to configure any of those services. Yes, Exchange has had it outages in the past couple of years, but that's usually just a day or maybe half a day. It does still work, but it's not really working the way it should.

And I do feel like some of these components within the Microsoft ecosystem are not really targeted or made for MSPs. So yes, sometimes you do not have one overview of all of your clients, but still when it comes to the catastrophic event argument, I'd say like I've never seen something happen that big within the Microsoft ecosystem. And I don't I don't think that will happen because there's so many so many disaster recovery, so much availability baked into the ecosystem as well.

I feel like I do remember one not really realistically catastrophic, but I remember there was a defender for defender for endpoint or defender for business issue where they deployed the wrong configuration or the wrong threat detection on the device and it was deleting files from like Windows apps. I feel like the inbox apps or the built-in apps, I can't remember, but they very quickly fixed that. We were following the whole outage and things were being fixed very quickly and you get your service notification and you get that message.

I there was something like that. I could be completely wrong about this but that's what I remember.

I take back my argument there has been one moment where I actually hate I hate Microsoft

Let's not go down this route too much. There has been one moment where Microsoft up that really made my weak and that's with defender for cloud apps. You have the risk scores for every cloud application. We had a policy that automatically tagged them as unsanctioned if there was a risk score between one and three. There was an outage that made all of the risk scores zero for all the cloud applications. So, we had multiple customers locked out all of their cloud applications within Defender for Cloud Apps for like days or a full day even.

This was maybe two years ago. So yeah, that one was I'm not going to say I hated Microsoft that day, but I think it wasn't it wasn't that far off.

As MSP folk here, we've all had days where we absolutely hated Microsoft, but that's the nature of the business, right? Ultimately if it wasn't for them, if they don't have outages, if they don't break something or sometime

Yeah. Yeah. Who do we blame, right? We have to blame someone and sometimes it's easy.

Hello, Mr. Caller. It is Microsoft. I will speak to you tomorrow. I'll put your ticket on hold for now and put the phone down. Right. Great. Great. End of day.

Yeah. I mean, you need to blame Microsoft every now and then, right? If you have a client's on the phone that's complaining about something. Ultimately to end this conversation, ju just to add, I mean, every vendor is going to have some sort of issue, right? We're going to have some sort of at some point. Hopefully not catastrophic events like the recent one where all of your backup data was gone. Hint, not going to say any names.

But yeah, hopefully it's not that bad where I can't have any of my backups back again. But other than that, I'm all golden.

Someone says they are the sacrificial lamb. Do you have time to Microsoft's name in vain throughout this world? They probably hate us by now.

Oh. Let's talk about on boarding actually because we went off on a different path there. When it comes to onboarding, as you can see within the slide, it does support multiple platforms. So, Mac OS is also included. IOS, I'm not even going to look at the chat right now. IOS and Android also able to onboard in defend for business service as we mentioned as well but we will leave that out of scope.

So Windows 10 and 11 you can see multiple ways of onboarding those endpoints the one way or the one solution that makes sense is via Intune. So within Intune, you can make a really quick connection between Defender and Intune and you can configure a policy within Intune and onboard all of your Intune managed devices into Defender. It takes probably like 10 minutes because you have to wait for the connector status to be enabled.

The actual policy takes one minute to configure and I can show that as well in a bit.

I agree with you with your connector status, the 10 minutes thing, but it's the coffee cup that pisses me off in Defender portal every single time. Brand new tenant, it's that coffee cup. It drives me nuts. I've seen it take half an hour. I've seen it take 3 days. I don't have a full-on reason of when that coffee is drank.

So, for the people that don't know what we're talking about, the first time you open up the devices pane within the security portal, for instance, the defender for endpoint instance has to hydrate or be created or I don't know what's going on. All you see is a coffee cup in the screen. And yeah, you are right. Sometimes it takes 15 minutes and then another time it takes hours for some reason. So yeah, be sure to open that up just once if you have the correct license and then it will actually hydrate the endpoints.

That's one strong coffee someone says. Yeah.

Brenda also said because Microsoft is always a great answer. I agree with that. And when someone we can't deploy defender for someone, it's the coffee cup because Microsoft I have caffeine intoxic. Okay, I got to stop looking at the chat.

Literally, I'm like at this point I could just live in the chat at this point.

