diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md index 301d635bef..ab87a6d7f1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md @@ -40,7 +40,7 @@ You'll need to take the following configuration steps to enable the managed secu The integration will allow MSSPs to take the following actions: -- Get access to MSSP customer's Windows Defender Security Center portal +- Get access to MSSP customer's Microsoft Defender Security Center portal - Get email notifications, and - Fetch alerts through security information and event management (SIEM) tools @@ -53,7 +53,7 @@ Typically, MSSP customers take the initial configuration steps to grant MSSPs ac In general, the following configuration steps need to be taken: -- **Grant the MSSP access to Windows Defender Security Center**
+- **Grant the MSSP access to Microsoft Defender Security Center**
This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Windows Defender ATP tenant. @@ -74,7 +74,7 @@ This action is taken by the MSSP. It allows MSSPs to fetch alerts using APIs. > These set of steps are directed towards the MSSP customer.
> Access to the portal can only be done by the MSSP customer. -As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Windows Defender Security Center. +As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Microsoft Defender Security Center. Authentication and authorization of the MSSP user is built on top of Azure Active Directory (Azure AD) B2B functionality. @@ -82,7 +82,7 @@ Authentication and authorization of the MSSP user is built on top of Azure Activ You'll need to take the following 2 steps: - Add MSSP user to your tenant as a guest user -- Grant MSSP user access to Windows Defender Security Center +- Grant MSSP user access to Microsoft Defender Security Center ### Add MSSP user to your tenant as a guest user @@ -90,8 +90,8 @@ Add a user who is a member of the MSSP tenant to your tenant as a guest user. To grant portal access to the MSSP, you must add the MSSP user to your Azure AD as a guest user. For more information, see [Add Azure Active Directory B2B collaboration users in the Azure portal](https://docs.microsoft.com/azure/active-directory/b2b/add-users-administrator). -### Grant MSSP user access to Windows Defender Security Center -Grant the guest user access and permissions to your Windows Defender Security Center tenant. +### Grant MSSP user access to Microsoft Defender Security Center +Grant the guest user access and permissions to your Microsoft Defender Security Center tenant. Granting access to guest user is done the same way as granting access to a user who is a member of your tenant. @@ -108,12 +108,12 @@ It is recommended that groups are created for MSSPs to make authorization access As a MSSP customer, you can always remove or modify the permissions granted to the MSSP by updating the Azure AD user groups. -## Access the Windows Defender Security Center MSSP customer portal +## Access the Microsoft Defender Security Center MSSP customer portal >[!NOTE] >These set of steps are directed towards the MSSP. -By default, MSSP customers access their Windows Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`. +By default, MSSP customers access their Microsoft Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`. MSSPs however, will need to use a tenant-specific URL in the following format: `https://securitycenter.windows.com?tid=customer_tenant_id` to access the MSSP customer portal. @@ -159,7 +159,7 @@ Step 1: Create a third-party application Step 2: Get access and refresh tokens from your customer's tenant -Step 3: Whitelist your application on Windows Defender Security Center +Step 3: Whitelist your application on Microsoft Defender Security Center @@ -279,8 +279,8 @@ After providing your credentials, you'll need to grant consent to the applicatio 8. In the PowerShell window, you'll receive an access token and a refresh token. Save the refresh token to configure your SIEM connector. -### Step 3: Whitelist your application on Windows Defender Security Center -You'll need to whitelist the application you created in Windows Defender Security Center. +### Step 3: Whitelist your application on Microsoft Defender Security Center +You'll need to whitelist the application you created in Microsoft Defender Security Center. You'll need to have **Manage portal system settings** permission to whitelist the application. Otherwise, you'll need to request your customer to whitelist the application for you. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md index 88ac0b8be9..0ef1449bfa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md @@ -36,7 +36,7 @@ Monitoring network connection behind a forward proxy is possible due to addition Network protection can be controlled using the following modes: -- **Block**
Users or apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. +- **Block**
Users or apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Microsoft Defender Security Center. - **Audit**
Users or apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Microsoft Defender Security Center. diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md index 117296a474..a3c0a5a7a2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md @@ -34,14 +34,14 @@ Before you get started, see [the main Microsoft Defender ATP for Mac page](micro ## Download installation and onboarding packages -Download the installation and onboarding packages from Windows Defender Security Center: +Download the installation and onboarding packages from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. +1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. 2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. 3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. 4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. - ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/ATP-Portal-Onboarding-page.png) + ![Microsoft Defender Security Center screenshot](../windows-defender-antivirus/images/ATP-Portal-Onboarding-page.png) 5. From a command prompt, verify that you have the two files. Extract the contents of the .zip files: @@ -112,6 +112,7 @@ The installation proceeds. After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. ![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) + ## How to Allow Full Disk Access diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index 6a79d9fca6..0e9abb20c1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -43,7 +43,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi 4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. 