mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-18 16:27:22 +00:00
Merge branch 'master' into delegated
This commit is contained in:
Joey Caparas
commit
e27f92037f
5
.vscode/extensions.json
vendored
5
.vscode/extensions.json
vendored
@ -1,5 +0,0 @@
|
|||||||
{
|
|
||||||
"recommendations": [
|
|
||||||
"docsmsft.docs-authoring-pack"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
8
.vscode/settings.json
vendored
8
.vscode/settings.json
vendored
@ -1,8 +0,0 @@
|
|||||||
{
|
|
||||||
"cSpell.words": [
|
|
||||||
"intune",
|
|
||||||
"kovter",
|
|
||||||
"kovter's",
|
|
||||||
"poshspy"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
@ -1,25 +1,23 @@
|
|||||||
---
|
---
|
||||||
title: ProfileXML XSD
|
title: ProfileXML XSD
|
||||||
description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples.
|
description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples.
|
||||||
ms.assetid: 2F32E14B-F9B9-4760-AE94-E57F1D4DFDB3
|
ms.assetid: 2F32E14B-F9B9-4760-AE94-E57F1D4DFDB3
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
ms.author: dansimp
|
ms.author: dansimp
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: manikadhiman
|
author: manikadhiman
|
||||||
ms.date: 02/05/2018
|
ms.date: 07/14/2020
|
||||||
---
|
---
|
||||||
|
|
||||||
# ProfileXML XSD
|
# ProfileXML XSD
|
||||||
|
|
||||||
|
Here's the XSD for the ProfileXML node in the VPNv2 CSP and VpnManagementAgent::AddProfileFromXmlAsync for Windows 10 and some profile examples.
|
||||||
Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples.
|
|
||||||
|
|
||||||
## XSD for the VPN profile
|
## XSD for the VPN profile
|
||||||
|
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||||
@ -27,6 +25,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
<xs:element name="VPNProfile">
|
<xs:element name="VPNProfile">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
|
<xs:element name="ProfileName" type="xs:string" minOccurs="0" maxOccurs="1" />
|
||||||
<xs:element name="EdpModeId" type="xs:string" minOccurs="0" maxOccurs="1" />
|
<xs:element name="EdpModeId" type="xs:string" minOccurs="0" maxOccurs="1" />
|
||||||
<xs:element name="RememberCredentials" type="xs:boolean" minOccurs="0" maxOccurs="1" />
|
<xs:element name="RememberCredentials" type="xs:boolean" minOccurs="0" maxOccurs="1" />
|
||||||
<xs:element name="AlwaysOn" type="xs:boolean" minOccurs="0" maxOccurs="1" />
|
<xs:element name="AlwaysOn" type="xs:boolean" minOccurs="0" maxOccurs="1" />
|
||||||
@ -36,6 +35,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
<xs:element name="DeviceTunnel" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="DeviceTunnel" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="RegisterDNS" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="RegisterDNS" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="ByPassForLocal" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="ByPassForLocal" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
|
<xs:element name="RequireVpnClientAppUI" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="Proxy" minOccurs="0" maxOccurs="1">
|
<xs:element name="Proxy" minOccurs="0" maxOccurs="1">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
@ -51,15 +51,15 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
|
|
||||||
<xs:element name="APNBinding" minOccurs="0" maxOccurs="1">
|
<xs:element name="APNBinding" minOccurs="0" maxOccurs="1">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
<xs:element name="ProviderId" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="ProviderId" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="AccessPointName" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="AccessPointName" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="UserName" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="UserName" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="Password" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="Password" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="IsCompressionEnabled" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="IsCompressionEnabled" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="AuthenticationType" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="AuthenticationType" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
@ -89,7 +89,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
<xs:element name="AppTrigger" minOccurs="0" maxOccurs="1">
|
<xs:element name="AppTrigger" minOccurs="0" maxOccurs="unbounded">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
<xs:element name="App" minOccurs="1" maxOccurs="1">
|
<xs:element name="App" minOccurs="1" maxOccurs="1">
|
||||||
@ -109,13 +109,20 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
<xs:element name="DnsServers" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="DnsServers" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="WebProxyServers" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="WebProxyServers" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="AutoTrigger" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="AutoTrigger" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
|
<xs:element name="Persistent" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
<xs:element name="TrafficFilter" minOccurs="0" maxOccurs="unbounded">
|
<xs:element name="TrafficFilter" minOccurs="0" maxOccurs="unbounded">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
<xs:element name="App" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="App" minOccurs="0" maxOccurs="1">
|
||||||
|
<xs:complexType>
|
||||||
|
<xs:sequence>
|
||||||
|
<xs:element name="Id" type="xs:string" minOccurs="1" maxOccurs="1"/>
|
||||||
|
</xs:sequence>
|
||||||
|
</xs:complexType>
|
||||||
|
</xs:element>
|
||||||
<xs:element name="Claims" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="Claims" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="Protocol" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="Protocol" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="LocalPortRanges" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="LocalPortRanges" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
@ -123,6 +130,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
<xs:element name="LocalAddressRanges" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="LocalAddressRanges" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="RemoteAddressRanges" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="RemoteAddressRanges" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="RoutingPolicyType" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="RoutingPolicyType" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
|
<xs:element name="Direction" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
@ -134,6 +142,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
<xs:element name="NativeProtocolType" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="NativeProtocolType" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="L2tpPsk" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="L2tpPsk" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="DisableClassBasedDefaultRoute" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="DisableClassBasedDefaultRoute" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
|
<xs:element name="PlumbIKEv2TSAsRoutes" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
<xs:element name="CryptographySuite" minOccurs="0" maxOccurs="1">
|
<xs:element name="CryptographySuite" minOccurs="0" maxOccurs="1">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
@ -148,34 +157,37 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
</xs:element>
|
</xs:element>
|
||||||
<xs:element name="Authentication" minOccurs="1" maxOccurs="1">
|
<xs:element name="Authentication" minOccurs="1" maxOccurs="1">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:choice>
|
||||||
<xs:element name="UserMethod" type="xs:string" minOccurs="0" maxOccurs="1" />
|
<xs:sequence>
|
||||||
|
<xs:element name="UserMethod" type="xs:string" minOccurs="0" maxOccurs="1" />
|
||||||
|
<xs:element name="Eap" minOccurs="0" maxOccurs="1">
|
||||||
|
<xs:complexType>
|
||||||
|
<xs:sequence>
|
||||||
|
<xs:element name="Configuration" minOccurs="1" maxOccurs="1">
|
||||||
|
<xs:complexType>
|
||||||
|
<xs:sequence>
|
||||||
|
<xs:element xmlns:q1="http://www.microsoft.com/provisioning/EapHostConfig" ref="q1:EapHostConfig" />
|
||||||
|
</xs:sequence>
|
||||||
|
</xs:complexType>
|
||||||
|
</xs:element>
|
||||||
|
</xs:sequence>
|
||||||
|
</xs:complexType>
|
||||||
|
</xs:element>
|
||||||
|
</xs:sequence>
|
||||||
<xs:element name="MachineMethod" type="xs:string" minOccurs="0" maxOccurs="1" />
|
<xs:element name="MachineMethod" type="xs:string" minOccurs="0" maxOccurs="1" />
|
||||||
<xs:element name="Eap" minOccurs="1" maxOccurs="1">
|
</xs:choice>
|
||||||
<xs:complexType>
|
|
||||||
<xs:sequence>
|
|
||||||
<xs:element name="Configuration" minOccurs="1" maxOccurs="1">
|
|
||||||
<xs:complexType>
|
|
||||||
<xs:sequence>
|
|
||||||
<xs:element xmlns:q1="http://www.microsoft.com/provisioning/EapHostConfig" ref="q1:EapHostConfig" />
|
|
||||||
</xs:sequence>
|
|
||||||
</xs:complexType>
|
|
||||||
</xs:element>
|
|
||||||
</xs:sequence>
|
|
||||||
</xs:complexType>
|
|
||||||
</xs:element>
|
|
||||||
</xs:sequence>
|
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
<xs:element minOccurs="0" maxOccurs="unbounded" name="Route">
|
<xs:element name="Route" minOccurs="0" maxOccurs="unbounded">
|
||||||
<xs:complexType>
|
<xs:complexType>
|
||||||
<xs:sequence>
|
<xs:sequence>
|
||||||
<xs:element name="Address" type="xs:string" minOccurs="1" maxOccurs="1"/>
|
<xs:element name="Address" type="xs:string" minOccurs="1" maxOccurs="1"/>
|
||||||
<xs:element name="PrefixSize" type="xs:unsignedByte" minOccurs="1" maxOccurs="1"/>
|
<xs:element name="PrefixSize" type="xs:unsignedByte" minOccurs="1" maxOccurs="1"/>
|
||||||
<xs:element name="ExclusionRoute" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
<xs:element name="ExclusionRoute" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||||
|
<xs:element name="Metric" type="xs:unsignedInt" minOccurs="0" maxOccurs="1"/>
|
||||||
</xs:sequence>
|
</xs:sequence>
|
||||||
</xs:complexType>
|
</xs:complexType>
|
||||||
</xs:element>
|
</xs:element>
|
||||||
@ -187,16 +199,79 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
|
|
||||||
## Native profile example
|
## Native profile example
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<VPNProfile>
|
||||||
|
<EdpModeId>corp.contoso.com</EdpModeId>
|
||||||
|
<RememberCredentials>true</RememberCredentials>
|
||||||
|
<AlwaysOn>false</AlwaysOn>
|
||||||
|
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||||
|
<TrustedNetworkDetection>contoso.com</TrustedNetworkDetection>
|
||||||
|
|
||||||
```
|
<Proxy>
|
||||||
<VPNProfile>
|
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
||||||
<NativeProfile>
|
<Manual>
|
||||||
<Servers>testServer.VPN.com</Servers>
|
<Server>HelloServer</Server>
|
||||||
<NativeProtocolType>IKEv2</NativeProtocolType>
|
</Manual>
|
||||||
<Authentication>
|
</Proxy>
|
||||||
<UserMethod>Eap</UserMethod>
|
|
||||||
<Eap>
|
<DeviceCompliance>
|
||||||
<Configuration>
|
<Enabled>true</Enabled>
|
||||||
|
<Sso>
|
||||||
|
<Enabled>true</Enabled>
|
||||||
|
<Eku>This is my Eku</Eku>
|
||||||
|
<IssuerHash>This is my issuer hash</IssuerHash>
|
||||||
|
</Sso>
|
||||||
|
</DeviceCompliance>
|
||||||
|
|
||||||
|
<AppTrigger>
|
||||||
|
<App>
|
||||||
|
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||||
|
</App>
|
||||||
|
</AppTrigger>
|
||||||
|
<AppTrigger>
|
||||||
|
<App>
|
||||||
|
<Id>C:\windows\system32\ping.exe</Id>
|
||||||
|
</App>
|
||||||
|
</AppTrigger>
|
||||||
|
|
||||||
|
<DomainNameInformation>
|
||||||
|
<DomainName>hrsite.corporate.contoso.com</DomainName>
|
||||||
|
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
||||||
|
<WebProxyServers>5.5.5.5</WebProxyServers>
|
||||||
|
<AutoTrigger>true</AutoTrigger>
|
||||||
|
</DomainNameInformation>
|
||||||
|
<DomainNameInformation>
|
||||||
|
<DomainName>.corp.contoso.com</DomainName>
|
||||||
|
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
||||||
|
<WebProxyServers>100.100.100.100</WebProxyServers>
|
||||||
|
</DomainNameInformation>
|
||||||
|
|
||||||
|
<TrafficFilter>
|
||||||
|
<App>
|
||||||
|
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||||
|
</App>
|
||||||
|
<Protocol>6</Protocol>
|
||||||
|
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
||||||
|
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
||||||
|
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
||||||
|
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||||
|
</TrafficFilter>
|
||||||
|
<TrafficFilter>
|
||||||
|
<App>
|
||||||
|
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||||
|
</App>
|
||||||
|
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
||||||
|
</TrafficFilter>
|
||||||
|
|
||||||
|
<NativeProfile>
|
||||||
|
<Servers>testServer.VPN.com</Servers>
|
||||||
|
<RoutingPolicyType>SplitTunnel</RoutingPolicyType>
|
||||||
|
<NativeProtocolType>IKEv2</NativeProtocolType>
|
||||||
|
<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
|
||||||
|
<Authentication>
|
||||||
|
<UserMethod>Eap</UserMethod>
|
||||||
|
<Eap>
|
||||||
|
<Configuration>
|
||||||
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
||||||
<EapMethod>
|
<EapMethod>
|
||||||
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type>
|
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type>
|
||||||
@ -261,178 +336,110 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro
|
|||||||
</Config>
|
</Config>
|
||||||
</EapHostConfig>
|
</EapHostConfig>
|
||||||
</Configuration>
|
</Configuration>
|
||||||
</Eap>
|
</Eap>
|
||||||
</Authentication>
|
</Authentication>
|
||||||
<RoutingPolicyType>SplitTunnel</RoutingPolicyType>
|
</NativeProfile>
|
||||||
<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
|
|
||||||
</NativeProfile>
|
<Route>
|
||||||
|
<Address>192.168.0.0</Address>
|
||||||
<Route>
|
<PrefixSize>24</PrefixSize>
|
||||||
<Address>192.168.0.0</Address>
|
</Route>
|
||||||
<PrefixSize>24</PrefixSize>
|
<Route>
|
||||||
</Route>
|
<Address>10.10.0.0</Address>
|
||||||
<Route>
|
<PrefixSize>16</PrefixSize>
|
||||||
<Address>10.10.0.0</Address>
|
</Route>
|
||||||
<PrefixSize>16</PrefixSize>
|
</VPNProfile>
|
||||||
</Route>
|
|
||||||
|
|
||||||
<AppTrigger>
|
|
||||||
<App>
|
|
||||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
|
||||||
</App>
|
|
||||||
</AppTrigger>
|
|
||||||
<AppTrigger>
|
|
||||||
<App>
|
|
||||||
<Id>C:\windows\system32\ping.exe</Id>
|
|
||||||
</App>
|
|
||||||
</AppTrigger>
|
|
||||||
|
|
||||||
|
|
||||||
<TrafficFilter>
|
|
||||||
<App>
|
|
||||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
|
||||||
</App>
|
|
||||||
<Protocol>6</Protocol>
|
|
||||||
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
|
||||||
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
|
||||||
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
|
||||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
|
||||||
</TrafficFilter>
|
|
||||||
<TrafficFilter>
|
|
||||||
<App>
|
|
||||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
|
||||||
</App>
|
|
||||||
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
|
||||||
</TrafficFilter>
|
|
||||||
|
|
||||||
|
|
||||||
<DomainNameInformation>
|
|
||||||
<DomainName>hrsite.corporate.contoso.com</DomainName>
|
|
||||||
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
|
||||||
<WebProxyServers>5.5.5.5</WebProxyServers>
|
|
||||||
<AutoTrigger>true</AutoTrigger>
|
|
||||||
</DomainNameInformation>
|
|
||||||
<DomainNameInformation>
|
|
||||||
<DomainName>.corp.contoso.com</DomainName>
|
|
||||||
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
|
||||||
<WebProxyServers>100.100.100.100</WebProxyServers>
|
|
||||||
</DomainNameInformation>
|
|
||||||
|
|
||||||
<EdpModeId>corp.contoso.com</EdpModeId>
|
|
||||||
<RememberCredentials>true</RememberCredentials>
|
|
||||||
<AlwaysOn>false</AlwaysOn>
|
|
||||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
|
||||||
<TrustedNetworkDetection>contoso.com</TrustedNetworkDetection>
|
|
||||||
<Proxy>
|
|
||||||
<Manual>
|
|
||||||
<Server>HelloServer</Server>
|
|
||||||
</Manual>
|
|
||||||
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
|
||||||
</Proxy>
|
|
||||||
|
|
||||||
<DeviceCompliance>
|
|
||||||
<Enabled>true</Enabled>
|
|
||||||
<Sso>
|
|
||||||
<Enabled>true</Enabled>
|
|
||||||
<Eku>This is my Eku</Eku>
|
|
||||||
<IssuerHash>This is my issuer hash</IssuerHash>
|
|
||||||
</Sso>
|
|
||||||
</DeviceCompliance>
|
|
||||||
</VPNProfile>
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Plug-in profile example
|
## Plug-in profile example
|
||||||
|
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
<VPNProfile>
|
<VPNProfile>
|
||||||
<PluginProfile>
|
<!--<EdpModeId>corp.contoso.com</EdpModeId>-->
|
||||||
<ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
|
<RememberCredentials>true</RememberCredentials>
|
||||||
<PluginPackageFamilyName>JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy</PluginPackageFamilyName>
|
<AlwaysOn>false</AlwaysOn>
|
||||||
<CustomConfiguration><pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema></CustomConfiguration>
|
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||||
</PluginProfile>
|
<TrustedNetworkDetection>contoso.com,test.corp.contoso.com</TrustedNetworkDetection>
|
||||||
<Route>
|
<DeviceTunnel>false</DeviceTunnel>
|
||||||
<Address>192.168.0.0</Address>
|
<RegisterDNS>false</RegisterDNS>
|
||||||
<PrefixSize>24</PrefixSize>
|
|
||||||
</Route>
|
|
||||||
<Route>
|
|
||||||
<Address>10.10.0.0</Address>
|
|
||||||
<PrefixSize>16</PrefixSize>
|
|
||||||
</Route>
|
|
||||||
<AppTrigger>
|
|
||||||
<App>
|
|
||||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
|
||||||
</App>
|
|
||||||
</AppTrigger>
|
|
||||||
<AppTrigger>
|
|
||||||
<App>
|
|
||||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
|
||||||
</App>
|
|
||||||
</AppTrigger>
|
|
||||||
<TrafficFilter>
|
|
||||||
<App>
|
|
||||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
|
||||||
</App>
|
|
||||||
<Protocol>6</Protocol>
|
|
||||||
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
|
||||||
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
|
||||||
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
|
||||||
<!--<RoutingPolicyType>ForceTunnel</RoutingPolicyType>-->
|
|
||||||
</TrafficFilter>
|
|
||||||
<TrafficFilter>
|
|
||||||
<App>
|
|
||||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
|
||||||
</App>
|
|
||||||
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
|
||||||
</TrafficFilter>
|
|
||||||
<TrafficFilter>
|
|
||||||
<App>
|
|
||||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
|
||||||
</App>
|
|
||||||
<Claims>O:SYG:SYD:(A;;CC;;;AU)</Claims>
|
|
||||||
<!--<RoutingPolicyType>SplitTunnel</RoutingPolicyType>-->
|
|
||||||
</TrafficFilter>
|
|
||||||
<DomainNameInformation>
|
|
||||||
<DomainName>corp.contoso.com</DomainName>
|
|
||||||
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
|
||||||
<WebProxyServers>5.5.5.5</WebProxyServers>
|
|
||||||
<AutoTrigger>false</AutoTrigger>
|
|
||||||
</DomainNameInformation>
|
|
||||||
<DomainNameInformation>
|
|
||||||
<DomainName>corp.contoso.com</DomainName>
|
|
||||||
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
|
||||||
<WebProxyServers>100.100.100.100</WebProxyServers>
|
|
||||||
</DomainNameInformation>
|
|
||||||
<!--<EdpModeId>corp.contoso.com</EdpModeId>-->
|
|
||||||
<RememberCredentials>true</RememberCredentials>
|
|
||||||
<AlwaysOn>false</AlwaysOn>
|
|
||||||
<DeviceTunnel>false</DeviceTunnel>
|
|
||||||
<RegisterDNS>false</RegisterDNS>
|
|
||||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
|
||||||
<TrustedNetworkDetection>contoso.com,test.corp.contoso.com</TrustedNetworkDetection>
|
|
||||||
<Proxy>
|
|
||||||
<Manual>
|
|
||||||
<Server>HelloServer</Server>
|
|
||||||
</Manual>
|
|
||||||
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
|
||||||
</Proxy>
|
|
||||||
<APNBinding>
|
|
||||||
<ProviderId></ProviderId>
|
|
||||||
<AccessPointName></AccessPointName>
|
|
||||||
<UserName></UserName>
|
|
||||||
<Password></Password>
|
|
||||||
<IsCompressionEnabled></IsCompressionEnabled>
|
|
||||||
<AuthenticationType></AuthenticationType>
|
|
||||||
</APNBinding>
|
|
||||||
</VPNProfile>
|
|
||||||
```
|
|
||||||
|
|
||||||
|
<Proxy>
|
||||||
|
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
||||||
|
<Manual>
|
||||||
|
<Server>HelloServer</Server>
|
||||||
|
</Manual>
|
||||||
|
|
||||||
|
</Proxy>
|
||||||
|
|
||||||
|
<APNBinding>
|
||||||
|
<ProviderId></ProviderId>
|
||||||
|
<AccessPointName></AccessPointName>
|
||||||
|
<UserName></UserName>
|
||||||
|
<Password></Password>
|
||||||
|
<IsCompressionEnabled>true</IsCompressionEnabled>
|
||||||
|
<AuthenticationType></AuthenticationType>
|
||||||
|
</APNBinding>
|
||||||
|
|
||||||
|
<PluginProfile>
|
||||||
|
<ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
|
||||||
|
<CustomConfiguration><pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema></CustomConfiguration>
|
||||||
|
<PluginPackageFamilyName>JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy</PluginPackageFamilyName>
|
||||||
|
</PluginProfile>
|
||||||
|
|
||||||
|
<AppTrigger>
|
||||||
|
<App>
|
||||||
|
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||||
|
</App>
|
||||||
|
</AppTrigger>
|
||||||
|
<AppTrigger>
|
||||||
|
<App>
|
||||||
|
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||||
|
</App>
|
||||||
|
</AppTrigger>
|
||||||
|
|
||||||
|
<DomainNameInformation>
|
||||||
|
<DomainName>corp.contoso.com</DomainName>
|
||||||
|
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
||||||
|
<WebProxyServers>5.5.5.5</WebProxyServers>
|
||||||
|
<AutoTrigger>false</AutoTrigger>
|
||||||
|
</DomainNameInformation>
|
||||||
|
<DomainNameInformation>
|
||||||
|
<DomainName>corp.contoso.com</DomainName>
|
||||||
|
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
||||||
|
<WebProxyServers>100.100.100.100</WebProxyServers>
|
||||||
|
</DomainNameInformation>
|
||||||
|
|
||||||
|
<TrafficFilter>
|
||||||
|
<App>
|
||||||
|
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||||
|
</App>
|
||||||
|
<Protocol>6</Protocol>
|
||||||
|
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
||||||
|
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
||||||
|
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
||||||
|
<!--<RoutingPolicyType>ForceTunnel</RoutingPolicyType>-->
|
||||||
|
</TrafficFilter>
|
||||||
|
<TrafficFilter>
|
||||||
|
<App>
|
||||||
|
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||||
|
</App>
|
||||||
|
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
||||||
|
</TrafficFilter>
|
||||||
|
<TrafficFilter>
|
||||||
|
<App>
|
||||||
|
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||||
|
</App>
|
||||||
|
<Claims>O:SYG:SYD:(A;;CC;;;AU)</Claims>
|
||||||
|
<!--<RoutingPolicyType>SplitTunnel</RoutingPolicyType>-->
|
||||||
|
</TrafficFilter>
|
||||||
|
|
||||||
|
<Route>
|
||||||
|
<Address>192.168.0.0</Address>
|
||||||
|
<PrefixSize>24</PrefixSize>
|
||||||
|
</Route>
|
||||||
|
<Route>
|
||||||
|
<Address>10.10.0.0</Address>
|
||||||
|
<PrefixSize>16</PrefixSize>
|
||||||
|
</Route>
|
||||||
|
</VPNProfile>
|
||||||
|
```
|
||||||
@ -24,7 +24,7 @@ ms.topic: article
|
|||||||
This guide helps IT professionals plan for and deploy Windows 10 Mobile devices.
|
This guide helps IT professionals plan for and deploy Windows 10 Mobile devices.
|
||||||
|
|
||||||
Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies.
|
Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies.
|
||||||
Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution.
|
Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement, by using a comprehensive mobile device management solution.
|
||||||
|
|
||||||
**In this article**
|
**In this article**
|
||||||
- [Deploy](#deploy)
|
- [Deploy](#deploy)
|
||||||
@ -36,8 +36,8 @@ Windows 10 supports end-to-end device lifecycle management to give companies con
|
|||||||
|
|
||||||
## Deploy
|
## Deploy
|
||||||
|
|
||||||
Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced.
|
Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which mobile device management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced.
|
||||||
Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050).
|
Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select the system that best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050).
|
||||||
|
|
||||||
### <a href="" id="deployment-scenarios"></a>Deployment scenarios
|
### <a href="" id="deployment-scenarios"></a>Deployment scenarios
|
||||||
|
|
||||||
@ -47,7 +47,7 @@ The built-in MDM client is common to all editions of the Windows 10 operating s
|
|||||||
|
|
||||||
Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee.
|
Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee.
|
||||||
Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps.
|
Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps.
|
||||||
Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ.
|
Knowing who owns the device and what the employee uses it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ.
|
||||||
|
|
||||||
For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic.
|
For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic.
|
||||||
|
|
||||||
@ -69,46 +69,47 @@ The way in which personal and corporate devices are enrolled into an MDM system
|
|||||||
</colgroup>
|
</colgroup>
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr class="odd">
|
<tr class="odd">
|
||||||
<td align="left"></td>
|
<th align="left"></th>
|
||||||
<td align="left"><strong>Personal devices</strong></td>
|
<th align="left">Personal devices</th>
|
||||||
<td align="left">Corporate devices</strong></td>
|
<th align="left">Corporate devices</th>
|
||||||
</tr>
|
</tr>
|
||||||
<tr class="even">
|
<tr class="even">
|
||||||
<td align="left"><strong>Ownership</strong></td>
|
<th align="left">Ownership</th>
|
||||||
<td align="left">Employee</td>
|
<td align="left">Employee</td>
|
||||||
<td align="left">Organization</td>
|
<td align="left">Organization</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr class="odd">
|
<tr class="odd">
|
||||||
<td align="left"><strong>Device Initialization</strong>
|
<td align="left"><strong>Device Initialization</strong>
|
||||||
|
|
||||||
In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.</td>
|
In the out-of-box experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.</td>
|
||||||
<td align="left">The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. </td>
|
<td align="left">The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. </td>
|
||||||
<td align="left">The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext).
|
<td align="left">The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext).
|
||||||
Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity.
|
Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory (Azure AD) organizational identity.
|
||||||
Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset.
|
Skipping the account setup in OOBE results in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device must be reset.
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr class="even">
|
<tr class="even">
|
||||||
<td align="left"><strong>Device Enrollment</strong>
|
<td align="left"><strong>Device Enrollment</strong>
|
||||||
|
|
||||||
Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. </td>
|
Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. </td>
|
||||||
<td align="left">Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM).
|
<td align="left">Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+Azure AD+MDM). If your organization does not have Azure AD, the employee’s device is automatically enrolled into your organization’s MDM system (MSA+MDM).
|
||||||
MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM).
|
MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM).
|
||||||
</td>
|
</td>
|
||||||
<td align="left">The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM).</td>
|
<td align="left">The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (Azure AD+MDM).</td>
|
||||||
</tr>
|
</tr>
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium.
|
Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (Azure AD+MDM) and personal devices (MSA+Azure AD+MDM). This requires Azure AD Premium.
|
||||||
|
|
||||||
### <a href="" id="identity-management"></a>Identity management
|
### <a href="" id="identity-management"></a>Identity management
|
||||||
|
|
||||||
*Applies to: Corporate and personal devices*
|
*Applies to: Corporate and personal devices*
|
||||||
|
|
||||||
Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities.
|
Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen determines who controls the device and influences your management capabilities.
|
||||||
|
|
||||||
>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services.
|
> [!NOTE]
|
||||||
|
> Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, and so on. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) provide access to these services.
|
||||||
|
|
||||||
The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios.
|
The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios.
|
||||||
|
|
||||||
@ -133,13 +134,13 @@ The following table describes the impact of identity choice on device management
|
|||||||
</tr>
|
</tr>
|
||||||
<tr class="odd">
|
<tr class="odd">
|
||||||
<td align="left"><strong>Ease of enrollment</td>
|
<td align="left"><strong>Ease of enrollment</td>
|
||||||
<td align="left">Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM).</td>
|
<td align="left">Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+Azure AD+MDM).</td>
|
||||||
<td align="left">Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium).</td>
|
<td align="left">Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (Azure AD+MDM – requires Azure AD Premium).</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr class="even">
|
<tr class="even">
|
||||||
<td align="left"><strong>Credential management</strong></td>
|
<td align="left"><strong>Credential management</strong></td>
|
||||||
<td align="left">Employees sign in to the device with Microsoft Account credentials.
|
<td align="left">Employees sign in to the device with Microsoft Account credentials.
|
||||||
Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account.
|
Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft Account.
|
||||||
</td>
|
</td>
|
||||||
<td align="left">Employees sign in to the device with Azure AD credentials.
