[Group Policy](configure-endpoints-gp.md)
[Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md)
[Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md)
[VDI scripts](configure-endpoints-vdi.md) | +| **macOS** | [Local script](mac-install-manually.md)
[Microsoft Endpoint Manager](mac-install-with-intune.md)
[JAMF Pro](mac-install-with-jamf.md)
[Mobile Device Management](mac-install-with-other-mdm.md) | +| **Linux Server** | [Local script](linux-install-manually.md)
[Puppet](linux-install-with-puppet.md)
[Ansible](linux-install-with-ansible.md)| +| **iOS** | [App-based](ios-install.md) | +| **Android** | [Microsoft Endpoint Manager](android-intune.md) | + + + +## Step 3: Configure capabilities +After onboarding endpoints, configure the security capabilities in Microsoft Defender ATP so that you can maximize the robust security protection available in the suite. Capabilities include: + +- Endpoint detection and response +- Next-generation protection +- Attack surface reduction + + ## Related topics - [Deployment phases](deployment-phases.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/deployment-strategy-big.png b/windows/security/threat-protection/microsoft-defender-atp/images/deployment-strategy-big.png new file mode 100644 index 0000000000..cfee2eaf86 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/deployment-strategy-big.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboard-config-mgr.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-config-mgr.png new file mode 100644 index 0000000000..6e0bfa21fc Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-config-mgr.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboard-configure-diagram.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-configure-diagram.png new file mode 100644 index 0000000000..03df8d4c0c Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-configure-diagram.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboard-gp.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-gp.png new file mode 100644 index 0000000000..138ffc93cd Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-gp.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboard-intune-big.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-intune-big.png new file mode 100644 index 0000000000..d2e629f921 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-intune-big.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboard-intune.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-intune.png new file mode 100644 index 0000000000..b794184562 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-intune.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboard-script.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-script.png new file mode 100644 index 0000000000..385dfa8e22 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboard-script.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/onboarding-flow-diagram.png b/windows/security/threat-protection/microsoft-defender-atp/images/onboarding-flow-diagram.png new file mode 100644 index 0000000000..73e6c05da6 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/onboarding-flow-diagram.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md index 34ae68ed71..dab5b79f99 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md @@ -40,6 +40,20 @@ In general, to onboard devices to the service: >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqr] +## Onboarding tool options +The following table lists the available tools based on the endpoint that you need to onboard. + +| Endpoint | Tool options | +|--------------|------------------------------------------| +| **Windows** | [Local script (up to 10 devices)](configure-endpoints-script.md)
[Group Policy](configure-endpoints-gp.md)
[Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md)
[Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md)
[VDI scripts](configure-endpoints-vdi.md) | +| **macOS** | [Local scripts](mac-install-manually.md)
[Microsoft Endpoint Manager](mac-install-with-intune.md)
[JAMF Pro](mac-install-with-jamf.md)
[Mobile Device Management](mac-install-with-other-mdm.md) | +| **Linux Server** | [Local script](linux-install-manually.md)
[Puppet](linux-install-with-puppet.md)
[Ansible](linux-install-with-ansible.md)| +| **iOS** | [App-based](ios-install.md) | +| **Android** | [Microsoft Endpoint Manager](android-intune.md) | + + + + ## In this section Topic | Description :---|:--- diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md index 4860a31a21..7435ab66b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md @@ -26,16 +26,40 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) -## Collection creation +This article is part of the Deployment guide and acts as an example onboarding method that guides users in: +- Step 1: Onboarding Windows devices to the service +- Step 2: Configuring Microsoft Defender ATP capabilities + +This onboarding guidance will walk you through the following basic steps that you need to take when using Microsoft Endpoint Configuration Manager: +- **Creating a collection in Microsoft Endpoint Configuration Manager** +- **Configuring Microsoft Defender ATP capabilities using Microsoft Endpoint Configuration Manager** + +>[!NOTE] +>Only Windows devices are covered in this example deployment. + +While Microsoft Defender ATP supports onboarding of various endpoints and tools, this article does not cover them. + +For information on general onboarding using other supported deployment tools and methods, see [Onboarding