So once you've onboarded devices into defender, the first question I would ask is what do I need to configure as an admin? Right? What do I need to have configured correctly? So the actual solution or the product behaves correctly as well. As you can see there's multiple things that we can configure there.

So we have next generation protection which basically consists of real-time protection and cloud deliver protection configured within intune usually. Network protection also configured within tune. I will show that in a little bit. We also have a firewall policy that we can configure some basic configuration there. We can create firewall rules as well. So we can configure that from within eune. Also from within Intune some ASR or the ASR component that consists of multiple subcomponents.

The attack surface reduction rules is a subcomponent of attack surface reduction as a whole. And controlled folder access and device controls also included there. So I'll show that as well in a bit. There is one thing I'd like to emphasize here that I don't like and Jazzy please tell me if you agree or not. So for some reason or I mean I get it but defender lives in Intune and the defender portal. So the security portal

I will give a I will give an example. Attack surface reduction rules are configured within intune. But if you want to see the reports and the monitoring on it you go to the security portal. In the security portal you see what exclusions you have to make for what file paths. But if you want to make those exclusions, you go back to Inune. So there is this back and forth between Incune and Defender when it comes to configuring it.

Yeah, I agree with you some. I mean, you can have custom indicators for some of our ASR ruling as well for exclusions and things like that you can do within the Defender portal. But I like the fact that the reports and the actual what's the word I'm looking for? Hunting, if you will, for a better lack of words, for a lack of better words, sorry, is done in the defender portal because then I've got my XDR, right?

I've got everything in there. I've got my identity. I've got my now cases. I believe they changed incidents to they're now called cases within the defender portal. So, I do like that all of the reporting side is in one element in some case. And Intune is what Intune is, which is an MDM platform, right? Manage your mobile devices, push the policies out. I kind of like that separation. So, I disagree with your hatred for this.

Maybe hatred is a strong word. Should I say strong dislike?

I have noted your disagreement with me.

Oh, there we go. We're keeping it civil here. No one's dropping any f bombs at each other today.

I can see I can see a question. Does anyone have any bad experiences with a full ASR stack? So, that's the attack service reductions. Some are higher impact than others. I can see somebody else already. Yeah, somebody else already. Yeah, Brenda, thank you. You can put those roles into audit mode and then actually go to the report and see what would have been blocked if you had it in block mode. So I can I can show that as well in a bit and I will actually go ahead and share my screen right now.

And for Peter just said it's been a few years but it caused a lot of noise when I took over it. Maybe it was still an issue though. Maybe it was a skill issue though. I don't think it was a skill issue. I Peter honestly the noise that comes out of in the beginning is crazy. Especially read SVChost.exe

Every single time. There is some noise that you can frantically ignore actually. But a lot of it is noise in the beginning. I think it takes a little while to iron it out, but the audit mode is brilliant and you can have proper reporting on audit mode that Red will hopefully show us in just a moment's time.

Yeah. So the noise that has been mentioned I can actually show that in this tenant as well. So you have one you have the SPC host process that will bug out or not really bug out but just cause a lot of noise on one specific rule. I think it's the credential stealing I don't know. Yeah, credential access something like that.

Let's talk about onboarding first and I'd have to go to the defender portal real briefly and show that first action.

So let's head over to the security portal. Go to settings and then hop over to endpoints. There's a toggle there that actually enables the intune connection. So that's the connection between the security portal and Intune. So if you scroll down a bit, we can see let's see where we are at Microsoft Intune connection. You got to enable that toggle. That will set the service to service connection. And then if we hop back to Inune, we head over to endpoint security on the left hand side here and head over to endpoint detection and response over here.

And this is where you configure one policy and that basically onboards all of the in managed devices the Windows devices into EDR. As you can see, Windows specific policy is really simple only has like two settings in it. It will be auto from connector and sample sharing that you could configure as well. That's basically it. If you are too lazy to configure this policy with three settings, you can actually go ahead and click on edr onboarding status and you can deploy a preconfigured policy as well.

So, makes it even easier for you as well and you can see what Yeah.

Isn't it that when you're doing it from the security portal that you can have it select in from there as well and then it creates the profile? I can't remember. There was a

You sure that's a one time thing? One time when you activate it lets you chuck it into. So yeah, I think it's that button there.