|
<td align="left">Employees sign in to the device with Azure AD credentials.
|
||||||
IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations.
|
IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations.
|
||||||
@ -153,7 +154,7 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou
|
|||||||
<tr class="even">
|
<tr class="even">
|
||||||
<td align="left"><strong>User settings and data roaming across multiple Windows devices</td>
|
<td align="left"><strong>User settings and data roaming across multiple Windows devices</td>
|
||||||
<td align="left">User and app settings roam across all devices activated with the same personal identity through OneDrive.</td>
|
<td align="left">User and app settings roam across all devices activated with the same personal identity through OneDrive.</td>
|
||||||
<td align="left">If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release.</td>
|
<td align="left">If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD-joined device, this is not the case. Microsoft is investigating Enterprise roaming for a future release.</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr class="even">
|
<tr class="even">
|
||||||
<td align="left"><strong>Level of control</strong></td>
|
<td align="left"><strong>Level of control</strong></td>
|
||||||
@ -174,13 +175,14 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou
|
|||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
>**Note:** In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities will change in the future.
|
> [!NOTE]
|
||||||
|
> In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities may change in the future.
|
||||||
|
|
||||||
### <a href="" id="Infrastructure choices"></a>Infrastructure choices
|
### <a href="" id="Infrastructure choices"></a>Infrastructure choices
|
||||||
|
|
||||||
*Applies to: Corporate and personal devices*
|
*Applies to: Corporate and personal devices*
|
||||||
|
|
||||||
For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/library/mt627908.aspx).
|
For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD Premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/library/mt627908.aspx).
|
||||||
|
|
||||||
**Azure Active Directory**
|
**Azure Active Directory**
|
||||||
Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state.
|
Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state.
|
||||||
@ -189,7 +191,8 @@ Azure AD is a cloud-based directory service that provides identity and access ma
|
|||||||
Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution.
|
Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution.
|
||||||
Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account.
|
Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account.
|
||||||
|
|
||||||
>**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365.
|
> [!NOTE]
|
||||||
|
> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365.
|
||||||
In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx).
|
In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx).
|
||||||
|
|
||||||
**Cloud services**
|
**Cloud services**
|
||||||
@ -210,19 +213,20 @@ The Microsoft Store for Business is the place where IT administrators can find,
|
|||||||
|
|
||||||
## Configure
|
## Configure
|
||||||
|
|
||||||
MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control.
|
MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. The configuration settings you use depend on the deployment scenario, and corporate devices offer IT the broadest range of control.
|
||||||
|
|
||||||
>**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor.
|
> [!NOTE]
|
||||||
|
> This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor.
|
||||||
Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors.
|
Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors.
|
||||||
|
|
||||||
### <a href="" id="account-profile"></a>Account profile
|
### <a href="" id="account-profile"></a>Account profile
|
||||||
|
|
||||||
*Applies to: Corporate devices*
|
*Applies to: Corporate devices*
|
||||||
|
|
||||||
Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts.
|
Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization reduces the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts.
|
||||||
|
|
||||||
- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove.
|
- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove.
|
||||||
- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts.
|
- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than a Microsoft Account.
|
||||||
|
|
||||||
### <a href="" id="email-account"></a>Email accounts
|
### <a href="" id="email-account"></a>Email accounts
|
||||||
|
|
||||||
@ -230,7 +234,7 @@ Enforcing what accounts employees can use on a corporate device is important for
|
|||||||
|
|
||||||
Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies.
|
Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies.
|
||||||
|
|
||||||
- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx).
|
- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [Exchange ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx).
|
||||||
- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile.
|
- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile.
|
||||||
|
|
||||||
### <a href="" id="device-lock-restrictions"></a>Device Lock restrictions
|
### <a href="" id="device-lock-restrictions"></a>Device Lock restrictions
|
||||||
@ -239,41 +243,42 @@ Email and associated calendar and contacts are the primary apps that users acces
|
|||||||
|
|
||||||
It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](https://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices.
|
It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](https://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices.
|
||||||
|
|
||||||
>**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
|
> [!NOTE]
|
||||||
To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based.
|
> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
|
||||||
Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into.
|
To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware-based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based.
|
||||||
|
Companion devices must be paired with a Windows 10 PC using Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires the Pro or Enterprise edition of Windows 10.
|
||||||
|
|
||||||
Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply.
|
Most of the device lock restriction policies have been available through Exchange ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply:
|
||||||
|
|
||||||
- **Device Password Enabled** Specifies whether users are required to use a device lock password.
|
- **Device Password Enabled** Specifies whether users are required to use a device lock password.
|
||||||
- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234).
|
- **Allow Simple Device Password** Specifies whether users can use a simple password (for example, 1111 or 1234).
|
||||||
- **Alphanumeric Device Password Required** Whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard.
|
- **Alphanumeric Device Password Required** Specifies whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user can enter a numeric PIN on the keyboard.
|
||||||
- **Min Device Password Complex Characters** The number of password element types (i.e., uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords.
|
- **Min Device Password Complex Characters** The number of password element types (uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords.
|
||||||
- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.)
|
- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history. (Users cannot reuse passwords in the history to create new passwords.)
|
||||||
- **Min Device Password Length** The minimum number of characters required to create new passwords.
|
- **Min Device Password Length** The minimum number of characters required to create new passwords.
|
||||||
- **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock.
|
- **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock.
|
||||||
- **Allow Idle Return Without Password** Whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached.
|
- **Allow Idle Return Without Password** Specifies whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached.
|
||||||
- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.)
|
- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped. (A value of zero disables device wipe functionality.)
|
||||||
- **Screen Timeout While Locked** The number of minutes before the lock screen times out (this policy influences device power management).
|
- **Screen Timeout While Locked** The number of minutes before the lock screen times out. (This policy influences device power management.)
|
||||||
- **Allow Screen Timeout While Locked User Configuration** Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting).
|
- **Allow Screen Timeout While Locked User Configuration** Specifies whether users can manually configure screen timeout while the device is on the lock screen. (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting.)
|
||||||
|
|
||||||
Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario.
|
Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario.
|
||||||
Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment.
|
Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an Azure AD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment.
|
||||||
|
|
||||||
You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information.
|
You may notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies are applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information.
|
||||||
|
|
||||||
### <a href="" id="prevent-of-settings"></a>Prevent changing of settings
|
### <a href="" id="prevent-of-settings"></a>Prevent changing of settings
|
||||||
|
|
||||||
*Applies to: Corporate devices*
|
*Applies to: Corporate devices*
|
||||||
|
|
||||||
Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change.
|
Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change, including:
|
||||||
|
|
||||||
- **Allow Your Account** Specifies whether users are able to change account configuration in the Your Email and Accounts panel in Settings
|
- **Allow Your Account** Specifies whether users are allowed to change account configuration in the **Your Email and Accounts** panel in Settings
|
||||||
- **Allow VPN** Allows the user to change VPN settings</td>
|
- **Allow VPN** Specifies whether users are allowed to change VPN settings</td>
|
||||||
- **Allow Data Sense** Allows the user to change Data Sense settings</td>
|
- **Allow Data Sense** Specifies whether users are allowed to change Data Sense settings</td>
|
||||||
- **Allow Date Time** Allows the user to change data and time setting
|
- **Allow Date Time** Specifies whether users are allowed to change data and time setting
|
||||||
- **Allow Edit Device Name** Allows users to change the device name
|
- **Allow Edit Device Name** Specifies whether users are allowed to change the device name
|
||||||
- **Allow Speech Model Update** Specifies whether the device will receive updates to the speech recognition and speech synthesis models (to improve accuracy and performance)
|
- **Allow Speech Model Update** Specifies whether the device receives updates to the speech recognition and speech synthesis models (to improve accuracy and performance)
|
||||||
|
|
||||||
### <a href="" id="hardware-restrictions"></a>Hardware restrictions
|
### <a href="" id="hardware-restrictions"></a>Hardware restrictions
|
||||||
|
|
||||||
@ -281,35 +286,37 @@ Employees are usually allowed to change certain personal device settings that yo
|
|||||||
|
|
||||||
Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can use hardware restrictions to control the availability of these features.
|
Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can use hardware restrictions to control the availability of these features.
|
||||||
|
|
||||||
The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions.
|
The following is a list of the MDM settings that Windows 10 Mobile supports to configure hardware restrictions:
|
||||||
|
|
||||||
>**Note:** Some of these hardware restrictions provide connectivity and assist in data protection.
|
> [!NOTE]
|
||||||
|
> Some of these hardware restrictions provide connectivity and assist in data protection.
|
||||||
|
|
||||||
- **Allow NFC:** Whether the NFC radio is enabled
|
- **Allow NFC:** Specifies whether the NFC radio is enabled
|
||||||
- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging)
|
- **Allow USB Connection:** Specifies whether the USB connection is enabled (doesn’t affect USB charging)
|
||||||
- **Allow Bluetooth:** Whether users can enable and use the Bluetooth radio on their devices
|
- **Allow Bluetooth:** Specifies whether users can enable and use the Bluetooth radio on their devices
|
||||||
- **Allow Bluetooth Advertising:** Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices
|
- **Allow Bluetooth Advertising:** Specifies whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices
|
||||||
- **Allow Bluetooth Discoverable Mode:** Whether the device can discover other devices (e.g., headsets)
|
- **Allow Bluetooth Discoverable Mode:** Specifies whether the device can discover other devices (such as headsets)
|
||||||
- **Allow Bluetooth pre-pairing** Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device
|
- **Allow Bluetooth pre-pairing** Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device
|
||||||
- **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect
|
- **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect
|
||||||
- **Set Bluetooth Local Device Name:** The local Bluetooth device name
|
- **Set Bluetooth Local Device Name:** The local Bluetooth device name
|
||||||
- **Allow Camera:** Whether the camera is enabled
|
- **Allow Camera:** Specifies whether the camera is enabled
|
||||||
- **Allow Storage Card:** Whether the storage card slot is enabled
|
- **Allow Storage Card:** Specifies whether the storage card slot is enabled
|
||||||
- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings
|
- **Allow Voice Recording:** Specifies whether the user can use the microphone to create voice recordings
|
||||||
- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information
|
- **Allow Location:** Specifies whether the device can use the GPS sensor or other methods to determine location so applications can use location information
|
||||||
|
|
||||||
### <a href="" id="certificates"></a>Certificates
|
### <a href="" id="certificates"></a>Certificates
|
||||||
|
|
||||||
*Applies to: Personal and corporate devices*
|
*Applies to: Personal and corporate devices*
|
||||||
|
|
||||||
Certificates help improve security by providing account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation.
