mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 23:37:22 +00:00
Merge branch 'master' into tvm-updates
This commit is contained in:
Beth Levin
commit
9e23ccd27e
@ -12,7 +12,7 @@ author: TrudyHa
|
||||
ms.author: TrudyHa
|
||||
ms.topic: conceptual
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/17/2017
|
||||
ms.date:
|
||||
---
|
||||
|
||||
# Microsoft Store for Business and Microsoft Store for Education overview
|
||||
@ -24,6 +24,9 @@ ms.date: 10/17/2017
|
||||
|
||||
Designed for organizations, Microsoft Store for Business and Microsoft Store for Education give IT decision makers and administrators in businesses or schools a flexible way to find, acquire, manage, and distribute free and paid apps in select markets to Windows 10 devices in volume. IT administrators can manage Microsoft Store apps and private line-of-business apps in one inventory, plus assign and re-use licenses as needed. You can choose the best distribution method for your organization: directly assign apps to individuals and teams, publish apps to private pages in Microsoft Store, or connect with management solutions for more options.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Customers who are in the Office 365 GCC environment or are eligible to buy with government pricing cannot use Microsoft Store for Business.
|
||||
|
||||
## Features
|
||||
Organizations or schools of any size can benefit from using Microsoft Store for Business or Microsoft Store for Education:
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ author: TrudyHa
|
||||
ms.author: TrudyHa
|
||||
ms.topic: conceptual
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/13/2017
|
||||
ms.date:
|
||||
---
|
||||
|
||||
# Prerequisites for Microsoft Store for Business and Education
|
||||
@ -22,6 +22,9 @@ ms.date: 10/13/2017
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Customers who are in the Office 365 GCC environment or are eligible to buy with government pricing cannot use Microsoft Store for Business.
|
||||
|
||||
There are a few prerequisites for using Microsoft Store for Business or Microsoft Store for Education.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@ -2728,6 +2728,7 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
| [DiagnosticLog CSP](diagnosticlog-csp.md) |  |  |  |
|
||||
| [DMAcc CSP](dmacc-csp.md) |  |  |  |
|
||||
| [DMClient CSP](dmclient-csp.md) |  |  |  |
|
||||
| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) |  |  |  <sup>10</sup> |
|
||||
| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) |  |  |  |
|
||||
| [NetworkProxy CSP](networkproxy-csp.md) |  |  |  |
|
||||
| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) |  |  |  <sup>8</sup>|
|
||||
@ -2737,6 +2738,7 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
| [RemoteFind CSP](remotefind-csp.md) |  |  <sup>4</sup> |  |
|
||||
| [RemoteWipe CSP](remotewipe-csp.md) |  |  <sup>4</sup> |  |
|
||||
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) |  |  |  |
|
||||
| [TenantLockdown CSP](tenantlockdown-csp.md) |  |  |  <sup>10</sup> |
|
||||
| [Update CSP](update-csp.md) |  |  |  |
|
||||
| [VPNv2 CSP](vpnv2-csp.md) |  |  |  |
|
||||
| [WiFi CSP](wifi-csp.md) |  |  |  |
|
||||
@ -2745,7 +2747,9 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
|
||||
## <a href="" id="surfacehubcspsupport"></a>CSPs supported in Microsoft Surface Hub
|
||||
|
||||
- [Accounts CSP](accounts-csp.md)<sup>9</sup> **Note:** Support in Surface Hub is limited to **Domain\ComputerName**.
|
||||
- [Accounts CSP](accounts-csp.md)<sup>9</sup>
|
||||
> [!NOTE]
|
||||
> Support in Surface Hub is limited to **Domain\ComputerName**.
|
||||
- [AccountManagement CSP](accountmanagement-csp.md)
|
||||
- [APPLICATION CSP](application-csp.md)
|
||||
- [CertificateStore CSP](certificatestore-csp.md)
|
||||
@ -2813,3 +2817,4 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
- 7 - Added in Windows 10, version 1909.
|
||||
- 8 - Added in Windows 10, version 2004.
|
||||
- 9 - Added in Windows 10 Team 2020 Update
|
||||
- 10 - Added in [Windows Holographic, version 20H2](https://docs.microsoft.com/hololens/hololens-release-notes#windows-holographic-version-20h2)
|
||||
|
||||
@ -22,7 +22,7 @@ Requirements:
|
||||
- The enterprise has configured a mobile device management (MDM) service
|
||||
- The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md)
|
||||
- The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`)
|
||||
- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information.
|
||||
- The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information.
|
||||
|
||||
> [!TIP]
|
||||
> For additional information, see the following topics:
|
||||
@ -30,7 +30,7 @@ Requirements:
|
||||
> - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan)
|
||||
> - [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm)
|
||||
|
||||
The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered.
|
||||
The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD–registered.