Yeah, that's also definitely a possibility. So we were talking about the prevention policies that you can configure. So that is mainly done from within the Intune portal. We have discovered or discovered we've actually talked about real-time protection, network protection. Let's see what else we had. Temper protection. We'll talk about in a bit. As you can see, I have an anti virus policy here. This one is based on the open inum baseline actually that's an opensource initiative that has a baseline of a lot of policies that have a lot of best recommendations already set if there is one thing I would say here is we're going to look at multiple different policies anti virus policies ASR rules we're going to talk about device control controlled folder access don't try to reinvent the wheel there are very good open source initiatives there are very good baselines within inforcer for instance as we have the blueprint library.

Take over those best practice recommendations that have already been set and then tune them as you like. But don't try to reinvent the wheel with these things. So don't think you have to configure this policy all by yourself. There's multiple initiatives that will help you in this. So for instance, if you look at the anti virus configuration, this is where real time protection for instance lives. Realtime protection is a combination of real time behavior monitoring if I'm not mistaken.

There should be another one as well. Real time monitoring. Oh, so it is this one. Real time monitoring allowed and it's also the cloud protection. So there we go. Allow cloud protection is allowed. Turns on cloud protection also configured from within intune. When it comes to network protection also configured within this same policy. So let's scroll down a bit. We can see that network protection is also enabled from within this policy. So most of those capabilities you can actually configure from within this policy.

Like I said, just take over best practices and it's really easy to configure

And some of these do point back to our episode three as well where we talked about defend for cloud apps. So having the enable network protection in there, having block mode in there, I believe these are the settings you're looking to deploy to make sure when you're unsanctioning an app, it gets blocked by a custom indicators on the endpoints as well. So some of these settings will be a prerec for that.

Yeah. And this is where that consolidation then also comes into play of course because this where those different tools or platforms within Microsoft 365 actually talk to each other and yeah play along with each other as well. So that's antivirus configuration. If we hop over to firewall we usually you will see just a firewall policy that configures the firewall as a whole and you can configure some firewall rules as well.

So if we think about firewall configuration also usually just best practice configuration that you will see here. Also don't reinvent the wheel. Most of this is already configured with best practices. If it comes to actual rules that you want to create that's also fine. If you create a policy you will have an option for firewall rules and you can actually get as granular as you can get from within the local firewall policies that you have on Windows as well.

So just like you're used to. Default I believe is block all inbound. So you can start opening up ports here in case you need to for any reason. It's all done in Intune in the way you imagine deploying your rules. It's not just because you're deploying defender for business doesn't mean you're now living in a different portal configuring lots of those policies. You are still doing a lot of it if you want to with an intune.

There is also just to caveat what you're saying red but you can you don't have to use intune when you do onboard devices you can just use the security portal and not have that Intune connection and still deploy some basic things like correct me here if I'm wrong red AV firewall rules and things like that straight down to the device not things like ASRS like attack service reduction rules that we'll probably show in a minute that you do need Intune for it's not available in the security portal directly But when you set up Defender for Business for the first time, you'll get that wizard.

It will show you the path. How do you want to configure all of this? So you can get started with a minimum approach if you want to as well.

Yeah. And you can actually check, if I'm not mistaken, you can change that as well later on. I can actually show where that toggle lives. Usually most MSPs or most organizations I've seen they will choose to configure the endpoint security policies within Intune and then do all of the threat detection and response and stuff like that in the defender portal. So firewall configuration lives here. Next one is attack surface reduction. The attack surface reduction that has multiple components is it in it.

The attack surface reduction rules and the controlled folder access lives in the same policy type. So, if I were to dive into this one at the top here, attack service reduction rules for instance. I think that is actually not the correct one because I have one in audit mode and one in block mode. Let's take the second one. There we go. So, these are all of the ASR rules that you can configure.

You have multiple options here. So, let's see if I can show that. So you can block it immediately, you can audit, you can warn or have it off or just not configured. And I will show where the reports live that will show you what specific processes or files have been blocked by the ASR rules. So these are all the all of the ASR rules that you can configure with yeah any of the actions that you can see.

And then at the bottom of the page, this is where you can configure controlled folder access. I'm having a hard time giving a simple explanation of controlled folder access. I'm pretty sure it's right access to specific folders. I'm not sure what there's like some preset folders there.