|
Certificates help improve security by providing account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation.
|
||||||
To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes.
|
To install certificates manually, you can post them on Microsoft Edge website or send them directly by using email, which is ideal for testing purposes.
|
||||||
Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired.
|
Using Simple Certificate Enrollment Protocol (SCEP) and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device, as long as the MDM system supports the SCEP or Personal Information Exchange (PFX). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired.
|
||||||
In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings.
|
In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings.
|
||||||
Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile).
|
For more detailed information about MDM certificate management, see [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile).
|
||||||
Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidentally.
|
Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidentally.
|
||||||
|
|
||||||
> **Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you:
|
> [!NOTE]
|
||||||
|
> To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you:
|
||||||
> - View a summary of all personal certificates
|
> - View a summary of all personal certificates
|
||||||
> - View the details of individual certificates
|
> - View the details of individual certificates
|
||||||
> - View the certificates used for VPN, Wi-Fi, and email authentication
|
> - View the certificates used for VPN, Wi-Fi, and email authentication
|
||||||
@ -322,7 +329,7 @@ Use the Allow Manual Root Certificate Installation setting to prevent users from
|
|||||||
*Applies to: Corporate and personal devices*
|
*Applies to: Corporate and personal devices*
|
||||||
|
|
||||||
Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention.
|
Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention.
|
||||||
You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators.
|
You can create multiple Wi-Fi profiles in your MDM system. The Windows 10 Mobile Wi-Fi connection profile settings that can be configured by administrators include:
|
||||||
|
|
||||||
- **SSID** The case-sensitive name of the Wi-Fi network Service Set Identifier
|
- **SSID** The case-sensitive name of the Wi-Fi network Service Set Identifier
|
||||||
- **Security type** The type of security the Wi-Fi network uses; can be one of the following authentication types:
|
- **Security type** The type of security the Wi-Fi network uses; can be one of the following authentication types:
|
||||||
@ -345,14 +352,14 @@ You can create multiple Wi-Fi profiles in your MDM system. The below table lists
|
|||||||
- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file
|
- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file
|
||||||
- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled
|
- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled
|
||||||
|
|
||||||
In addition, you can set a few device wide Wi-Fi settings.
|
In addition, you can set the following device wide Wi-Fi settings:
|
||||||
- **Allow Auto Connect to Wi-Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks
|
- **Allow Auto Connect to Wi-Fi Sense Hotspots** Specifies whether the device automatically detects and connects to Wi-Fi networks
|
||||||
- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings
|
- **Allow Manual Wi-Fi Configuration** Specifies whether the user can manually configure Wi-Fi settings
|
||||||
- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled
|
- **Allow Wi-Fi** Specifies whether the Wi-Fi hardware is enabled
|
||||||
- **Allow Internet Sharing** Allow or disallow Internet sharing
|
- **Allow Internet Sharing** Allows or disallows Internet sharing
|
||||||
- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks
|
- **WLAN Scan Mode** Specifies how actively the device scans for Wi-Fi networks
|
||||||
|
|
||||||
Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx).
|
For more detailed information about Wi-Fi connection profile settings, see [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx).
|
||||||
|
|
||||||
### <a href="" id="apn-profiles"></a>APN profiles
|
### <a href="" id="apn-profiles"></a>APN profiles
|
||||||
|
|
||||||
@ -360,7 +367,7 @@ Get more detailed information about Wi-Fi connection profile settings in the [Wi
|
|||||||
|
|
||||||
An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators.
|
An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators.
|
||||||
An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network.
|
An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network.
|
||||||
You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles.
|
You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles:
|
||||||
|
|
||||||
- **APN name** The APN name
|
- **APN name** The APN name
|
||||||
- *IP connection type* The IP connection type; set to one of the following values:
|
- *IP connection type* The IP connection type; set to one of the following values:
|
||||||
@ -368,7 +375,7 @@ You can define and deploy APN profiles in MDM systems that configure cellular da
|
|||||||
- IPv6 only
|
- IPv6 only
|
||||||
- IPv4 and IPv6 concurrently
|
- IPv4 and IPv6 concurrently
|
||||||
- IPv6 with IPv4 provided by 46xlat
|
- IPv6 with IPv4 provided by 46xlat
|
||||||
- **LTE attached** Whether the APN should be attached as part of an LTE Attach
|
- **LTE attached** Specifies whether the APN should be attached as part of an LTE Attach
|
||||||
- **APN class ID** The globally unique identifier that defines the APN class to the modem
|
- **APN class ID** The globally unique identifier that defines the APN class to the modem
|
||||||
- **APN authentication type** The APN authentication type; set to one of the following values:
|
- **APN authentication type** The APN authentication type; set to one of the following values:
|
||||||
- None
|
- None
|
||||||
@ -379,22 +386,22 @@ You can define and deploy APN profiles in MDM systems that configure cellular da
|
|||||||
- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
|
- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
|
||||||
- **Password** The password for the user account specified in User name
|
- **Password** The password for the user account specified in User name
|
||||||
- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile
|
- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile
|
||||||
- **Always on** Whether the connection manager will automatically attempt to connect to the APN whenever it is available
|
- **Always on** Specifies whether the connection manager automatically attempts to connect to the APN when it is available
|
||||||
- **Connection enabled** Specifies whether the APN connection is enabled
|
- **Connection enabled** Specifies whether the APN connection is enabled
|
||||||
- **Allow user control** Allows users to connect with other APNs than the enterprise APN
|
- **Allow user control** Allows users to connect with other APNs than the enterprise APN
|
||||||
- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs
|
- **Hide view** Specifies whether the cellular UX allows the user to view enterprise APNs
|
||||||
|
|
||||||
Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx).
|
For more detailed information about APN settings, see [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx).
|
||||||
|
|
||||||
### <a href="" id="proxy"></a>Proxy
|
### <a href="" id="proxy"></a>Proxy
|
||||||
|
|
||||||
*Applies to: Corporate devices*
|
*Applies to: Corporate devices*
|
||||||
|
|
||||||
The below lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity.
|
The following lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity:
|
||||||
|
|
||||||
- **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection)
|
- **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection)
|
||||||
- **Bypass Local** Specifies if the proxy should be bypassed when local hosts are accessed by the device
|
- **Bypass Local** Specifies whether the proxy should be bypassed when local hosts are accessed by the device
|
||||||
- **Enable** Specifies if the proxy is enabled
|
- **Enable** Specifies whether the proxy is enabled
|
||||||
- **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed
|
- **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed
|
||||||
- **User Name** Specifies the username used to connect to the proxy
|
- **User Name** Specifies the username used to connect to the proxy
|
||||||
- **Password** Specifies the password used to connect to the proxy
|
- **Password** Specifies the password used to connect to the proxy
|
||||||
@ -408,15 +415,15 @@ For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.micro
|
|||||||
|
|
||||||
*Applies to: Corporate and personal devices*
|
*Applies to: Corporate and personal devices*
|
||||||
|
|
||||||
Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management).
|
Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management).
|
||||||
|
|
||||||
You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile.
|
You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile.
|
||||||
To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings:
|
To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings:
|
||||||
|
|
||||||
- **VPN Servers** The VPN server for the VPN profile
|
- **VPN Servers** The VPN server for the VPN profile
|
||||||
- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values:
|
- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values:
|
||||||
- Split tunnel. Only network traffic destined to the intranet goes through the VPN connection
|
- Split tunnel: Only network traffic destined to the intranet goes through the VPN connection
|
||||||
- Force tunnel. All traffic goes through the VPN connection
|
- Force tunnel: All traffic goes through the VPN connection
|
||||||
- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic
|
- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic
|
||||||
- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections)
|
- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections)
|
||||||
- **Machine certificate** The machine certificate used for IKEv2-based VPN connections
|
- **Machine certificate** The machine certificate used for IKEv2-based VPN connections
|
||||||
@ -424,24 +431,25 @@ To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such a
|
|||||||
- **L2tpPsk** The pre-shared key used for an L2TP connection
|
- **L2tpPsk** The pre-shared key used for an L2TP connection
|
||||||
- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling
|
- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling
|
||||||
|
|
||||||
>**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client.
|
> [!NOTE]
|
||||||
|
> The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard walks you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client.
|
||||||
|
|
||||||
Microsoft Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes:
|
Microsoft Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes:
|
||||||
|
|
||||||
- **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address
|
- **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address
|
||||||
- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires
|
- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (such as authentication information) that the plugin provider requires
|
||||||
- **Microsoft Store VPN plugin family name** Specifies the Microsoft Store package family name for the Microsoft Store–based VPN plugin
|
- **Microsoft Store VPN plugin family name** Specifies the Microsoft Store package family name for the Microsoft Store–based VPN plugin
|
||||||
|
|
||||||
In addition, you can specify per VPN Profile:
|
In addition, you can specify per VPN profile:
|
||||||
|
|
||||||
- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list will automatically trigger the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention.
|
- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list automatically triggers the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention.
|
||||||
- **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface.
|
- **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface.
|
||||||
- **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile.
|
- **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile.