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.
|
||||
@ -110,7 +110,10 @@ Requirements:
|
||||
|
||||
|
||||
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** (support for Device Credential is coming) as the Selected Credential Type to use. User Credential enrolls Windows 10, version 1709 and later once an Intune licensed user logs into the device. Device Credential will enroll the device and then assign a user later, once support for this is available.
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use.
|
||||
|
||||
> [!NOTE]
|
||||
> **Device Credential** Credential Type will also work, however, it is not yet supported for MDM solutions (including Intune). We don't recommend using this option until support is announced.
|
||||
|
||||
|
||||
|
||||
@ -162,7 +165,7 @@ Requirements:
|
||||
|
||||
Requirements:
|
||||
- AD-joined PC running Windows 10, version 1709 or later
|
||||
- Enterprise has MDM service already configured (with Intune or a third party service provider)
|
||||
- Enterprise has MDM service already configured (with Intune or a third-party service provider)
|
||||
- Enterprise AD must be integrated with Azure AD.
|
||||
- Ensure that PCs belong to same computer group.
|
||||
|
||||
@ -257,7 +260,7 @@ To collect Event Viewer logs:
|
||||
|
||||
|
||||
By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016.
|
||||
A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display less entries as shown in the following screenshot:
|
||||
A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot:
|
||||
|
||||
|
||||
|
||||
|
||||
@ -389,7 +389,7 @@ On **MDT01**:
|
||||
2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start.
|
||||
|
||||
> [!IMPORTANT]
|
||||
>The current version of MDT (8456) has a known issue generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. As a temporary workaround:
|
||||
> The ADK version 1903 has a [known issue](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](https://docs.microsoft.com/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903:
|
||||
> - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144.
|
||||
> - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe).
|
||||
> - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim).
|
||||
|
||||
@ -53,6 +53,8 @@ These are the things you'll need to complete this lab:
|
||||
|
||||
A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix.
|
||||
|
||||
> If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version.
|
||||
|
||||
[Verify support for Hyper-V](#verify-support-for-hyper-v)
|
||||
<br>[Enable Hyper-V](#enable-hyper-v)
|
||||
<br>[Create a demo VM](#create-a-demo-vm)
|
||||
@ -70,7 +72,8 @@ A summary of the sections and procedures in the lab is provided below. Follow ea
|
||||
<br> [Autopilot registration using MSfB](#autopilot-registration-using-msfb)
|
||||
<br>[Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile)
|
||||
<br> [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune)
|
||||
<br> [Assign the profile](#assign-the-profile)
|
||||
<br> [Create a device group](#create-a-device-group)
|
||||
<br> [Create the deployment profile](#create-the-deployment-profile)
|
||||
<br> [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb)
|
||||
<br>[See Windows Autopilot in action](#see-windows-autopilot-in-action)
|
||||
<br>[Remove devices from Autopilot](#remove-devices-from-autopilot)
|
||||
@ -140,7 +143,7 @@ After we have set the ISO file location and determined the name of the appropria
|
||||
You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise).
|
||||
- When asked to select a platform, choose **64 bit**.
|
||||
|
||||
After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso).
|
||||
After you download this file, the name will be extremely long (ex: 19042.508.200927-1902.20h2_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso).
|
||||
|
||||
1. So that it is easier to type and remember, rename the file to **win10-eval.iso**.
|
||||
2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**.
|
||||
@ -163,7 +166,7 @@ For example, if the command above displays Ethernet but you wish to use Ethernet
|
||||
All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> **VM switch**: a VM switch is how Hyper-V connects VMs to a network. <br><br>If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."<br><br>If you have never created an external VM switch before, then just run the commands below.
|
||||
> **VM switch**: a VM switch is how Hyper-V connects VMs to a network. <br><br>If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."<br><br>If you have never created an external VM switch before, then just run the commands below.<br><br>If you are not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch).