5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). - ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) + ![Microsoft Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) 6. From a command prompt, verify that you have the three files. Extract the contents of the .zip files: @@ -90,19 +90,19 @@ You need no special provisioning for a Mac device beyond a standard [Company Por 1. You are asked to confirm device management. -![Confirm device management screenshot](../windows-defender-antivirus/images/MDATP-3-ConfirmDeviceMgmt.png) + ![Confirm device management screenshot](../windows-defender-antivirus/images/MDATP-3-ConfirmDeviceMgmt.png) -Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: + Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: -![Management profile screenshot](../windows-defender-antivirus/images/MDATP-4-ManagementProfile.png) + ![Management profile screenshot](../windows-defender-antivirus/images/MDATP-4-ManagementProfile.png) 2. Select **Continue** and complete the enrollment. -You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. + You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. 3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: -![Add Devices screenshot](../windows-defender-antivirus/images/MDATP-5-allDevices.png) + ![Add Devices screenshot](../windows-defender-antivirus/images/MDATP-5-allDevices.png) ## Create System Configuration profiles @@ -284,9 +284,9 @@ You may now enroll more devices. You can also enroll them later, after you have 10. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. -Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: + Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: -![System configuration profiles screenshot](../windows-defender-antivirus/images/MDATP-7-DeviceStatusBlade.png) + ![System configuration profiles screenshot](../windows-defender-antivirus/images/MDATP-7-DeviceStatusBlade.png) ## Publish application diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index 083d1a181e..04f3d87059 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -38,14 +38,19 @@ In addition, for JAMF deployment, you need to be familiar with JAMF administrati ## Download installation and onboarding packages -Download the installation and onboarding packages from Windows Defender Security Center: +Download the installation and onboarding packages from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > device Management > Onboarding**. -2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. +1. In Microsoft Defender Security Center, go to **Settings > Machine management > Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android**. +3. Set the deployment method to **Mobile Device Management / Microsoft Intune**. + + >[!NOTE] + >JamF falls under **Mobile Device Management**. + +4. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +5. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. - ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) + ![Microsoft Defender Security Center screenshot](../windows-defender-antivirus/images/jamf-onboarding.png) 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: @@ -87,7 +92,7 @@ To approve the kernel extension: 1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. 2. Use **UBF8T346G9** for Team Id. -![Approved kernel extensions screenshot](../windows-defender-antivirus/images/MDATP-17-approvedKernelExtensions.png) + ![Approved kernel extensions screenshot](../windows-defender-antivirus/images/MDATP-17-approvedKernelExtensions.png) ### Privacy Preferences Policy Control @@ -103,7 +108,7 @@ Add the following JAMF policy to grant Full Disk Access to Microsoft Defender AT 3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. 4. Set app or service to SystemPolicyAllFiles and access to Allow. -![Privacy Preferences Policy Control](../windows-defender-antivirus/images/MDATP-35-JAMF-PrivacyPreferences.png) + ![Privacy Preferences Policy Control](../windows-defender-antivirus/images/MDATP-35-JAMF-PrivacyPreferences.png) #### Configuration Profile's Scope @@ -153,16 +158,16 @@ You'll need no special provisioning for a macOS computer, beyond the standard JA > [!NOTE] > After a computer is enrolled, it will show up in the Computers inventory (All Computers). -1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. + - Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. -![MDM approve button screenshot](../windows-defender-antivirus/images/MDATP-21-MDMProfile1.png)
-![MDM screenshot](../windows-defender-antivirus/images/MDATP-22-MDMProfileApproved.png) + ![MDM approve button screenshot](../windows-defender-antivirus/images/MDATP-21-MDMProfile1.png)
+ ![MDM screenshot](../windows-defender-antivirus/images/MDATP-22-MDMProfileApproved.png) -After a moment, the device's User Approved MDM status will change to **Yes**. + After a moment, the device's User Approved MDM status will change to **Yes**. -![MDM status screenshot](../windows-defender-antivirus/images/MDATP-23-MDMStatus.png) + ![MDM status screenshot](../windows-defender-antivirus/images/MDATP-23-MDMStatus.png) -You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. + You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. ## Deployment diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index 1ffd2a0270..de5dd35eec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -1,6 +1,6 @@ --- title: Weaknesses -description: Windows Defender Security Center offers a Weaknesses page, which lists vulnerabilities found in the infected software running in your organization. +description: Microsoft Defender Security Center offers a Weaknesses page, which lists vulnerabilities found in the infected software running in your organization. keywords: mdatp threat & vulnerability management, mdatp tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/jamf-onboarding.png b/windows/security/threat-protection/windows-defender-antivirus/images/jamf-onboarding.png new file mode 100644 index 0000000000..dedadfcc30 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/jamf-onboarding.png differ