|
||||||
- **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface.
|
- **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface.
|
||||||
- **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List.
|
- **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List.
|
||||||
- **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings.
|
- **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings.
|
||||||
- **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it.
|
- **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it.
|
||||||
- **Remember credentials** Whether the VPN connection caches credentials.
|
- **Remember credentials** Specifies whether the VPN connection caches credentials.
|
||||||
- **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi).
|
- **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi).
|
||||||
- **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy.
|
- **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy.
|
||||||
- **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance.
|
- **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance.
|
||||||
@ -452,12 +460,12 @@ In addition, you can specify per VPN Profile:
|
|||||||
- No other VPN profiles can be connected or modified.
|
- No other VPN profiles can be connected or modified.
|
||||||
- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require.
|
- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require.
|
||||||
|
|
||||||
For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx)
|
For more details about VPN profiles, see [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx).
|
||||||
|
|
||||||
Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges.
|
Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges:
|
||||||
- **Allow VPN** Whether users can change VPN settings
|
- **Allow VPN** Specifies whether users can change VPN settings
|
||||||
- **Allow VPN Over Cellular** Whether users can establish VPN connections over cellular networks
|
- **Allow VPN Over Cellular** Specifies whether users can establish VPN connections over cellular networks
|
||||||
- **Allow VPN Over Cellular when Roaming** Whether users can establish VPN connections over cellular networks when roaming
|
- **Allow VPN Over Cellular when Roaming** Specifies whether users can establish VPN connections over cellular networks when roaming
|
||||||
|
|
||||||
### <a href="" id="storage-management"></a>Storage management
|
### <a href="" id="storage-management"></a>Storage management
|
||||||
|
|
||||||
@ -471,16 +479,16 @@ The SD card is uniquely paired with a device. No other devices can see the apps
|
|||||||
|
|
||||||
You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards.
|
You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards.
|
||||||
|
|
||||||
Here is a list of MDM storage management settings that Windows 10 Mobile provides.
|
Here is a list of MDM storage management settings that Windows 10 Mobile provides:
|
||||||
|
|
||||||
- **Allow Storage Card** Whether the use of storage cards for data storage is allowed
|
- **Allow Storage Card** Specifies whether the use of storage cards for data storage is allowed
|
||||||
- **Require Device Encryption** Whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off)
|
- **Require Device Encryption** Specifies whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off)
|
||||||
- **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values:
|
- **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values:
|
||||||
- AES-Cipher Block Chaining (CBC) 128-bit
|
- AES-Cipher Block Chaining (CBC) 128-bit
|
||||||
- AES-CBC 256-bit
|
- AES-CBC 256-bit
|
||||||
- XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default)
|
- XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default)
|
||||||
- XTS-AES-256-bit
|
- XTS-AES-256-bit
|
||||||
- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Whether the device allows or disallows the FIPS algorithm policy
|
- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Specifies whether the device allows or disallows the FIPS algorithm policy
|
||||||
- **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections
|
- **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections
|
||||||
- **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive
|
- **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive
|
||||||
- **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive
|
- **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive
|
||||||
@ -513,11 +521,11 @@ Azure AD authenticated managers have access to Microsoft Store for Business func
|
|||||||
Microsoft Store for Business supports app distribution under two licensing models: online and offline.
|
Microsoft Store for Business supports app distribution under two licensing models: online and offline.
|
||||||
|
|
||||||
The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps.
|
The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps.
|
||||||
Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention.
|
Corporate device users can find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system App Catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention.
|
||||||
|
|
||||||
Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps.
|
Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps.
|
||||||
|
|
||||||
Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device.
|
Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it's automatically installed from the cloud. Also, apps are automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device.
|
||||||
|
|
||||||
To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method.
|
To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method.
|
||||||
|
|
||||||
@ -525,7 +533,7 @@ To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile d
|
|||||||
|
|
||||||
Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition.
|
Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition.
|
||||||
|
|
||||||
Learn more about the [Microsoft Store for Business](/microsoft-store/index).
|
For more information, see [Microsoft Store for Business](/microsoft-store/index).
|
||||||
|
|
||||||
### <a href="" id="managing-apps"></a>Managing apps
|
### <a href="" id="managing-apps"></a>Managing apps
|
||||||
|
|
||||||
@ -535,23 +543,23 @@ IT administrators can control which apps are allowed to be installed on Windows
|
|||||||
|
|
||||||
Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store.
|
Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store.
|
||||||
|
|
||||||
For more details, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx).
|
For more information, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx).
|
||||||
|
|
||||||
In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM.
|
In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM:
|
||||||
|
|
||||||
- **Allow All Trusted Apps** Whether users can sideload apps on the device.
|
- **Allow All Trusted Apps** Specifies whether users can sideload apps on the device.
|
||||||
- **Allow App Store Auto Update** Whether automatic updates of apps from Microsoft Store are allowed.
|
- **Allow App Store Auto Update** Specifies whether automatic updates of apps from Microsoft Store are allowed.
|
||||||
- **Allow Developer Unlock** Whether developer unlock is allowed.
|
- **Allow Developer Unlock** Specifies whether developer unlock is allowed.
|
||||||
- **Allow Shared User App Data** Whether multiple users of the same app can share data.
|
- **Allow Shared User App Data** Specifies whether multiple users of the same app can share data.
|
||||||
- **Allow Store** Whether Microsoft Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system.
|
- **Allow Store** Specifies whether Microsoft Store app is allowed to run. This completely blocks the user from installing apps from the Store, but still allows app distribution through an MDM system.
|
||||||
- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above.
|
- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above.
|
||||||
- **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied.
|
- **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied.
|
||||||
- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.
|
- **Require Private Store Only** Specifies whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.
|
||||||
- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card.
|
- **Restrict App Data to System Volume** Specifies whether app data is allowed only on the system drive or can be stored on an SD card.
|
||||||
- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card.
|
- **Restrict App to System Volume** Specifies whether app installation is allowed only to the system drive or can be installed on an SD card.
|
||||||
- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx) for more information).
|
- **Start screen layout** An XML blob used to configure the Start screen (for more information, see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx)).
|
||||||
|
|
||||||
Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps)
|
Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps).
|
||||||
|
|
||||||
### <a href="" id="data-leak-prevention"></a>Data leak prevention
|
### <a href="" id="data-leak-prevention"></a>Data leak prevention
|
||||||
|
|
||||||
@ -561,7 +569,7 @@ One of the biggest challenges in protecting corporate information on mobile devi
|
|||||||
|
|
||||||
Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email.
|
Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email.
|
||||||
|
|
||||||
Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default.
|
Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data is encrypted at all times and any attempt to copy/paste or share this information with non-corporate apps or users fails. Unenlightened apps consider all data corporate and encrypt everything by default.
|
||||||
|
|
||||||
Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including:
|
Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including:
|
||||||
- Microsoft Edge
|
- Microsoft Edge
|
||||||
@ -581,19 +589,19 @@ The following table lists the settings that can be configured for Windows Inform
|
|||||||
- Override mode (encrypt, prompt, and audit)
|
- Override mode (encrypt, prompt, and audit)
|
||||||
- Block mode (encrypt, block, and audit)
|
- Block mode (encrypt, block, and audit)
|
||||||
- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected.
|
- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected.
|
||||||
- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience.
|
- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user is not able to remove protection from enterprise content through the OS or app user experience.
|
||||||
- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured.
|
- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured.
|
||||||
- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy.
|
- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy.
|
||||||
- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service.
|
- **Revoke on unenroll** Specifies whether to revoke the information protection keys when a device unenrolls from the management service.
|
||||||
- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long.
|
- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long.
|
||||||
- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection.
|
- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection.
|
||||||
- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu.
|
- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the **Start** menu.
|
||||||
- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection.
|
- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection.
|
||||||
- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected.
|
- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers is considered part of the enterprise and protected.
|
||||||
- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected.
|
- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device is considered enterprise data and is protected.
|
||||||
- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected.
|
- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected.
|
||||||
|
|
||||||
>**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it.
|
* Mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings (specifically Enterprise IP Range and Enterprise Network Domain Names) must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key so that others in the company can access it.
|
||||||
|
|
||||||
For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||||
|
|
||||||
@ -601,18 +609,18 @@ For more information on Windows Information Protection, see the [EnterpriseDataP
|
|||||||
|
|
||||||
*Applies to: Corporate devices*
|
*Applies to: Corporate devices*
|
||||||
|
|
||||||
On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks.
|
On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks:
|
||||||
|
|
||||||
- **Allow copy and paste** Whether users can copy and paste content
|
- **Allow copy and paste** Specifies whether users can copy and paste content
|
||||||
- **Allow Cortana** Whether users can use Cortana on the device (where available)
|
- **Allow Cortana** Specifies whether users can use Cortana on the device (where available)
|
||||||
- **Allow device discovery** Whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed)
|
- **Allow device discovery** Specifies whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed)
|
||||||
- **Allow input personalization** Whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation)
|
- **Allow input personalization** Specifies whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation)
|
||||||
- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system)
|
- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system)
|
||||||
- **Allow screen capture** Whether users are allowed to capture screenshots on the device
|
- **Allow screen capture** Specifies whether users are allowed to capture screenshots on the device
|
||||||
- **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed
|
- **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed
|
||||||
- **Allow sync my settings** Whether the user experience settings are synchronized between devices (works with Microsoft accounts only)
|
- **Allow sync my settings** Specifies whether the user experience settings are synchronized between devices (works with Microsoft accounts only)
|
||||||
- **Allow toasts notifications above lock screen** Whether users are able to view toast notification on the device lock screen
|
- **Allow toasts notifications above lock screen** Specifies whether users are able to view toast notification on the device lock screen
|
||||||
- **Allow voice recording** Whether users are allowed to perform voice recordings
|
- **Allow voice recording** Specifies whether users are allowed to perform voice recordings
|
||||||
- **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft
|
- **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft
|
||||||
- **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher
|
- **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher
|
||||||
- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data
|
- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data
|
||||||
@ -626,19 +634,19 @@ You can find more details on the experience settings in Policy CSP.