I do believe there are some preset folders. I don't remember off the top of my head, but essentially you're controlling some folders on the device where no one will have right access to make sure that malicious programs don't get in and try and modify system level files and things like that.

So, let's take that scenario where someone in the chat said, "We've had some issues with the ASR rules." Let's say I've put them in audit mode for a couple of weeks. If I now hop back to the security portal, there is a reports section. So, there we go. Left hand side reports you can see there's an endpoint section here and there's attack surface reduction rules. If I click in on that, I will see all of the detections that have been made over the past couple of weeks for instance and all of the different components that would have been blocked or audited for some reason by what rule as well.

So I can see here that a specific file would have been blocked for now. It's just an audit mode because of this specific rule. Now you of course have to make the choice. Do I want to do I want to make an exclusion for this specific file? If you want to add the exclusion, head over to add exclusions. You will see that specific file and you can get the actual file path for that specific file.

So if I go over here and get the selected exclusion path, you will get the whole path from for instance C to users or whatever and you can put that path into the policy here in Intune. So for that specific rule, you would add the exclusion for that specific rule only if that makes sense. So this is how you would go about and audit the actual impact first, make the exclusions that you want to make and then move towards block action if that makes sense.

I am pretty sure though on Oh, I'm guessing that Jez wants to say something.

Yeah, we've got a question. We've got something that Martine actually said for some of the ASR audit modes you need higher license to be able to read the impact as far as I could find. I wasn't able to see the reports with business premium I found. So personally for me I've deployed this to BP and gone exactly the way you went to see the audit results of the policies that I was deploying even post deployment where I have blocked it.

It hadn't caused an issue for me. Now you may be right by saying that certain ASR rules don't show up. I cannot confirm nor deny that right now. I will look into it. But do you know if certain ASR rules don't actually show up in audit mode in the defender portal? I haven't seen that. And is I'm thinking are you not seeing those rules because they don't have any impact? Maybe is that

That's the whole to be honest that was my first notion. That's what I agreed upon and left it as.

So I can see that Rosie has a question. Could you not search in advanced hunting? So most advanced hunting capabilities for defender for endpoint

Are not in defender for business. So I'm actually going to give an example. Controlled folder access is if you want to know the impact for controlled folder access. I always did it with advanced hunting. There's a very simple KQL query that you can run but I cannot run it in this tenant since I have defender for business. So it's actually pretty hard to know what the actual impact is of control folder access. So that is I would say the one the only limitation in the Fenderful business that I would like to have had which was a nice to have but not necessarily a mustave to be honest.

Let's see what else we had. Oh yeah. So within attack surface reduction I just showed the attack surface reduction rules and controlled folder access but you have multiple policy types here. So device control for instance is also something that you can configure from within here.

Device control is the question do I need to be able to use USB devices for instance or external storage devices or external storage media excuse me. And also some Bluetooth control on devices as well. So this is where you can control those. Again this is done by the defender agent so to speak. So you need that connection with defender. Anything else we had to add here or anything else on the prevention slide that we are missing?

Maybe tamper protection. Oh yeah and web content filtering actually. So

Another good example of how configuration lives in two different portals. So I am still going with that argument Jazzy. I don't care for your opinion on that. So what is web content filtering? It's basically being able to block certain categories of websites within defender for endpoints. So if we head over to settings on the lefthand corner, go to endpoints, you will see web content filtering here on the left hand side.

If I click in on that, you can just it's very easy. This will take one minute. You can add a policy and it will basically ask you to select categories. For us in the MSP that I worked for, we always had two categories that we fully blocked and the rest we did not block. So it was adult content and legal liability. All categories or subcategories within there we would block. It would make perfect sense for us because there's no good reason on a company managed device to go to any of these websites.

Download sites, image sharing, all of these are yeah, you could have a discussion about that. You could have a good argument to actually allow it or not allow it. And this would actually block sites that would didn't necessarily were bad.

Yeah, I mean ultimately depends what you want them doing on the end points, right? It's probably a discussion you can have with the customer directly. Sometimes it's like, you know, they're using image sharing or they're using any sort of streaming media and download sites because, you know, box gets blocked out, whatever, and they use box on the outside or they receive links from customers that they need to actually download. But you could go down the route of allow listing specific things that works for them.