|
||||
|
||||
```powershell
|
||||
New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
@ -218,6 +221,9 @@ PS C:\autopilot>
|
||||
|
||||
### Install Windows 10
|
||||
|
||||
> [!NOTE]
|
||||
> The VM will be booted to gather a hardware ID, then it will be reset. The goal in the next few steps is to get to the desktop quickly so don't worry about how it is configured at this stage. The VM only needs to be connected to the Internet.
|
||||
|
||||
Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples:
|
||||
|
||||
|
||||
@ -250,7 +256,7 @@ Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see
|
||||
|
||||
Follow these steps to run the PS script:
|
||||
|
||||
1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device:
|
||||
1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device:
|
||||
|
||||
```powershell
|
||||
md c:\HWID
|
||||
@ -263,18 +269,20 @@ Follow these steps to run the PS script:
|
||||
|
||||
When you are prompted to install the NuGet package, choose **Yes**.
|
||||
|
||||
See the sample output below.
|
||||
See the sample output below. A 'dir' command is issued at the end to show the file that was created.
|
||||
|
||||
<pre>
|
||||
PS C:\> md c:\HWID
|
||||
|
||||
Directory: C:\
|
||||
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
d----- 3/14/2019 11:33 AM HWID
|
||||
d----- 11/13/2020 3:00 PM HWID
|
||||
|
||||
PS C:\> Set-Location c:\HWID
|
||||
|
||||
PS C:\Windows\system32> Set-Location c:\HWID
|
||||
PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
|
||||
PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
|
||||
|
||||
@ -287,13 +295,17 @@ import the NuGet provider now?
|
||||
[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"): Y
|
||||
PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
|
||||
PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
|
||||
Gathered details for device with serial number: 1804-7078-6805-7405-0796-0675-17
|
||||
PS C:\HWID> dir
|
||||
|
||||
|
||||
Directory: C:\HWID
|
||||
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
-a---- 3/14/2019 11:33 AM 8184 AutopilotHWID.csv
|
||||
-a---- 11/13/2020 3:01 PM 8184 AutopilotHWID.csv
|
||||
|
||||
|
||||
PS C:\HWID>
|
||||
</pre>
|
||||
@ -305,7 +317,7 @@ Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory
|
||||
|
||||
|
||||
|
||||
You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you're using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM).
|
||||
You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM).
|
||||
|
||||
If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this.
|
||||
|
||||
@ -317,7 +329,7 @@ If you have trouble copying and pasting the file, just view the contents in Note
|
||||
With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE.
|
||||
|
||||
On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**.
|
||||
Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**.
|
||||
Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**.
|
||||
|
||||
|
||||
|
||||
@ -363,7 +375,7 @@ Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com
|
||||
|
||||
For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**.
|
||||
|
||||
|
||||
|
||||
|
||||
## Register your VM
|
||||
|
||||
@ -371,24 +383,24 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B
|
||||
|
||||
### Autopilot registration using Intune
|
||||
|
||||
1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**.
|
||||
1. In the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), choose **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices** and then on the **Windows Autopilot devices** page, choose **Import**.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared.
|
||||
|
||||
2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank.
|
||||
|
||||
|
||||
|
||||
|
||||
You should receive confirmation that the file is formatted correctly before uploading it, as shown above.
|
||||
|
||||
3. Click **Import** and wait until the import process completes. This can take up to 15 minutes.
|
||||
|
||||
4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example.
|
||||
4. Click **Refresh** to verify your VM or device has been added. See the following example.
|
||||
|
||||
|
||||
|
||||
|
||||
### Autopilot registration using MSfB
|
||||
|
||||
@ -425,17 +437,33 @@ Pick one:
|
||||
### Create a Windows Autopilot deployment profile using Intune
|
||||
|
||||
> [!NOTE]
|
||||
> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first:
|
||||
> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list.
|
||||
|
||||
|
||||
|
||||
|
||||
> The example above lists both a physical device and a VM. Your list should only include only one of these.
|
||||
#### Create a device group
|
||||
|
||||
To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles**
|
||||
The Autopilot deployment profile wizard will ask for a device group, so we must create one first. To create a device group:
|
||||
|
||||
|
||||
1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Groups** > **New group**.