|
|||||||
|
|
||||||
MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection.
|
MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection.
|
||||||
|
|
||||||
The following settings for Microsoft Edge on Windows 10 Mobile can be managed.
|
The following settings for Microsoft Edge on Windows 10 Mobile can be managed:
|
||||||
|
|
||||||
- **Allow Browser** Whether users can run Microsoft Edge on the device
|
- **Allow Browser** Specifies whether users can run Microsoft Edge on the device
|
||||||
- **Allow Do Not Track headers** Whether Do Not Track headers are allowed
|
- **Allow Do Not Track headers** Specifies whether Do Not Track headers are allowed
|
||||||
- **Allow InPrivate** Whether users can use InPrivate browsing
|
- **Allow InPrivate** Specifies whether users can use InPrivate browsing
|
||||||
- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally
|
- **Allow Password Manager** Specifies whether users can use Password Manager to save and manage passwords locally
|
||||||
- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar
|
- **Allow Search Suggestions in Address Bar** Specifies whether search suggestions are shown in the address bar
|
||||||
- **Allow Windows Defender SmartScreen** Whether Windows Defender SmartScreen is enabled
|
- **Allow Windows Defender SmartScreen** Specifies whether Windows Defender SmartScreen is enabled
|
||||||
- **Cookies** Whether cookies are allowed
|
- **Cookies** Specifies whether cookies are allowed
|
||||||
- **Favorites** Configure Favorite URLs
|
- **Favorites** Configure Favorite URLs
|
||||||
- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time
|
- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time
|
||||||
- **Prevent Windows Defender SmartScreen Prompt Override** Whether users can override the Windows Defender SmartScreen warnings for URLs
|
- **Prevent Windows Defender SmartScreen Prompt Override** Specifies whether users can override the Windows Defender SmartScreen warnings for URLs
|
||||||
- **Prevent Smart Screen Prompt Override for Files** Whether users can override the Windows Defender SmartScreen warnings for files
|
- **Prevent Smart Screen Prompt Override for Files** Specifies whether users can override the Windows Defender SmartScreen warnings for files
|
||||||
|
|
||||||
## Manage
|
## Manage
|
||||||
|
|
||||||
@ -646,7 +654,7 @@ In enterprise IT environments, the need for security and cost control must be ba
|
|||||||
|
|
||||||
### <a href="" id="servicing-options"></a>Servicing options
|
### <a href="" id="servicing-options"></a>Servicing options
|
||||||
|
|
||||||
**A streamlined update process**
|
#### A streamlined update process
|
||||||
|
|
||||||
*Applies to: Corporate and personal devices*
|
*Applies to: Corporate and personal devices*
|
||||||
|
|
||||||
@ -682,11 +690,11 @@ Microsoft has streamlined the Windows product engineering and release cycle so n
|
|||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These <strong>Quality Updates</strong>, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process.
|
Microsoft also delivers and installs monthly updates for security and stability directly to Windows 10 Mobile devices. These <strong>Quality Updates</strong>, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process.
|
||||||
|
|
||||||
Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates.
|
Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process apply to both feature and quality updates.
|
||||||
|
|
||||||
Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary.
|
Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device uses Auto Scan to search for available updates. However, depending on the device’s network and power status, update methods and timing may vary.
|
||||||
|
|
||||||
<table>
|
<table>
|
||||||
<colgroup>
|
<colgroup>
|
||||||
@ -717,8 +725,8 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au
|
|||||||
<tr class="odd">
|
<tr class="odd">
|
||||||
<td align="left"><strong>Cellular</strong></td>
|
<td align="left"><strong>Cellular</strong></td>
|
||||||
<td align="left">Device is only connected to a cellular network (standard data charges apply)</td>
|
<td align="left">Device is only connected to a cellular network (standard data charges apply)</td>
|
||||||
<td align="left">Will skip a daily scan if scan was successfully completed in the last 5 days</td>
|
<td align="left">Skips a daily scan if scan was successfully completed in the last 5 days</td>
|
||||||
<td align="left">Will only occur if update package is small and does not exceed the mobile operator data limit.</td>
|
<td align="left">Only occurs if update package is small and does not exceed the mobile operator data limit.</td>
|
||||||
<td align="left">Yes</td>
|
<td align="left">Yes</td>
|
||||||
<td align="left">Idem</td>
|
<td align="left">Idem</td>
|
||||||
</tr>
|
</tr>
|
||||||
@ -733,22 +741,22 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au
|
|||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
**Keeping track of updates releases**
|
#### Keeping track of updates releases
|
||||||
|
|
||||||
*Applies to: Corporate and Personal devices*
|
*Applies to: Corporate and Personal devices*
|
||||||
|
|
||||||
Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](https://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about.
|
Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](https://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about.
|
||||||
|
|
||||||
>**Note:**
|
> [!NOTE]
|
||||||
We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub
|
> We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback by using the Feedback Hub.
|
||||||
|
|
||||||
**Windows as a Service**
|
#### Windows as a Service
|
||||||
|
|
||||||
*Applies to: Corporate and Personal devices*
|
*Applies to: Corporate and Personal devices*
|
||||||
|
|
||||||
Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure.
|
Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure.
|
||||||
|
|
||||||
Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below:
|
Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the following chart.
|
||||||
|
|
||||||
<table>
|
<table>
|
||||||
<colgroup>
|
<colgroup>
|
||||||
@ -790,7 +798,7 @@ Update availability depends on what servicing option you choose for the device.
|
|||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
**Enterprise Edition**
|
#### Enterprise edition
|
||||||
|
|
||||||
*Applies to: Corporate devices*
|
*Applies to: Corporate devices*
|
||||||
|
|
||||||
@ -805,11 +813,12 @@ To learn more about diagnostic, see [Configure Windows diagnostic data in your o
|
|||||||
|
|
||||||
To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required.
|
To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required.
|
||||||
|
|
||||||
Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx)
|
For more information on updating a device to Enterprise edition, see [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx).
|
||||||
|
|
||||||
>**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices.
|
> [!NOTE]
|
||||||
|
> We recommend using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices.
|
||||||
|
|
||||||
**Deferring and Approving Updates with MDM**
|
#### Deferring and approving updates with MDM
|
||||||
|
|
||||||
*Applies to: Corporate devices with Enterprise edition*
|
*Applies to: Corporate devices with Enterprise edition*
|
||||||
|
|
||||||
@ -845,11 +854,11 @@ The following table summarizes applicable update policy settings by version of W
|
|||||||
<td align="left"><strong>Subscribe device to CBB, to defer Feature Updates</strong></td>
|
<td align="left"><strong>Subscribe device to CBB, to defer Feature Updates</strong></td>
|
||||||
<td align="left">RequireDeferUpgrade
|
<td align="left">RequireDeferUpgrade
|
||||||
|
|
||||||
Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB).
|
Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB).
|
||||||
Defers feature update for minimum of 4 months after Current Branch was release.</td>
|
Defers feature update for minimum of 4 months after Current Branch was release.</td>
|
||||||
<td align="left">BranchReadinessLevel
|
<td align="left">BranchReadinessLevel
|
||||||
|
|
||||||
Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB).
|
Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB).
|
||||||
Defers feature update for minimum of 4 months after Current Branch was release.</td></tr>
|
Defers feature update for minimum of 4 months after Current Branch was release.</td></tr>
|
||||||
<tr class="odd">
|
<tr class="odd">
|
||||||
<td align="left"><strong>Defer Updates</strong></td>
|
<td align="left"><strong>Defer Updates</strong></td>
|
||||||
@ -880,7 +889,7 @@ Pause Feature Updates for up to 35 days</td>
|
|||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
**Managing the Update Experience**
|
#### Managing the update experience
|
||||||
|
|
||||||
*Applies to: Corporate devices with Enterprise edition*
|
*Applies to: Corporate devices with Enterprise edition*
|
||||||
|
|
||||||
@ -892,33 +901,33 @@ This can include:
|
|||||||
- Automatically downloading and restarting devices with user notification.
|
- Automatically downloading and restarting devices with user notification.
|
||||||
- Automatically downloading and restarting devices at a specified time.
|
- Automatically downloading and restarting devices at a specified time.
|
||||||
- Automatically downloading and restarting devices without user interaction.
|
- Automatically downloading and restarting devices without user interaction.
|
||||||
- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates.
|
- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device does not receive any updates.
|
||||||
|
|
||||||
In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.).
|
In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, and so on) or on a specific [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, and so on).
|
||||||
|
|
||||||
**Managing the source of updates with MDM**
|
#### Managing the source of updates with MDM
|
||||||
|
|
||||||
*Applies to: Corporate devices with Enterprise edition*
|
*Applies to: Corporate devices with Enterprise edition*
|
||||||
|
|
||||||
Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system.
|
Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system.
|
||||||
|
|
||||||
Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
|
For more information, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
|
||||||
|
|
||||||
IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS.
|
IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS).
|
||||||
|
|
||||||
**Managing Updates with Windows Update Server**
|
#### Managing Updates with Windows Update Server
|
||||||
|
|
||||||
*Applies to: Corporate devices with Enterprise edition*
|
*Applies to: Corporate devices with Enterprise edition*
|
||||||
|
|
||||||
When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices.
|
When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices.
|
||||||
|
|
||||||
Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx)
|
For more information, see [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx).
|
||||||
|
|
||||||
**Querying the device update status**
|
#### Querying the device update status
|
||||||
|
|
||||||
*Applies to: Personal and corporate devices*
|
*Applies to: Personal and corporate devices*
|
||||||
|
|
||||||
In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates.