But we realized there was a lot of noise. We were receiving far too many actual tickets to white listings or allow listings than necessary and those categories I completely agree with other than we also used to do uncatategorized. So we used to do park domains in newly registered domains to make sure that phishing attempts you know hopefully get suppressed a little bit. But those are the only other thing that we used to do on top of what red was doing at previous MSP.

Yeah and just a quick note on that. So we have tried uncatategorized as well. We had some false positives with that. So we'd have clients that were would message us and say, "Hey, we cannot reach this particular domain." There is a way to also monitor this. It also lives in the reports section. So if I head over to reports on the left hand side again, go to endpoints again, you can see it's a web protection report.

And if I head over there, I can see the actual report for web content filtering. So I can see how many web requests have been done in different categories. I can see if any attempts have been blocked and I can also see what specific domains have been have been visited and if I can even dispute the category. So if there is one specific domain and you want it to be allowed within that category since it's category based blocking you cannot really do anything.

You can dispute the category from within that report. Let's see what else we have. Temper protection is the last one that I'd like to discuss that lives in the endpoint section here as well. So under optional features, there is a capability here called tamper protection. It essentially makes sure that users or helpful users that we've put in the slide cannot tamper with any AV settings locally on the device. Usually this I'm pretty sure that nowadays if you create a tenant this is turned on by default.

This used to be turned off by default, but there's no real good reason to have this off, especially for MSPs. Just turn tamper protection on to be honest. It makes life easier. Anything to add? Did we miss anything on the prevention side of things?

No, I was looking at it. You got it spot on, mate. Yeah, you've got everything in there. Tamber protection is one of the ones that you can still configure in your AV profile as well. But that depends if it lands on the endpoint, right? And

The one switch from here forces it for everyone.

So there is a good question from Anthony is I gather you can allow list specific domains that fall within a category. For example, our current filter does gambling sites, but the amount of owners we've had say can you unblock the lottery though? I have seen that a lot as well actually. It's funny that people behave the same in like

Every single thing. Yeah. Buzz buzzword bingo for any of our owners and contacts we've spoken with any of our employee with any of our customers. It's always the same thing.

So when it comes to allow listing in web content filtering, I would go with the route of disputing the category within the reports. That's what I just showed in the report as well. You have custom indicators as well within Defender for Endpoint. To be honest, I'm not sure which one took prevalence to be honest because I've had this question before. I'm not sure if indicators went before web content filtering block. That's something I'd have to look up again.

Do you do you know that, Jazzy?

No, I'm not too sure about that.

I'm not too sure about that as well. We disputed the category usually, and that worked pretty fine. Work within a day or two.

Yeah, I mean allow custom indicators allow what would work straight away, right? The second you have that in there, that would allow it. I'm not sure if that falls under web content filtering or not.

Yeah. And to be honest, disputing the category wouldn't be the solution because the lottery website is actually the website.

Yeah. Yeah. So that doesn't make sense actually. So, yes, you would have to go the custom indicator route. Go to cost and allow

I'm hoping that takes prevalence over can you show the ASR audit page again? So yeah, that is in the report section as well. If you head over to reports endpoints, here is the web protection one and here is the attack surface reduction rules one and this is where that report lives as you can see. So we just talked about the device control policy. You're actually able to have a or you have a report on that as well.

So if I want to know if any USB sticks have been mounted and unmounted on specific devices, I can see that here as well. Same goes for firewall, I have those reports as well. So all the policies that you configure within Intune. If you want to monitor those, you go to the report section within the security portal. If I head over to that specific reports, I can see all of those all of those here.

Let me uncheck that real quick. Let's see if that works. This is this is the specific thing that Red doesn't like about it that he has to do all the reporting here.

I don't mind it.

I mean, and let me guess, the defender portal is now going to bug out and not show not

Obviously because we're doing a demo. What do you expect? That's the demo. Does that work?

Yeah. Well, usually this should load in. We probably have to wait for two or three minutes and then it will load in. And this will show you all of the mount and unmount actions that you have within your organization. Let's see if we can hop back to the presentation real quick and show the next slide. Oh, there we go. So, you are able to see that now. So, here you can see all of the mount actions that I actually have performed on my device.

But this is a lot of mount actions in a short amount of time. So, I'm guessing that there's something wrong with my external storage. It's likely sleep mode.

