diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 4d35506749..c9a8e4b1b1 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 04/24/2018 +ms.date: 09/19/2018 --- # Onboard Windows 10 machines using Mobile Device Management tools @@ -55,82 +55,9 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre 7. Select **OK**, and **Create** to save your changes, which creates the profile. - - -### Onboard and monitor machines using the classic Intune console - -1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/): - - a. In the navigation pane, select **Settings** > **Onboarding**. - - b. Select Windows 10 as the operating system. - - c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**. - - d. Click **Download package**, and save the .zip file. - -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*. - -3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). - - a. Select **Policy** > **Configuration Policies** > **Add**. - ![Microsoft Intune Configuration Policies](images/atp-add-intune-policy.png) - - b. Under **Windows**, select **Custom Configuration (Windows 10 Desktop and Mobile and later)** > **Create and Deploy a Custom Policy** > **Create Policy**.
- ![Microsoft Intune Configuration Policies](images/atp-intune-new-policy.png) - - c. Type a name and description for the policy.
- - ![Microsoft Intune Create Policy](images/atp-intune-policy-name.png) - - d. Under OMA-URI settings, select **Add...**.
- - ![Microsoft Intune add OMC-URI](images/atp-intune-add-oma.png) - - e. Type the following values then select **OK**: - - ![Microsoft Intune save policy](images/atp-intune-oma-uri-setting.png) - - - **Setting name**: Type a name for the setting. - - **Setting description**: Type a description for the setting. - - **Data type**: Select **String**. - - **OMA-URI**: *./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding* - - **Value**: Copy and paste the contents of the *WindowsDefenderATP.onboarding* file you downloaded. - - - f. Save the policy. - - ![Microsoft Intune save policy](images/atp-intune-save-policy.png) - - g. Deploy the policy. - - ![Microsoft Intune deploy policy](images/atp-intune-deploy-policy.png) - - h. Select the device group to deploy the policy to: - - ![Microsoft Intune manage deployment](images/atp-intune-manage-deployment.png) - -When the policy is deployed and is propagated, machines will be shown in the **Machines list**. - -You can use the following onboarding policies to deploy configuration settings on machines. These policies can be sub-categorized to: -- Onboarding -- Health Status for onboarded machines -- Configuration for onboarded machines - -> [!div class="mx-tableFixed"] -Policy | OMA-URI | Type | Value | Description -:---|:---|:---|:---|:--- -Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Copy content from onboarding MDM file | Onboarding -Health Status for onboarded machines: Sense Is Running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | TRUE | Windows Defender ATP service is running -Health Status for onboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP -Health Status for onboarded machines: Organization ID | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID -Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
Default value: 1 | Windows Defender ATP Sample sharing is enabled -Configuration for onboarded machines: diagnostic data reporting frequency | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/TelemetryReportingFrequency | Integer | 1 or 2
1: Normal (default)

2: Expedite | Windows Defender ATP diagnostic data reporting - > [!NOTE] > - The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. > - Configuration of diagnostic data reporting frequency is only available for machines on Windows 10, version 1703. -> - Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical. >[!TIP] @@ -156,16 +83,6 @@ For security reasons, the package used to Offboard machines will expire 30 days 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). -Offboarding - Use the offboarding policies to remove configuration settings on machines. These policies can be sub-categorized to: -- Offboarding -- Health Status for offboarded machines -- Configuration for offboarded machines - -Policy | OMA-URI | Type | Value | Description -:---|:---|:---|:---|:--- -Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding - Health Status for offboarded machines: Sense Is Running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running -Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP > [!NOTE] > The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated.