Preface

Microsoft 365 Defender is Microsoft’s extended detection and response (XDR) platform, which you can use to protect against and respond to cybersecurity threats across endpoints, identities, cloud apps, and email.

The goal of this book is to cut through the marketing fluff, separate buzz from reality, and create clear guidance about the key parts of Microsoft 365 Defender, including the following:

• Microsoft Defender for Endpoint
• Microsoft Defender Vulnerability Management
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Microsoft Defender for Cloud Apps

The authors have found that customers are often confused about what each of these products and the larger suite is capable of. Often, core capabilities are misunderstood and not optimally configured. Many features and abilities aren’t even known about. To help you master Microsoft 365 Defender, this book was written to give you an overall understanding of the entire product set that you can articulate at either the executive or technical level, along with detailed guidance on best practices regarding architecture, deployment, and ongoing operations after deployment.

We hope you enjoy it!

Who this book is for

This book is for anyone architecting, deploying, managing, responding with, or otherwise using Microsoft 365 Defender and its suite of capabilities.

The first section of the book is intended for anyone (including executive-level readers) who wants to understand the need for and capabilities of Microsoft 365 Defender.

The remainder of the book is targeted at both new and current users of Microsoft 365 Defender, be it those starting a new deployment journey and looking to understand fundamentals, or those with existing deployments looking to confirm that best practices are in place and features are fully utilized.

What this book covers

Here are the chapters that make up Mastering Microsoft 365 Defender. The author of each is denoted by either (RC) or (VH).

Chapter 1, Microsoft and Modern Cybersecurity Threats, explains the current threat landscape and what we must defend against, followed by how Microsoft 365 Defender fits into this with an executive summary of its vast capabilities. (RC)

Chapter 2, Microsoft 365 Defender: The Big Picture, acts as an executive-level description of what Microsoft 365 Defender is and its vast capability set. (RC)

Chapter 3, The Fundamentals of Microsoft Defender for Endpoint, sets the foundations for learning about Microsoft Defender for Endpoint, such as important architectural points. (RC)

Chapter 4, Onboarding Windows Clients and Servers, guides you through the many different ways that both legacy and modern Windows operating systems can be onboarded into Microsoft Defender for Endpoint. (RC)

Chapter 5, Getting Started with Microsoft Defender Antivirus for Windows, covers basic management and interfaces for Windows, including topics such as the GUI and PowerShell, scanning exclusions, and updates. (RC)

Chapter 6, Advanced Microsoft Defender Antivirus for Windows, continues the learning path for protection on Windows, exploring cloud-delivered protection, potentially unwanted app protection, running modes, tamper protection, troubleshooting, and reporting. (RC)

Chapter 7, Managing Attack Surface Reduction for Windows, focuses on a huge set of proactive security capabilities collectively called attack surface reduction (ASR): ASR rules, controlled folder access, exploit protection, and network layer protection. (RC)

Chapter 8, Managing Additional Capabilities for Windows, finishes the Windows capabilities path by covering device discovery, device control, and firewall management. (RC)

Chapter 9, Onboarding and Managing macOS, teaches you how to onboard and then manage your macOS estate with Microsoft Defender for Endpoint. (RC)

Chapter 10, Onboarding and Managing Linux Servers, picks up from the previous chapter by continuing to cover Linux server onboarding and management. (RC)

Chapter 11, Onboarding and Managing iOS and Android, wraps up the journey of Microsoft Defender for Endpoint’s huge OS scope, as you’ll learn how to get your mobile devices protected. (RC)

Chapter 12, Deploying Microsoft Defender for Identity, covers what Microsoft Defender for Identity is and what it can be used for. It also goes into detail on how to deploy this solution in your environment to monitor your on-premises Active Directory. (VH)

Chapter 13, Managing Defender for Identity, builds on the knowledge gathered in Chapter 12 and focuses on how to manage this solution, both in terms of managing security alerts and health alerts. (VH)

Chapter 14, Deploying Exchange Online Protection, teaches you how to deploy the first line of email and collaboration defense in Exchange Online Protection. (VH)

Chapter 15, Deploying Defender for Office 365, covers the second part of the email and collaboration defenses in Microsoft 365, and how to deploy it. It will go into detail on how to configure the solution-specific details in Defender for Office 365 as well as look at how it integrates with Exchange Online Protection to offer security through the entire email chain. (VH)

Chapter 16, Implementing and Managing Microsoft Defender for Cloud Apps, covers the cloud access security broker and SaaS security tool in the Microsoft 365 Defender platform, by teaching you about its capabilities, how to deploy them, and how to integrate with other services such as Azure AD and your other SaaS apps. (RC)

Chapter 17, Maintaining Security Hygiene and Threat Awareness, teaches you all about proactive security measures by covering Microsoft Defender Vulnerability Management and threat analytics so that you can block threats before you even need to respond. (RC)

Chapter 18, Extended Detection and Response with Microsoft 365 Defender, looks at how Microsoft 365 Defender is used in an XDR sense, and how you can utilize these solutions together to identify, triage, and respond to incidents. (VH)

Chapter 19, Advanced Hunting with KQL, covers how to use KQL to perform advanced searches in your Microsoft 365 Defender solutions. It also gives you detailed knowledge about how to create custom detections, which is a vital part of using Microsoft 365 Defender. (VH)

Chapter 20, Microsoft Sentinel Integration, shows you how to integrate Microsoft 365 Defender with Microsoft Sentinel so that, if you use Sentinel, you can centrally respond to incidents. (RC)

Chapter 21, Understanding Microsoft 365 Defender APIs, explores the different APIs available for working with Microsoft 365 Defender, including recommendations about when to use each. (RC)

Chapter 22, Glossary, provides a quick lookup reference of common terms and abbreviations used in Microsoft 365 Defender.

Chapter 23, Answers, gives you the answers to the questions posed at the end of each chapter.

To get the most out of this book

You’ll want licensing to Microsoft 365 Defender, typically obtained with Microsoft 365 E5 or Microsoft 365 E5 Security. Trial licenses are an option, as is the Microsoft 365 E5 Developer license, but please note that one does not include Microsoft Defender for Endpoint. You can deploy Microsoft Defender for Endpoint using tools such as Group Policy, Intune, or Configuration Manager, so consider having one of those available.

Microsoft Defender Vulnerability Management add-on capabilities also have a trial available.

An Azure subscription, including a trial subscription, will also help as you explore Microsoft Defender for Servers.

On-premises or cloud-hosted Active Directory Domain Services will be required for Microsoft Defender for Identity.

If you have them available, Enterprise versions of cloud apps such as Dropbox will be useful for experimenting with Microsoft Defender for Cloud Apps. Dropbox, at the time of writing, has a trial available for when you want to test out things such as session policies.

The network requirements for Microsoft 365 Defender vary by its subcomponents and are likely to change over time. The same goes for the supported operating systems. If you run into any problems, you should reference Microsoft’s official network and support documentation.

Software/hardware covered in the book	Operating system requirements
Microsoft Defender for Endpoint	Windows 7 SP1 – Windows 11; Windows Server 2012 R2 or later; macOS (last three versions); Linux servers; iOS/iPadOS and Android phones
Microsoft Defender for Servers	Windows Server 2012 R2 or later; Linux servers
Microsoft Defender for Identity	Active Directory Domain Services; optionally Active Directory Federation Services

Consider following and reaching out to the authors on Twitter (twitter.com/rucam365 and twitter.com/headburgh to keep up to date with Microsoft 365 Defender changes over time. The product never sits still!

Some files relevant to the book are also available on GitHub: https://github.com/PacktPublishing/Mastering-Microsoft-365-Defender.

Download the color images

We also provide a PDF file that has color images of the screenshots and diagrams used in this book. You can download it here: https://packt.link/meh2k.

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: “Download the mde_installer.sh installation and onboarding script from GitHub for execution on your Linux server. One way of doing this might be using wget or curl.”

A block of code is set as follows:

{
	"antivirusEngine":{
		"enforcementLevel":"real_time",
		"behaviorMonitoring":"enabled",
		"scanArchives":true,
		"maximumOnDemandScanThreads":1,
		"exclusionsMergePolicy":"admin_only",
		"threatTypeSettingsMergePolicy":"admin_only",
		"threatTypeSettings":[{
			"key":"potentially_unwanted_application",

Any command-line input or output is written as follows:

{
	"antivirusEngine":{
		"allowedThreats":[
			"PUA:MacOS/Adload.L!MTB"
			]
	}
}

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: “Visit the Microsoft 365 Defender portal and navigate to Settings | Endpoints | Onboarding.”

Tips or important notes

Appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, email us at [e-mail] and mention the book title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [e-mail] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Share your thoughts

Once you’ve read Mastering Microsoft 365 Defender, we’d love to hear your thoughts! Please click here to go straight to the Amazon review page for this book and share your feedback.

Your review is important to us and the tech community and will help us make sure we’re delivering excellent quality content.

Download a free PDF copy of this book

Thanks for purchasing this book!

Do you like to read on the go but are unable to carry your print books everywhere?
Is your eBook purchase not compatible with the device of your choice?

Don’t worry, now with every Packt book you get a DRM-free PDF version of that book at no cost.

Read anywhere, any place, on any device. Search, copy, and paste code from your favorite technical books directly into your application.

The perks don’t stop there, you can get exclusive access to discounts, newsletters, and great free content in your inbox daily

Follow these simple steps to get the benefits:

1. Scan the QR code or visit the link below

https://packt.link/free-ebook/978-1-80324-170-8

2. Submit your proof of purchase
3. That’s it! We’ll send your free PDF and other benefits to your email directly