|
||||
2. In the **Group** blade:
|
||||
1. For **Group type**, choose **Security**.
|
||||
2. Type a **Group name** and **Group description** (ex: Autopilot Lab).
|
||||
3. Azure AD roles can be assigned to the group: **No**
|
||||
4. For **Membership type**, choose **Assigned**.
|
||||
3. Click **Members** and add the Autopilot VM to the group. See the following example:
|
||||
|
||||
Click on **Create profile**.
|
||||
|
||||
|
||||
4. Click **Create**.
|
||||
|
||||
#### Create the deployment profile
|
||||
|
||||
To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**.
|
||||
|
||||
|
||||
|
||||
Click on **Create profile** and then select **Windows PC**.
|
||||
|
||||
|
||||
|
||||
@ -444,22 +472,33 @@ On the **Create profile** blade, use the following values:
|
||||
| Setting | Value |
|
||||
|---|---|
|
||||
| Name | Autopilot Lab profile |
|
||||
| Description | blank |
|
||||
| Description | Lab |
|
||||
| Convert all targeted devices to Autopilot | No |
|
||||
| Deployment mode | User-driven |
|
||||
| Join to Azure AD as | Azure AD joined |
|
||||
|
||||
Click on **Out-of-box experience (OOBE)** and configure the following settings:
|
||||
Click **Next** to continue with the **Out-of-box experience (OOBE)** settings:
|
||||
|
||||
| Setting | Value |
|
||||
|---|---|
|
||||
| EULA | Hide |
|
||||
| Deployment mode | User-driven |
|
||||
| Join to Azure AD as | Azure AD joined |
|
||||
| Microsoft Sofware License Terms | Hide |
|
||||
| Privacy Settings | Hide |
|
||||
| Hide change account options | Hide |
|
||||
| User account type | Standard |
|
||||
| Allow White Glove OOBE | No |
|
||||
| Language (Region) | Operating system default |
|
||||
| Automatically configure keyboard | Yes |
|
||||
| Apply device name template | No |
|
||||
|
||||
See the following example:
|
||||
Click **Next** to continue with the **Assignments** settings:
|
||||
|
||||
| Setting | Value |
|
||||
|---|---|
|
||||
| Assign to | Selected groups |
|
||||
|
||||
1. Click **Select groups to include**.
|
||||
2. Click the **Autopilot Lab** group, and then click **Select**.
|
||||
3. Click **Next** to continue and then click **Create**. See the following example:
|
||||
|
||||
|
||||
|
||||
@ -467,40 +506,6 @@ Click on **OK** and then click on **Create**.
|
||||
|
||||
> If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile).
|
||||
|
||||
#### Assign the profile
|
||||
|
||||
Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading.
|
||||
|
||||
To create a Group, open the Azure portal and select **Azure Active Directory** > **Groups** > **All groups**:
|
||||
|
||||
|
||||
|
||||
Select New group from the Groups blade to open the new groups UI. Select the "Security" group type, name the group, and select the "Assigned" membership type:
|
||||
|
||||
Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group.
|
||||
|
||||
|
||||
|
||||
Now click **Create** to finish creating the new group.
|
||||
|
||||
Click on **All groups** and click **Refresh** to verify that your new group has been successfully created.
|
||||
|
||||
With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results).
|
||||
|
||||
From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile:
|
||||
|
||||
|
||||
|
||||
Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**).
|
||||
|
||||
|
||||
|
||||
Click **Select** and then click **Save**.
|
||||
|
||||
|
||||
|
||||
It's also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot).
|
||||
|
||||
### Create a Windows Autopilot deployment profile using MSfB
|
||||
|
||||
If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section.
|
||||
@ -559,14 +564,17 @@ Also, make sure to wait at least 30 minutes from the time you've [configured com
|
||||
- Turn on the device
|
||||
- Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip).
|
||||
|
||||
|
||||
|
||||
|
||||
Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated.
|
||||
|
||||
|
||||
|
||||
|
||||
Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done.
|
||||
|
||||
> [!TIP]
|
||||
> If you recieve a message that "Something went wrong" and it "Looks like we can't connect to the URL for your organization's MDM terms of use" then verify you have correctly [assigned licenses](https://docs.microsoft.com/mem/intune/fundamentals/licenses-assign) to the current user.