overview](onboarding.md). + + +## Step 1: Onboard Windows devices using Microsoft Endpoint Configuration Manager + +### Collection creation To onboard Windows 10 devices with Microsoft Endpoint Configuration Manager, the -deployment can target either and existing collection or a new collection can be -created for testing. The onboarding like group policy or manual method does -not install any agent on the system. Within the Configuration Manager console +deployment can target an existing collection or a new collection can be +created for testing. + +Onboarding using tools such as Group policy or manual method does not install any agent on the system. + +Within the Microsoft Endpoint Configuration Manager console the onboarding process will be configured as part of the compliance settings -within the console. Any system that receives this required configuration will +within the console. + +Any system that receives this required configuration will maintain that configuration for as long as the Configuration Manager client -continues to receive this policy from the management point. Follow the steps -below to onboard systems with Configuration Manager. +continues to receive this policy from the management point. + +Follow the steps below to onboard endpoints using Microsoft Endpoint Configuration Manager. 1. In Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Device Collections**. @@ -75,8 +99,17 @@ below to onboard systems with Configuration Manager. After completing this task, you now have a device collection with all the Windows 10 endpoints in the environment. -## Endpoint detection and response -### Windows 10 + +## Step 2: Configure Microsoft Defender ATP capabilities +This section guides you in configuring the following capabilities using Microsoft Endpoint Configuration Manager on Windows devices: + +- [**Endpoint detection and response**](#endpoint-detection-and-response) +- [**Next-generation protection**](#next-generation-protection) +- [**Attack surface reduction**](#attack-surface-reduction) + + +### Endpoint detection and response +#### Windows 10 From within the Microsoft Defender Security Center it is possible to download the '.onboarding' policy that can be used to create the policy in System Center Configuration Manager and deploy that policy to Windows 10 devices. @@ -132,7 +165,7 @@ Manager and deploy that policy to Windows 10 devices.  -### Previous versions of Windows Client (Windows 7 and Windows 8.1) +#### Previous versions of Windows Client (Windows 7 and Windows 8.1) Follow the steps below to identify the Microsoft Defender ATP Workspace ID and Workspace Key, that will be required for the onboarding of previous versions of Windows. 1. From a Microsoft Defender Security Center Portal, select **Settings > Onboarding**. @@ -183,7 +216,7 @@ Follow the steps below to identify the Microsoft Defender ATP Workspace ID and W Once completed, you should see onboarded endpoints in the portal within an hour. -## Next generation protection +### Next generation protection Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers. 1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Antimalware Polices** and choose **Create Antimalware Policy**. @@ -230,7 +263,7 @@ needs on how Antivirus is configured. After completing this task, you now have successfully configured Windows Defender Antivirus. -## Attack surface reduction +### Attack surface reduction The attack surface reduction pillar of Microsoft Defender ATP includes the feature set that is available under Exploit Guard. Attack surface reduction (ASR) rules, Controlled Folder Access, Network Protection and Exploit Protection. @@ -295,7 +328,7 @@ See [Optimize ASR rule deployment and detections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr) for more details. -### To set Network Protection rules in Audit mode: +#### Set Network Protection rules in Audit mode: 1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.  @@ -325,7 +358,7 @@ detections](https://docs.microsoft.com/windows/security/threat-protection/micros After completing this task, you now have successfully configured Network Protection in audit mode. -### To set Controlled Folder Access rules in Audit mode: +#### To set Controlled Folder Access rules in Audit mode: 1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md index f30fe6cafa..29548856da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md @@ -27,24 +27,25 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631) -In this section, we will be using Microsoft Endpoint Manager (MEM) to deploy -Microsoft Defender ATP to your endpoints. - -For more information about MEM, check out these resources: -- [Microsoft Endpoint Manager page](https://docs.microsoft.com/mem/) -- [Blog post on convergence of Intune and ConfigMgr](https://www.microsoft.com/microsoft-365/blog/2019/11/04/use-the-power-of-cloud-intelligence-to-simplify-and-accelerate-it-and-the-move-to-a-modern-workplace/) -- [Introduction video on MEM](https://www.microsoft.com/microsoft-365/blog/2019/11/04/use-the-power-of-cloud-intelligence-to-simplify-and-accelerate-it-and-the-move-to-a-modern-workplace) -This process is a multi-step process, you'll need to: +This article is part of the Deployment guide and acts as an example onboarding method that guides users in: +- Step 1: Onboarding devices to the service by creating a group in Microsoft Endpoint Manager (MEM) to assign configurations on +- Step 2: Configuring Microsoft Defender ATP capabilities using Microsoft Endpoint Manager -- Identify target devices or