Yeah. Yeah, that's Yeah

It's just going standby. The one thing that I will say, Red, maybe in the interest of saving time, rather than jumping into the slideshow, which you just have done, we could probably show vulnerability management in there and show

Okay, fair enough. Let's just hop back into the portal. So, what we are going to discuss now is posture and reporting. I'm happy that we already showed the reports actually. So we're just going to talk about posture management as well and then detection as and response capabilities within the Defender endpoint as well. So let's hop back to the portal and actually show where that lives. So there we go. Are you able to see that again?

Okay, perfect.

So when it comes to posture management, most of the capabilities live under exposure management. One of those subm modules so to speak is vulnerability management which lives in this dropdown. I get a little overview page of all of the different vulner vulnerabilities. I get some impactful events that have so new CVEs that have been detected within my environment. I usually wasn't in this overview a lot to be honest. The vulnerability section here and inventories is where you will probably spend most of your time.

Vulnerabilities is pretty granular. So it will show all of the CVEs that are actually applicable to your organization. There is a filter that's always preset here in this page that will show all of the CVEs actually applicable to your organization. So you can see in my little test tenant here with just a couple of devices. I have 7000 or 700 vulnerabilities already. Most of them are in Google Chrome and in the Windows OS probably.

So I might need to have a look at that actually. Th this is all the C cvees applicable to the organization. I can actually remove that filter and you will see that you can see all CVEEs that Microsoft has in its database which is around 300,000 I want to say or maybe even more by now

When it loads

330,000 CVE. So if you just want to have a quick lookup of a particular CVE and some information about it, this is probably where you would go.

Yeah. Do you have some questions?

No questions at the moment. The one thing I will add for the UK members here. This is a lifesaver when it comes to cyber essentials and things like that where we can find the old apps that are still living on there and the scanners will throw a fit that it's an old version and things like that. Really helpful.

We can actually kind of flip this view. So, as you can see, we have so many CVE for Google Chromebook. For instance, if we head over to inventories, it flips the view and it shows you all of the software components that have been installed on those devices and shows you the amount of weaknesses there. So, that's the amount of CVEs that you just saw in the other view. This is also a perfect overview of or maybe a perfect answer to a question.

Has a particular application been installed in my environment? Right? Intune does something similar. It has a report called discovered applications, but it's pretty bloated with a lot of native Windows applications, whereas this is a little bit more friendly to be honest. So, if you have a question if Burp Suite for instance is downloaded, cuz I'm pretty sure I have Burp Suite on my There we go. I think I just saw it. Burp Suite. If a user has installed Burp Suite for a reason, which will probably not be a good reason, then you can actually find it here.

If you have defender for endpoint installed on your on your devices. So this is just a software inventory of all those different devices. Let's see. So this is just vulnerabilities and having a software inventory list. When it comes to actual configuration of your endpoints, you also get recommendations from Microsoft. So if we head over to recommendations, you will see that those recommendations are split out by misconfigurations and vulnerabilities. If you're thinking about how ASR rules need to be configured according to Microsoft, if you're thinking about other policies, how they need to be configured, this is basically where you can go.

You can see you have a very specific secure score for only devices and you can go ahead and create your baseline based on the best practices that Microsoft has here. So you can see the policy names or the setting names. You can see how many devices already have that configured and you can see under which category that lives. If I scroll down a bit, you can see that some or a lot of things should already be configured for my devices.

Of course, the defender portal is bugging me out and is not scrolling correctly. There we go. So, you can see that real-time protection for instance, that's one of the things that we were already looking at. Now, I lost it again. But has been configured already for in one of those policies. Defend the firewall. As you saw in my policy, I had it configured and assigned to those devices. So, you can see I'm actually scoring 10 out of 10 on those specific settings in the firewall configuration.

And at the top of the page, I still have some policies where I have work to do. Any additions? Am I missing something here?

No, you've said it all very well. The idea obviously behind this is that you create the policies within inforcer, deploy it to your baseline tenant, celebrate because it'll only take you one minute to deploy it out to all of your tenants. And then we're all golden, right? That's the idea behind all of this.

Exactly. I see 33 4,000. Let's see. So on the vulnerability section here, it's also the vulnerabilities, but then wrapped in a recommendation. So here it actually tells you that you should update Google Chrome to a very specific version whereas the other overviews here vulnerabilities and inventories just showed you the CVES and shows you that there are weaknesses and here it's wrapped in a recommendation actually go ahead and remediate that and that's probably done viaune as well.