|
||||
|
||||
Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings.
|
||||
|
||||
## Remove devices from Autopilot
|
||||
@ -575,41 +583,27 @@ To use the device (or VM) for other purposes after completion of this lab, you w
|
||||
|
||||
### Delete (deregister) Autopilot device
|
||||
|
||||
You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu.
|
||||
You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu.
|
||||
|
||||
|
||||
|
||||
Click **X** when challenged to complete the operation:
|
||||
|
||||
|
||||
|
||||
This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**.
|
||||
|
||||
|
||||
|
||||
The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune.
|
||||
|
||||
> [!NOTE]
|
||||
> A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.
|
||||
|
||||
To remove the device from the Autopilot program, select the device and click Delete.
|
||||
To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion.
|
||||
|
||||
|
||||
|
||||
A warning message appears reminding you to first remove the device from Intune, which we previously did.
|
||||
|
||||
|
||||
|
||||
|
||||
At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program:
|
||||
|
||||
|
||||
|
||||
Once the device no longer appears, you are free to reuse it for other purposes.
|
||||
|
||||
If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button:
|
||||
|
||||
|
||||
|
||||
## Appendix A: Verify support for Hyper-V
|
||||
|
||||
Starting with Windows 8, the host computer's microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information.
|
||||
@ -741,7 +735,7 @@ You will be able to find your app in your app list:
|
||||
#### Assign the app to your Intune profile
|
||||
|
||||
> [!NOTE]
|
||||
> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
|
||||
In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu:
|
||||
|
||||
@ -810,7 +804,7 @@ Click **OK** and then click **Add**.
|
||||
#### Assign the app to your Intune profile
|
||||
|
||||
> [!NOTE]
|
||||
> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
|
||||
|
||||
In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu:
|
||||
|
||||
|
||||
BIN
windows/deployment/windows-autopilot/images/ap-aad-mdm.png
Normal file
BIN
windows/deployment/windows-autopilot/images/ap-aad-mdm.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
BIN
windows/deployment/windows-autopilot/images/autopilot-oobe.png
Normal file
BIN
windows/deployment/windows-autopilot/images/autopilot-oobe.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 80 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 5.5 KiB After Width: | Height: | Size: 61 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 115 KiB After Width: | Height: | Size: 146 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB After Width: | Height: | Size: 124 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 80 KiB After Width: | Height: | Size: 137 KiB |
BIN
windows/deployment/windows-autopilot/images/devices1.png
Normal file
BIN
windows/deployment/windows-autopilot/images/devices1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 79 KiB |
BIN
windows/deployment/windows-autopilot/images/dp.png
Normal file
BIN
windows/deployment/windows-autopilot/images/dp.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 229 KiB |
BIN
windows/deployment/windows-autopilot/images/enroll1.png
Normal file
BIN
windows/deployment/windows-autopilot/images/enroll1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 204 KiB |
BIN
windows/deployment/windows-autopilot/images/enroll2.png
Normal file
BIN
windows/deployment/windows-autopilot/images/enroll2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 104 KiB |
BIN
windows/deployment/windows-autopilot/images/enroll3.png
Normal file
BIN
windows/deployment/windows-autopilot/images/enroll3.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 72 KiB |
BIN
windows/deployment/windows-autopilot/images/enroll4.png
Normal file
BIN
windows/deployment/windows-autopilot/images/enroll4.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
BIN
windows/deployment/windows-autopilot/images/group1.png
Normal file
BIN
windows/deployment/windows-autopilot/images/group1.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 214 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 111 KiB After Width: | Height: | Size: 120 KiB |
@ -76,6 +76,8 @@ Communicating with Azure Active Directory uses the following URLs:
|
||||
- login.microsoftonline.com
|
||||
- login.windows.net
|
||||
- account.live.com
|
||||
- accountalt.azureedge.net
|
||||
- secure.aadcdn.microsoftonline-p.com
|
||||
|
||||
If your environment uses Microsoft Intune, you need these additional URLs:
|
||||
- enrollment.manage.microsoft.com
|
||||
|
||||
@ -24,10 +24,10 @@ ms.reviewer:
|
||||
- Key trust
|
||||
|
||||
|
||||
You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520).
|
||||
You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520).
|
||||
Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703.
|
||||
|
||||
Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information.