users +This onboarding guidance will walk you through the following basic steps that you need to take when using Microsoft Endpoint Manager: - - Create an Azure Active Directory group (User or Device) +- [Identifying target devices or users](#identify-target-devices-or-users) -- Create a Configuration Profile + - Creating an Azure Active Directory group (User or Device) - - In MEM, we'll guide you in creating a separate policy for each feature +- [Creating a Configuration Profile](#step-2-create-configuration-policies-to-configure-microsoft-defender-atp-capabilities) + + - In Microsoft Endpoint Manager, we'll guide you in creating a separate policy for each capability. + +While Microsoft Defender ATP supports onboarding of various endpoints and tools, this article does not cover them. + +For information on general onboarding using other supported deployment tools and methods, see [Onboarding overview](onboarding.md). ## Resources @@ -57,7 +58,13 @@ Here are the links you'll need for the rest of the process: - [Intune Security baselines](https://docs.microsoft.com/mem/intune/protect/security-baseline-settings-defender-atp#microsoft-defender) -## Identify target devices or users +For more information about Microsoft Endpoint Manager, check out these resources: +- [Microsoft Endpoint Manager page](https://docs.microsoft.com/mem/) +- [Blog post on convergence of Intune and ConfigMgr](https://www.microsoft.com/microsoft-365/blog/2019/11/04/use-the-power-of-cloud-intelligence-to-simplify-and-accelerate-it-and-the-move-to-a-modern-workplace/) +- [Introduction video on MEM](https://www.microsoft.com/microsoft-365/blog/2019/11/04/use-the-power-of-cloud-intelligence-to-simplify-and-accelerate-it-and-the-move-to-a-modern-workplace) + +## Step 1: Onboard devices by creating a group in MEM to assign configurations on +### Identify target devices or users In this section, we will create a test group to assign your configurations on. >[!NOTE] @@ -93,11 +100,18 @@ needs.
8. Your testing group now has a member to test. -## Create configuration policies +## Step 2: Create configuration policies to configure Microsoft Defender ATP capabilities In the following section, you'll create a number of configuration policies. + First is a configuration policy to select which groups of users or devices will -be onboarded to Microsoft Defender ATP. Then you will continue by creating several -different types of Endpoint security policies. +be onboarded to Microsoft Defender ATP. + +Then you will continue by creating several +different types of endpoint security policies. + +- [Endpoint detection and response](#endpoint-detection-and-response) +- [Next-generation protection](#next-generation-protection) +- [Attack surface reduction](#attack-surface-reduction--attack-surface-reduction-rules) ### Endpoint detection and response diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index 233975b647..f26781b856 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -1,6 +1,6 @@ --- title: Onboard to the Microsoft Defender ATP service -description: +description: Learn how to onboard endpoints to Microsoft Defender ATP service keywords: search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -44,28 +44,51 @@ Deploying Microsoft Defender ATP is a three-phase process:
+
Phase 3: Onboard
[Group Policy](configure-endpoints-gp.md)
[Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md)
[Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md)
[VDI scripts](configure-endpoints-vdi.md) | +| **macOS** | [Local scripts](mac-install-manually.md)
[Microsoft Endpoint Manager](mac-install-with-intune.md)
[JAMF Pro](mac-install-with-jamf.md)
[Mobile Device Management](mac-install-with-other-mdm.md) | +| **Linux Server** | [Local script](linux-install-manually.md)
[Puppet](linux-install-with-puppet.md)
[Ansible](linux-install-with-ansible.md)| +| **iOS** | [App-based](ios-install.md) | +| **Android** | [Microsoft Endpoint Manager](android-intune.md) | -To deploy Microsoft Defender ATP, you'll need to onboard devices to the service. - -Depending on the architecture of your environment, you'll need to use the appropriate management tool that best suites your requirements. - -After onboarding the devices, you'll then configure the various capabilities such as endpoint detection and response, next-generation protection, and attack surface reduction. +## Step 2: Configure capabilities +After onboarding the endpoints, you'll then configure the various capabilities such as endpoint detection and response, next-generation protection, and attack surface reduction. -This article provides resources to guide you on: -- Using various management tools to onboard devices - - [Onboarding using Microsoft Endpoint Configuration Manager](onboarding-endpoint-configuration-manager.md) - - [Onboarding using Microsoft Endpoint Manager](onboarding-endpoint-manager.md) +## Example deployments +In this deployment guide, we'll guide you through using two deployment tools to onboard endpoints and how to configure capabilities. + +The tools in the example deployments are: +- [Onboarding using Microsoft Endpoint Configuration Manager](onboarding-endpoint-configuration-manager.md) +- [Onboarding using Microsoft Endpoint Manager](onboarding-endpoint-manager.md) + +Using the mentioned deployment tools above, you'll then be guided in configuring the following Microsoft Defender ATP capabilities: - Endpoint detection and response configuration - Next-generation protection configuration - Attack surface reduction configuration