diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 3b4fddffaf..89bda37390 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -33,15 +33,53 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre 1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Select **Endpoint Management** on the **Navigation pane**. - b. Select **Mobile Device Management/Microsoft Intune**, click **Download package** and save the .zip file. + b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file. + + ![Endpoint onboarding](images/atp-onboard-mdm.png) 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*. 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). -Onboarding - Use the onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to: + a. Select **Policy** > **Configuration Policies** > **Add**. + ![Microsoft Intune Configuration Policies](images/atp-intune-add-policy.png) + + b. Under **Windows**, select **Custom Configuration (Windows 10 Desktop and Mobile and later)** > **Create and Deploy a Custom Policy** > **Create Policy**. + ![Microsoft Intune Configuration Policies](images/atp-intune-new-policy.png) + + c. Type a name and description for the policy. + ![Microsoft Intune Create Policy](images/atp-intune-policy-name.png) + + d. Under OMA-URI settings, select **Add...**. + ![Microsoft Intune add OMC-URI](images/atp-intune-add-oma.png) + + e. Type the following values then select **OK**: + ![Microsoft Intune save policy](images/atp-intune-oma-uri-setting.png) + + - **Setting name**: Type a name for the setting. + - **Setting description**: Type a description for the setting. + - **Data type**: Select **String**. + - **OMA-URI**: *./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding* + - **Value**: Copy and paste the contents of the *WindowsDefenderATP.onboarding* file you downloaded. + + + f. Save the policy. + + ![Microsoft Intune save policy](images/atp-intune-save-policy.png) + + g. Deploy the policy. + + ![Microsoft Intune deploy policy](images/atp-intune-deploy-policy.png) + + h. Select the device group to deploy the policy to: + + ![Microsoft Intune manage deployment](images/atp-intune-manage-deployment.png) + +When the policy is deployed and is propagated, endpoints will be shown in the **Machines view**. + +You can use the following onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to: - Onboarding - Health Status for onboarded machines - Configuration for onboarded machines @@ -49,10 +87,10 @@ Onboarding - Use the onboarding policies to deploy configuration settings on end Policy | OMA-URI | Type | Value | Description :---|:---|:---|:---|:--- Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Copy content from onboarding MDM file | Onboarding -Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | TRUE | Windows Defender ATP service is running - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID - Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
Default value: 1 | Windows Defender ATP Sample sharing is enabled +Health Status for onboarded machines: Sense Is Running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | TRUE | Windows Defender ATP service is running +Health Status for onboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP +Health Status for onboarded machines: Organization ID | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID +Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
Default value: 1 | Windows Defender ATP Sample sharing is enabled > [!NOTE] @@ -83,8 +121,8 @@ Offboarding - Use the offboarding policies to remove configuration settings on e Policy | OMA-URI | Type | Value | Description :---|:---|:---|:---|:--- Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding - Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP + Health Status for offboarded machines: Sense Is Running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running +Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP > [!NOTE] > The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated. diff --git a/windows/keep-secure/images/atp-intune-add-oma.png b/windows/keep-secure/images/atp-intune-add-oma.png new file mode 100644 index 0000000000..87586e7bd2 Binary files /dev/null and b/windows/keep-secure/images/atp-intune-add-oma.png differ diff --git a/windows/keep-secure/images/atp-intune-add-policy.png b/windows/keep-secure/images/atp-intune-add-policy.png new file mode 100644 index 0000000000..570ab0a688 Binary files /dev/null and b/windows/keep-secure/images/atp-intune-add-policy.png differ diff --git a/windows/keep-secure/images/atp-intune-deploy-policy.png b/windows/keep-secure/images/atp-intune-deploy-policy.png new file mode 100644 index 0000000000..a4f155428d Binary files /dev/null and b/windows/keep-secure/images/atp-intune-deploy-policy.png differ diff --git a/windows/keep-secure/images/atp-intune-manage-deployment.png b/windows/keep-secure/images/atp-intune-manage-deployment.png new file mode 100644 index 0000000000..450cb83369 Binary files /dev/null and b/windows/keep-secure/images/atp-intune-manage-deployment.png differ diff --git a/windows/keep-secure/images/atp-intune-new-policy.png b/windows/keep-secure/images/atp-intune-new-policy.png new file mode 100644 index 0000000000..1e3661e63f Binary files /dev/null and b/windows/keep-secure/images/atp-intune-new-policy.png differ diff --git a/windows/keep-secure/images/atp-intune-oma-uri-setting.png b/windows/keep-secure/images/atp-intune-oma-uri-setting.png new file mode 100644 index 0000000000..f201f402da Binary files /dev/null and b/windows/keep-secure/images/atp-intune-oma-uri-setting.png differ diff --git a/windows/keep-secure/images/atp-intune-policy-name.png b/windows/keep-secure/images/atp-intune-policy-name.png new file mode 100644 index 0000000000..b45b2c5211 Binary files /dev/null and b/windows/keep-secure/images/atp-intune-policy-name.png differ diff --git a/windows/keep-secure/images/atp-intune-save-policy.png b/windows/keep-secure/images/atp-intune-save-policy.png new file mode 100644 index 0000000000..b4adb7c064 Binary files /dev/null and b/windows/keep-secure/images/atp-intune-save-policy.png differ diff --git a/windows/keep-secure/images/atp-onboard-mdm.png b/windows/keep-secure/images/atp-onboard-mdm.png new file mode 100644 index 0000000000..18b70c8c27 Binary files /dev/null and b/windows/keep-secure/images/atp-onboard-mdm.png differ