|
||||
Alternatively, you can create a copy of the .ADMX and .ADML files from a Windows 10, version 1703 installation setup template folder to their respective language folder on a Windows Server, or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information.
|
||||
|
||||
On-premises certificate-based deployments of Windows Hello for Business needs one Group Policy setting: Enable Windows Hello for Business
|
||||
|
||||
|
||||
@ -152,7 +152,7 @@ You can onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windo
|
||||
> - The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs).
|
||||
> - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune.
|
||||
|
||||
Support for Windows Server, provide deeper insight into activities happening on the Windows server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
Support for Windows Server provides deeper insight into server activities, coverage for kernel and memory attack detection, and enables response actions.
|
||||
|
||||
1. Configure Defender for Endpoint onboarding settings on the Windows server. For more information, see [Onboard Windows 10 devices](configure-endpoints.md).
|
||||
|
||||
|
||||
@ -27,25 +27,50 @@ ms.topic: article
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
There are three phases in deploying Defender for Endpoint:
|
||||
|
||||
|Phase | Description |
|
||||
|:-------|:-----|
|
||||
| <br>[Phase 1: Prepare](prepare-deployment.md)| Learn about what you need to consider when deploying Defender for Endpoint: <br><br>- Stakeholders and sign-off <br> - Environment considerations <br>- Access <br> - Adoption order
|
||||
|  <br>[Phase 2: Setup](production-deployment.md)| Take the initial steps to access Microsoft Defender Security Center. You'll be guided on:<br><br>- Validating the licensing <br> - Completing the setup wizard within the portal<br>- Network configuration|
|
||||
|  <br>[Phase 3: Onboard](onboarding.md) | Onboard devices to the service so the Microsoft Defender ATP service can get sensor data from them.
|
||||
Microsoft Defender for Endpoint has the capabilities to effectively protect your enterprise from cyber threats.
|
||||
|
||||
Learn how to deploy Microsoft Defender for Endpoint so that your enterprise can take advantage of preventative protection, post-breach detection, automated investigation, and response.
|
||||
|
||||
|
||||
This solution provides guidance on the three phases of deployment. Each section corresponds to a separate article in this solution.
|
||||
|
||||
The deployment guide will guide you through the recommended path in deploying Defender for Endpoint.
|
||||
|
||||
|
||||
If you're unfamiliar with the general deployment planning steps, check out the [Plan deployment](deployment-strategy.md) topic to get a high-level overview of the general deployment steps and methods.
|
||||
Regardless of the environment architecture and method of deployment you choose outlined in the [Plan deployment](deployment-strategy.md) guidance, this guide is going to support you in onboarding endpoints.
|
||||
|
||||
|
||||
## Prepare
|
||||
Learn about what you need to consider when deploying Defender for Endpoint such as stakeholder approvals, environment considerations, access permissions, and adoption order of capabilities.
|
||||
|
||||
## In Scope
|
||||
## Setup
|
||||
Get guidance on the initial steps you need to take so that you can access the portal such as validating licensing, completing the setup wizard, and network configuration.
|
||||
|
||||
The following is in scope for this deployment guide:
|
||||
## Onboard
|
||||
Learn how to make use of deployment rings, supported onboarding tools based on the type of endpoint, and configuring available capabilities.
|
||||
|
||||
|
||||
## Key capabilities
|
||||
|
||||
This solution provides the following key capabilities:
|
||||
|
||||
Capability | Description
|
||||
:---|:---
|
||||
Eliminate risks and reduce your attack surface| Use attack surface reduction to minimize the areas where your organization could be vulnerable to threats.
|
||||
Block sophisticated threats and malware | Defend against never-before-seen polymorphic and metamorphic malware and fileless and file-based threats with next-generation protection.
|
||||
Remediation at scale with automation | Automatically investigate alerts and remediate complex threats in minutes. Apply best practices and intelligent decision-making algorithms to determine whether a threat is active and what action to take.
|
||||
Discover vulnerabilities and misconfigurations in real time | Bring security and IT together with Microsoft Threat & Vulnerability Management to quickly discover, prioritize, and remediate vulnerabilities and misconfigurations.
|
||||
Get expert-level threat monitoring and analysis | Empower your security operations centers with Microsoft Threat Experts. Get deep knowledge, advanced threat monitoring, analysis, and support to identify critical threats in your unique environment.
