mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-30 09:43:42 +00:00
Merge pull request #4036 from MicrosoftDocs/onboarding-note
update note
This commit is contained in:
Gary Moore
GitHub
@ -72,11 +72,13 @@ needs.<br>
|
||||
|
||||
2. Open **Groups > New Group**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. Enter details and create a new group.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
4. Add your test user or device.
|
||||
|
||||
@ -86,7 +88,8 @@ needs.<br>
|
||||
|
||||
7. Find your test user or device and select it.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Your testing group now has a member to test.
|
||||
|
||||
@ -103,40 +106,48 @@ different types of Endpoint security policies.
|
||||
2. Navigate to **Endpoint security > Endpoint detection and response**. Click
|
||||
on **Create Profile**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. Under **Platform, select Windows 10 and Later, Profile - Endpoint detection
|
||||
and response > Create**.
|
||||
|
||||
4. Enter a name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. Select settings as required, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
>[!NOTE]
|
||||
>In this instance, this has been auto populated as Microsoft Defender ATP has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender ATP in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp). <br>
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> In this instance, this has been auto populated as Microsoft Defender ATP has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender ATP in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp).
|
||||
>
|
||||
> The following image is an example of what you'll see when Microsoft Defender ATP is NOT integrated with Intune:
|
||||
>
|
||||
> 
|
||||
|
||||
6. Add scope tags if necessary, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Add test group by clicking on **Select groups to include** and choose your group, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Review and accept, then select **Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. You can view your completed policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Next-generation protection
|
||||
|
||||
@ -144,36 +155,43 @@ different types of Endpoint security policies.
|
||||
|
||||
2. Navigate to **Endpoint security > Antivirus > Create Policy**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. Select **Platform - Windows 10 and Later - Windows and Profile – Microsoft
|
||||
Defender Antivirus > Create**.
|
||||
|
||||
4. Enter name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. In the **Configuration settings page**: Set the configurations you require for
|
||||
Microsoft Defender Antivirus (Cloud Protection, Exclusions, Real-Time
|
||||
Protection, and Remediation).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
6. Add scope tags if necessary, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Select groups to include, assign to your test group, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Review and create, then select **Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. You'll see the configuration policy you created.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Attack Surface Reduction – Attack surface reduction rules
|
||||
|
||||
@ -186,37 +204,44 @@ different types of Endpoint security policies.
|
||||
4. Select **Platform - Windows 10 and Later – Profile - Attack surface reduction
|
||||
rules > Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. Enter a name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
6. In the **Configuration settings page**: Set the configurations you require for
|
||||
Attack surface reduction rules, then select **Next**.
|
||||
|
||||
>[!NOTE]
|
||||
>We will be configuring all of the Attack surface reduction rules to Audit.
|
||||
> [!NOTE]
|
||||
> We will be configuring all of the Attack surface reduction rules to Audit.
|
||||
>
|
||||
> For more information, see [Attack surface reduction rules](attack-surface-reduction.md).
|
||||
|
||||
For more information, see [Attack surface reduction rules](attack-surface-reduction.md).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Add Scope Tags as required, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Select groups to include and assign to test group, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. Review the details, then select **Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
10. View the policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Attack Surface Reduction – Web Protection
|
||||
|
||||
@ -228,37 +253,44 @@ different types of Endpoint security policies.
|
||||
|
||||
4. Select **Windows 10 and Later – Web protection > Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. Enter a name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
6. In the **Configuration settings page**: Set the configurations you require for
|
||||
Web Protection, then select **Next**.
|
||||
|
||||
>[!NOTE]
|
||||
>We are configuring Web Protection to Block.
|
||||
> [!NOTE]
|
||||
> We are configuring Web Protection to Block.
|
||||
>
|
||||
> For more information, see [Web Protection](web-protection-overview.md).
|
||||
|
||||
For more information, see [Web Protection](web-protection-overview.md).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Add **Scope Tags as required > Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Select **Assign to test group > Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. Select **Review and Create > Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
10. View the policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Validate configuration settings
|
||||
|
||||
@ -275,26 +307,31 @@ To confirm that the configuration policy has been applied to your test device, f
|
||||
1. Open the MEM portal and navigate to the relevant policy as shown in the
|
||||
steps above. The following example shows the next generation protection settings.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/43ab6aa74471ee2977e154a4a5ef2d39.png#lightbox)
|
||||
|
||||
2. Select the **Configuration Policy** to view the policy status.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/55ecaca0e4a022f0e29d45aeed724e6c.png#lightbox)
|
||||
|
||||
3. Select **Device Status** to see the status.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/18a50df62cc38749000dbfb48e9a4c9b.png#lightbox)
|
||||
|
||||
4. Select **User Status** to see the status.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/4e965749ff71178af8873bc91f9fe525.png#lightbox)
|
||||
|
||||
5. Select **Per-setting status** to see the status.
|
||||
|
||||
>[!TIP]
|
||||
>This view is very useful to identify any settings that conflict with another policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/42acc69d0128ed09804010bdbdf0a43c.png#lightbox)
|
||||
|
||||
### Endpoint detection and response
|
||||
|
||||
@ -302,33 +339,38 @@ To confirm that the configuration policy has been applied to your test device, f
|
||||
1. Before applying the configuration, the Microsoft Defender ATP
|
||||
Protection service should not be started.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/b418a232a12b3d0a65fc98248dbb0e31.png#lightbox)
|
||||
|
||||
2. After the configuration has been applied, the Microsoft Defender ATP
|
||||
Protection Service should be started.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/a621b699899f1b41db211170074ea59e.png#lightbox)
|
||||
|
||||
3. After the services are running on the device, the device appears in Microsoft
|
||||
Defender Security Center.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> [  ](images/df0c64001b9219cfbd10f8f81a273190.png#lightbox)
|
||||
|
||||
### Next-generation protection
|
||||
|
||||
1. Before applying the policy on a test device, you should be able to manually
|
||||
manage the settings as shown below.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
2. After the policy has been applied, you should not be able to manually manage
|
||||
the settings.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> In the following image **Turn on cloud-delivered protection** and
|
||||
**Turn on real-time protection** are being shown as managed.
|
||||
> **Turn on real-time protection** are being shown as managed.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Attack Surface Reduction – Attack surface reduction rules
|
||||
|
||||
@ -337,11 +379,11 @@ To confirm that the configuration policy has been applied to your test device, f
|
||||
|
||||
2. This should respond with the following lines with no content:
|
||||
|
||||
AttackSurfaceReductionOnlyExclusions:
|
||||
|
||||
AttackSurfaceReductionRules_Actions:
|
||||
|
||||
AttackSurfaceReductionRules_Ids:
|
||||
> AttackSurfaceReductionOnlyExclusions:
|
||||
>
|
||||
> AttackSurfaceReductionRules_Actions:
|
||||
>
|
||||
> AttackSurfaceReductionRules_Ids:
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user