So this is where you would actually use to update those applications

Might be able to start using Intune app management that we're now offering in inforcer as well. Ask your PSMs about engine app management if you haven't already.

But we're now having the ability to deploy apps and auto patch them with a enterprise back catalog as well with an inforcer.

Yeah. So to be honest on that note, if there is if I could say one thing that does not make a lot of sense for MSPs when I'm looking at this overview. So hey man, I'm just being honest over here. So, we have all of these recommendations, right? And I can go through all of these recommendations and create the correct policies, but I've just done that for one customer, and that makes zero sense because we're in MSP and we're managing maybe one hundreds of tenants.

So, the whole idea here, of course, is you only have to go through this list once. You wouldn't even have to go through the entire list because most of these recommendations are already in those initiatives like the opening baseline, like the blueprints that we have within inforcer. So, use those. You have most of the recommendations already set and you only need to baseline the rest of the recommendations that you can see here. The whole point of inforcer, the whole the whole reason why inforcer lives of course is the fact that you can baseline that once and then deploy it to all of your customers.

So yes, in the Microsoft portal it's not MSP friendly, but that's the whole reason of baselining and then deploying to your customers at scale. The last section cuz we've talked about configuring and on boarding. We've talked about posture management. So what kind of insights does defender actually give me about my devices? The last thing last but not least definitely I am looking at the time though we do have two is it two minutes left?

Do you remember me saying that I felt like for defender for business we probably will have like 15 minutes left at the end because there's

Literally we were sitting there saying how are we going to pat this out for an hour but clearly we have a lot to talk about for defend for business as well

Yeah so excuse me guys we might go over time just a couple of minutes I will go over the response capabilities that you have just very briefly will take one or two minutes within the assets here you can see all of your devices that have onboarded into Defender for Business. If I go over and click on one of these devices, so I have a Windows 365 device there for instance. If I click in on that, I have some response capabilities here on the top right corner.

So, I can initiate live response sessions. I can initiate automated investigations. I can isolate the device from the network and just have Defender connected to that device, but then have the user maybe still be able to use Outlook Teams and for some reason Skype for Business because everybody uses Skype for Business.

It's the best communication tool out there, man.

So, the point I'm trying to make is there's a lot of capabilities that you can run yourself from within Defender as well. And Defender does a lot automatic automatically as well. So if I head over to incidents, I can see that a high severity malware was detected on one of my devices. If I click in on it, I can actually see that specific malware was contained automatically by Defender. So I didn't even do anything.

It just did it for me. Those are the automation capabilities that you actually get. You can see that a remediation action quarantine has been made. So, let's hop back to the slides and actually conclude this real quick you guys. So, all of you can have a good rest of your day and think about the Defender for Business the rest of the day.

Well, the whole stack, eh, Know Your Stack.

Let's see if we can hop to the last slide real quick and come to a conclusion. There we go. So we do have a brief checklist here. You can go over the checklist because we will send out the slides to you guys so you can see what was important. Just a quick note on the Know Your Stack series. We've done multiple episodes now. We started off with Entra ID, Defender for Office, Defender for Cloud Apps, and now Defender for Business.

The series is kind of concluded now, but we'd love to get your feedback. So, a feedback form will probably be sent to you guys. Please give us some feedback. Please let us know what you did like, what you did not like, or if you want to have some more episodes. Doesn't have to be business premium per se. Can even be E5 maybe or some other capabilities or even other things. Please don't ask anything about SharePoint and stuff like that.

I'm not really into that.

Ask SharePoint. We'll figure something out. James, absolutely. The slides will be shared with you to your email addresses that you signed up with. And honestly, thank you all for sticking by. It's been a pleasure being here and showing you some of the things that Red and I have been doing in the last few years of us combined a couple decades of experience at this point. So it's been an absolute pleasure. We've done everything we could in Know Your Stack for what we thought was best for business premium.

Like Red said, drop us a feedback. Let us know what you want us to do next. We're here to help you guys out in any way we can.

Anthony, thank you so much. Everybody, thank you for the emojis. We really appreciate it. If you could just fill out the form that's been sent so we know what to focus on next and what webinar series to host next. But you guys will receive a form on that. So, thank you so much for all for listening in and hope to see you on the next webinar series.

Take care.

Peace out.