|
||||
Detect and respond to advanced attacks with behavioral monitoring | Spot attacks and zero-day exploits using advanced behavioral analytics and machine learning.
|
||||
Cross-platform support | Microsoft Defender for Endpoint provides security for non-Windows platforms including Mac, Linux servers, and Android.
|
||||
Evaluate capabilities | Fully evaluate our capabilities with a few simple clicks in the Microsoft Defender for Endpoint evaluation lab.
|
||||
Streamline and integrate via APIs | Integrate Microsoft Defender for Endpoint with your security solutions and streamline and automate security workflows with rich APIs.
|
||||
Simplify endpoint security management | Use a single pane of glass for all endpoint security actions, such as endpoint configuration, deployment, and management with Microsoft Endpoint Manager.
|
||||
|
||||
|
||||
## Scope
|
||||
|
||||
### In scope
|
||||
|
||||
- Use of Microsoft Endpoint Configuration Manager and Microsoft Endpoint Manager to onboard endpoints into the service and configure capabilities
|
||||
|
||||
@ -59,10 +84,19 @@ The following is in scope for this deployment guide:
|
||||
- Attack surface reduction
|
||||
|
||||
|
||||
## Out of scope
|
||||
### Out of scope
|
||||
|
||||
The following are out of scope of this deployment guide:
|
||||
|
||||
- Configuration of third-party solutions that might integrate with Defender for Endpoint
|
||||
|
||||
- Penetration testing in production environment
|
||||
|
||||
|
||||
|
||||
|
||||
## See also
|
||||
- [Phase 1: Prepare](prepare-deployment.md)
|
||||
- [Phase 2: Set up](production-deployment.md)
|
||||
- [Phase 3: Onboard](onboarding.md)
|
||||
- [Plan deployment](deployment-strategy.md)
|
||||
@ -25,15 +25,14 @@ ms.topic: article
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink)
|
||||
|
||||
Depending on the requirements of your environment, we've put together material to help guide you through the various options you can adopt to deploy Defender for Endpoint.
|
||||
|
||||
These are the general steps you need to take to deploy Defender for Endpoint:
|
||||
Plan your Microsoft Defender for Endpoint deployment so that you can maximize the security capabilities within the suite and better protect your enterprise from cyber threats.
|
||||
|
||||
|
||||
|
||||
- Identify architecture
|
||||
- Select deployment method
|
||||
- Configure capabilities
|
||||
This solution provides guidance on how to identify your environment architecture, select the type of deployment tool that best fits your needs, and guidance on how to configure capabilities.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Step 1: Identify architecture
|
||||
@ -43,7 +42,7 @@ Depending on your environment, some tools are better suited for certain architec
|
||||
|
||||
Use the following material to select the appropriate Defender for Endpoint architecture that best suites your organization.
|
||||
|
||||
|**Item**|**Description**|
|
||||
| Item | Description |
|
||||
|:-----|:-----|
|
||||
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf)<br/> [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) \| [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) | The architectural material helps you plan your deployment for the following architectures: <ul><li> Cloud-native </li><li> Co-management </li><li> On-premise</li><li>Evaluation and local onboarding</li>
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
@ -52,6 +52,11 @@ Windows 10 version | Microsoft Defender Antivirus
|
||||
-|-
|
||||
Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled
|
||||
|
||||
After you have enabled the services, you may need to configure your network or firewall to allow the connections between the services and your endpoints.
|
||||
|
||||
- .smartscreen.microsoft.com
|
||||
- .smartscreen-prod.microsoft.com
|
||||
|
||||
## Review network protection events in the Microsoft Defender for Endpoint Security Center
|
||||
|
||||
Microsoft Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
|
||||
@ -31,16 +31,23 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
## Before you begin:
|
||||
|
||||
1. Create an [event hub](https://docs.microsoft.com/azure/event-hubs/) in your tenant.
|
||||
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights****.
|
||||
|
||||
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights**.
|
||||
|
||||
## Enable raw data streaming:
|
||||
|
||||
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) with a Global Admin user.
