The Fundamentals of Microsoft Defender for Endpoint

We’ll begin our journey of deploying and configuring Microsoft Defender for Endpoint (MDE) by exploring its fundamentals. Why is a full chapter dedicated to this? Well, it’s complicated. No, really, it is! MDE’s complexity is a result of its far-reaching scope of different security capabilities, its support for a diverse set of OSs, and the ability for us to manage its features from different administrative systems.

In this chapter, you will learn important background knowledge about MDE. By learning the fundamentals, you will be able to understand the terminology and architectural options, and you will be braced for the inevitable changes of a cloud-based service. This chapter should be seen as a prerequisite to the upcoming chapters about onboarding and configuring MDE, as it sets the context for many decisions you will be making in your deployment.

In a nutshell, the following topics will be covered in...

An overview of MDE deployment

As you learned in the previous chapter, MDE is part of Microsoft 365 Defender, the wider XDR platform. You also learned that MDE provides both pre- and post-incident capabilities, insofar as it can harden and defend systems against malware and abuse, as well as use telemetry and machine learning to identify when something looks like an attack after the fact. Let’s explore how this translates into your administrative use and deployment of MDE.

Onboarding

In the chapters that follow this one, you will find guidance on how to onboard devices to MDE. This is a deep topic that will be explored thoroughly in those chapters, though an overview to get started is required.

What does onboarding mean, strictly speaking? Onboarding means getting the device to transmit EDR telemetry to the service and present itself in the Microsoft 365 Defender portal at security.microsoft.com (also known as the Microsoft Defender Security Center).

Onboarding for...

Exploring the Microsoft 365 Defender portal

Microsoft 365 Defender is provisioned automatically when the administrator of a licensed tenant visits security.microsoft.com. Several Azure AD administrative roles allow this, but the most common ones are Global Administrator, Security Administrator, or their Reader equivalents.

MDE is provisioned when the administrator clicks on any of the menus under the Endpoints banner. For example, you’ll see Vulnerability management and others. Clicking one begins the provisioning process of your tenant’s MDE instance. The geography of data storage is determined automatically based on your tenant’s location. If a change is required, you must get in touch with support and start from scratch:

Figure 3.1 – Endpoints option navigation in the Microsoft 365 Defender portal

Microsoft Defender for Cloud

In the next chapter, you will learn that Azure-managed devices can be onboarded using Microsoft...

Navigating Microsoft Intune

In 2019, Microsoft announced Microsoft Endpoint Manager (MEM) as its new brand for endpoint management. However, this was renamed simply Microsoft Intune in 2022. Microsoft Intune has two services in it. Although the two services are distinct, they can be connected using features such as co-management and tenant attach:

• Intune, an internet-based MDM service
• Configuration Manager, an on-premises-based management service

The Intune admin center or portal (endpoint.microsoft.com) is a web console that lets you manage Intune-enrolled, co-managed, or tenant-attached devices. It can also manage security settings for devices that do not fall into any of these categories with Security Management, which will be covered in the next section.

Microsoft Intune by OS

Using Microsoft Intune, you can configure Windows 10/11, Windows Server 2012 R2 or later (with some caveats you’ll learn about in the upcoming Understanding Security Management...

Understanding and enabling Security Management

A long-held pain point for MDE customers is the distributed nature of its configuration. Intune, Configuration Manager, and Group Policy can all be used for client settings. This contrasts with most third-party protection software, which offers a unified console. To address this, Microsoft introduced Security Management for Microsoft Defender for Endpoint (abbreviated to Security Management).

Rather than deliver a brand-new configuration console, Security Management leverages the existing Microsoft Intune admin center’s Endpoint security blade. Devices are created as Azure AD objects for a trust relationship (if they don’t already exist in Azure AD) and MDE itself, rather than Intune, enforces the policy. These Azure AD objects can be added to groups for endpoint security policy targeting. Intune filters are ignored, so make sure you target groups.

Azure AD groups for Security Management

Security Management devices...

Summary

This chapter kick-started your MDE journey by covering the fundamentals. The rate of change across the entire Microsoft 365 Defender suite is staggering, but by understanding things at a foundational level, you will be prepared for architectural decisions and future enhancements.

Specifically, you learned what it means to onboard a device to MDE, the difference between service and client settings, and how to decide which management tools are best for your scenario. You learned about using the Microsoft 365 Defender portal to manage MDE, and how that management continues to the Microsoft Intune admin center. In Chapters 5 through 7, you will dive deeper into this management by learning good practices to follow across Microsoft Intune and other tools. But before that, in the next chapter, we will explore the intricacies of how to get your Windows device into MDE.

Questions

The following questions can be used to measure your understanding of the MDE fundamentals discussed in this chapter:

1. You are reviewing the use of Security Management for MDE in your organization. Which of the following statements is true? Choose all that apply.
   1. Security Management is not compatible with Windows Server 2012 R2
   2. Security Management is not compatible with domain controllers
   3. Security Management requires on-premises Active Directory
   4. Security Management requires an internet connection to retrieve a policy
2. True or false: a device can belong to more than one device group.
   1. True
   2. False
3. Which of the following statements most accurately describes the general difference between when you would use the Microsoft 365 Defender portal or the Microsoft Intune admin center to change settings?
   1. The Microsoft 365 Defender portal is for endpoint engine settings, while the Microsoft Intune admin center is for EDR service settings
   2. The Microsoft Intune admin center is for endpoint...

Further reading

There may be some specific scenarios regarding onboarding that this book has not discussed. You can find useful information and examples of these by looking at the following links:

• In this chapter, you learned about device tags. You can set these using registry keys and/or Intune, as well as the Microsoft 365 Defender portal, and this blog has some information about that: campbell.scot/use-intune-to-manage-microsoft-defender-for-endpoint-tags-and-device-groups.
• When you want MDE RBAC, you cannot use built-in Azure AD roles, which also means native Privileged Identity Management (PIM) isn’t supported. In this article, Fabian Bader guides you on how it can still be achieved using privileged access groups: cloudbrothers.info/en/jit-role-assignment-microsoft-defender.
• The fundamentals you read about in this chapter are less likely to change as fast as the features of MDE, which you can keep up to date with by following Tech Community’s Microsoft...