|
||||
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
|
||||
3. Click on **Add data export settings**.
|
||||
|
||||
4. Choose a name for your new settings.
|
||||
|
||||
5. Choose **Forward events to Azure Event Hubs**.
|
||||
|
||||
6. Type your **Event Hubs name** and your **Event Hubs resource ID**.
|
||||
|
||||
In order to get your **Event Hubs resource ID**, go to your Azure Event Hubs namespace page on [Azure](https://ms.portal.azure.com/) > properties tab > copy the text under **Resource ID**:
|
||||
|
||||
|
||||
@ -64,8 +71,11 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
```
|
||||
|
||||
- Each event hub message in Azure Event Hubs contains list of records.
|
||||
|
||||
- Each record contains the event name, the time Microsoft Defender ATP received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "**properties**".
|
||||
|
||||
- For more information about the schema of Microsoft Defender for Endpoint events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
||||
|
||||
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
||||
|
||||
## Data types mapping:
|
||||
@ -73,13 +83,13 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
To get the data types for event properties do the following:
|
||||
|
||||
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package).
|
||||
|
||||
2. Run the following query to get the data types mapping for each event:
|
||||
|
||||
```
|
||||
{EventType}
|
||||
| getschema
|
||||
| project ColumnName, ColumnType
|
||||
|
||||
```
|
||||
|
||||
- Here is an example for Device Info event:
|
||||
@ -91,3 +101,4 @@ To get the data types for event properties do the following:
|
||||
- [Microsoft Defender for Endpoint streaming API](raw-data-export.md)
|
||||
- [Stream Microsoft Defender for Endpoint events to your Azure storage account](raw-data-export-storage.md)
|
||||
- [Azure Event Hubs documentation](https://docs.microsoft.com/azure/event-hubs/)
|
||||
- [Troubleshoot connectivity issues - Azure Event Hubs](https://docs.microsoft.com/azure/event-hubs/troubleshooting-guide)
|
||||
|
||||
@ -31,19 +31,24 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
## Before you begin:
|
||||
|
||||
1. Create a [Storage account](https://docs.microsoft.com/azure/storage/common/storage-account-overview) in your tenant.
|
||||
|
||||
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights**.
|
||||
3. Go to **Settings > Advanced Features > Preview features** and turn Preview features **On**.
|
||||
|
||||
## Enable raw data streaming:
|
||||
|
||||
1. Log in to [Microsoft Defender for Endpoint portal](https://securitycenter.windows.com) with Global Admin user.
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
3. Click on **Add data export settings**.
|
||||
4. Choose a name for your new settings.
|
||||
5. Choose **Forward events to Azure Storage**.
|
||||
6. Type your **Storage Account Resource Id**. In order to get your **Storage Account Resource Id**, go to your Storage account page on [Azure portal](https://ms.portal.azure.com/) > properties tab > copy the text under **Storage account resource ID**:
|
||||
|
||||
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
|
||||
3. Click on **Add data export settings**.
|
||||
|
||||
4. Choose a name for your new settings.
|
||||
|
||||
5. Choose **Forward events to Azure Storage**.
|
||||
|
||||
6. Type your **Storage Account Resource ID**. In order to get your **Storage Account Resource ID**, go to your Storage account page on [Azure portal](https://ms.portal.azure.com/) > properties tab > copy the text under **Storage account resource ID**:
|
||||
|
||||
|
||||
|
||||
7. Choose the events you want to stream and click **Save**.
|
||||
|
||||
@ -51,7 +56,7 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
|
||||
- A blob container will be created for each event type:
|
||||
|
||||
|
||||
|
||||
|
||||
- The schema of each row in a blob is the following JSON:
|
||||
|
||||
@ -65,8 +70,11 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
```
|
||||
|
||||
- Each blob contains multiple rows.
|
||||
|
||||
- Each row contains the event name, the time Defender for Endpoint received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties".
|
||||
|
||||
- For more information about the schema of Microsoft Defender for Endpoint events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
||||
|
||||
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
||||
|
||||
## Data types mapping:
|
||||
@ -74,13 +82,13 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
In order to get the data types for our events properties do the following:
|
||||
|
||||
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package).
|
||||
|
||||
2. Run the following query to get the data types mapping for each event:
|
||||
|
||||
```
|
||||
{EventType}
|
||||
| getschema
|
||||
| project ColumnName, ColumnType
|
||||
|
||||
```
|
||||
|
||||
- Here is an example for Device Info event:
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user