|
In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates:
|
||||||
|
|
||||||
The device update status query provides an overview of:
|
The device update status query provides an overview of:
|
||||||
- Installed updates: A list of updates that are installed on the device.
|
- Installed updates: A list of updates that are installed on the device.
|
||||||
@ -936,7 +945,7 @@ Device Health Attestation (DHA) is another line of defense that is new to Window
|
|||||||
|
|
||||||
Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN.
|
Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN.
|
||||||
|
|
||||||
The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network.
|
The first version of DHA was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, DHA capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network.
|
||||||
|
|
||||||
The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that:
|
The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that:
|
||||||
- Run Windows 10 operating system (mobile phone or PC)
|
- Run Windows 10 operating system (mobile phone or PC)
|
||||||
@ -953,26 +962,27 @@ DHA-enabled device management solutions help IT managers create a unified securi
|
|||||||
- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring)
|
- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring)
|
||||||
- Simply alert the user or the admin to fix the issue
|
- Simply alert the user or the admin to fix the issue
|
||||||
|
|
||||||
>**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately.
|
> [!NOTE]
|
||||||
|
> Windows Device Health Attestation Service can be used for conditional access scenarios that may be enabled by Mobile Device Management solutions (such as Microsoft Intune) and other types of management systems (such as SCCM) purchased separately.
|
||||||
|
|
||||||
For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide).
|
For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide).
|
||||||
|
|
||||||
This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above.
|
This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above:
|
||||||
- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK).
|
- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK).
|
||||||
- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy.
|
- **Data Execution Prevention (DEP) enabled** Specifies whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy.
|
||||||
- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker.
|
- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker.
|
||||||
- **Secure Boot enabled** Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices.
|
- **Secure Boot enabled** Specifies whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices.
|
||||||
- **Code integrity enabled** Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity.
|
- **Code integrity enabled** Specifies whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity.
|
||||||
- **Safe mode** Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode.
|
- **Safe mode** Specifies whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode.
|
||||||
- **Boot debug enabled** Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled.
|
- **Boot debug enabled** Specifies whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled.
|
||||||
- **OS kernel debugging enabled** Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled.
|
- **OS kernel debugging enabled** Specifies whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled.
|
||||||
- **Test signing enabled** Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled.
|
- **Test signing enabled** Specifies whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled.
|
||||||
- **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted).
|
- **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted).
|
||||||
- **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted).
|
- **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted).
|
||||||
- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash.
|
- **Secure Boot Configuration Policy (SBCP) present** Specifies whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash.
|
||||||
- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allow list. A device that complies with the allow list is more trustworthy (secure) than a device that is noncompliant.
|
- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allow list. A device that complies with the allow list is more trustworthy (secure) than a device that is noncompliant.
|
||||||
|
|
||||||
**Example scenario**
|
#### Example scenario
|
||||||
|
|
||||||
Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device.
|
Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device.
|
||||||
|
|
||||||
@ -988,9 +998,9 @@ Here is what occurs when a smartphone is turned on:
|
|||||||
|
|
||||||
*Applies to: Corporate devices with Enterprise edition*
|
*Applies to: Corporate devices with Enterprise edition*
|
||||||
|
|
||||||
Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (e.g., installed updates).
|
Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (such as installed updates).
|
||||||
|
|
||||||
The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide.
|
The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide:
|
||||||
|
|
||||||
- **Installed enterprise apps** List of the enterprise apps installed on the device
|
- **Installed enterprise apps** List of the enterprise apps installed on the device
|
||||||
- **Device name** The device name configured for the device
|
- **Device name** The device name configured for the device
|
||||||
@ -1004,7 +1014,7 @@ The following list shows examples of the Windows 10 Mobile software and hardware
|
|||||||
- **Device language** Language in use on the device
|
- **Device language** Language in use on the device
|
||||||
- **Phone number** Phone number assigned to the device
|
- **Phone number** Phone number assigned to the device
|
||||||
- **Roaming status** Indicates whether the device has a roaming cellular connection
|
- **Roaming status** Indicates whether the device has a roaming cellular connection
|
||||||
- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user
|
- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI)** Unique identifiers for the cellular connection for the phone (Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user)
|
||||||
- **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device
|
- **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device
|
||||||
- **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device
|
- **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device
|
||||||
- **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device
|
- **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device
|
||||||
@ -1021,14 +1031,15 @@ You can control the level of data that diagnostic data systems collect. To confi
|
|||||||
|
|
||||||
For more information, see [Configure Windows diagnostic data in Your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
|
For more information, see [Configure Windows diagnostic data in Your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
|
||||||
|
|
||||||
>**Note:** Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition.
|
> [!NOTE]
|
||||||
|
> Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition.
|
||||||
|
|
||||||
### <a href="" id="mremote-assistance"></a>Remote assistance
|
### <a href="" id="mremote-assistance"></a>Remote assistance
|
||||||
|
|
||||||
*Applies to: Personal and corporate devices*
|
*Applies to: Personal and corporate devices*
|
||||||
|
|
||||||
The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include:
|
The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include:
|
||||||
- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (e.g., leaving the device at a customer site).
|
- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (such as leaving the device at a customer site).
|
||||||
- **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices.
|
- **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices.
|
||||||
- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it.
|
- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it.
|
||||||
- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device.
|
- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device.
|
||||||
@ -1040,7 +1051,8 @@ The remote assistance features in Windows 10 Mobile help resolve issues that use
|
|||||||
|
|
||||||
These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password.
|
These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password.
|
||||||
|
|
||||||
>**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store.
|
> [!NOTE]
|
||||||
|
> Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store.
|
||||||
|
|
||||||
## Retire
|
## Retire
|
||||||
|
|
||||||
@ -1050,19 +1062,20 @@ Device retirement is the last phase of the device lifecycle, which in today’s
|
|||||||
|
|
||||||
Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected.
|
Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected.
|
||||||
|
|
||||||
>**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration.
|
> [!NOTE]
|
||||||
|
> All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration.
|
||||||
|
|
||||||
**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world.
|
**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world.
|
||||||
|
|
||||||
If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data.
|
If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data.
|
||||||
|
|
||||||
A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system.
|
A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data is tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles are immediately removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and is reported to the MDM system.
|
||||||
|
|
||||||
**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process.
|
**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that also makes the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process.
|
||||||
|
|
||||||
**Settings for personal or corporate device retirement**
|
**Settings for personal or corporate device retirement**
|
||||||
- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system)
|
- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (unenroll the device from the MDM system)
|
||||||
- **Allow user to reset phone** Whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults
|
- **Allow user to reset phone** Specifies whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|||||||
@ -85,6 +85,7 @@ The following methodology was used to derive these network endpoints:
|
|||||||
|||HTTPS|*ow1.res.office365.com|
|
|||HTTPS|*ow1.res.office365.com|
|
||||||
|||HTTPS|office.com|
|
|||HTTPS|office.com|
|
||||||
|||HTTPS|blobs.officehome.msocdn.com|
|
|||HTTPS|blobs.officehome.msocdn.com|
|
||||||
|
|||HTTPS|self.events.data.microsoft.com|
|
||||||
|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)|
|
|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)|
|
||||||
|||TLSv1.2|*g.live.com|
|
|||TLSv1.2|*g.live.com|
|
||||||
|||TLSv1.2|oneclient.sfx.ms|
|
|||TLSv1.2|oneclient.sfx.ms|
|
||||||
|
|||||||
@ -8,11 +8,14 @@ ms.pagetype: security
|
|||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
author: dulcemontemayor
|
author: dulcemontemayor
|
||||||
ms.author: dansimp
|
ms.author: v-tea
|
||||||
manager: dansimp
|
manager: dansimp
|
||||||
ms.collection: M365-identity-device-management
|
ms.collection: M365-identity-device-management
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
|
ms.custom:
|
||||||
|
- CI 120967
|
||||||
|
- CSSTroubleshooting
|
||||||
---
|
---
|
||||||
|
|
||||||
# Manage Windows Defender Credential Guard
|
# Manage Windows Defender Credential Guard
|
||||||
@ -154,14 +157,25 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
|
|||||||
|
|
||||||
- You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for:
|
- You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for:
|
||||||
- **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials.
|
- **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials.
|
||||||
- **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: 0x1, 0
|
- **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0**
|
||||||
- The first variable: 0x1 means Windows Defender Credential Guard is configured to run. 0x0 means it's not configured to run.
|
- The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run.
|
||||||
- The second variable: 0 means it's configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0.
|
- The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**.
|
||||||
- **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard.
|
- **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard.
|
||||||
- **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\]
|
- **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\]
|
||||||
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
|
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
|
||||||
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
|
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
|
||||||
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0.
|
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**.
|
||||||
|
- You can use Windows Powershell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated Powershell window and run the following command:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
|
||||||
|
```
|
||||||
|
|
||||||
|
This command generates the following output:
|
||||||
|
- **0**: Windows Defender Credential Guard is disabled (not running)
|
||||||
|
- **1**: Windows Defender Credential Guard is enabled (running)
|
||||||
|
> [!NOTE]
|
||||||
|
> Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running.
|
||||||
|
|
||||||
## Disable Windows Defender Credential Guard
|
## Disable Windows Defender Credential Guard
|
||||||
|
|
||||||
@ -221,7 +235,7 @@ You can also disable Windows Defender Credential Guard by using the [HVCI and Wi
|
|||||||
```
|
```
|
||||||
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||||
```
|
```
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||||
> This is a known issue.
|
> This is a known issue.
|
||||||
|
|
||||||
|
|||||||
@ -35,16 +35,16 @@ We encourage all software vendors and developers to read about [how Microsoft id
|
|||||||
|
|
||||||
## Why is Microsoft asking for a copy of my program?
|
## Why is Microsoft asking for a copy of my program?
|
||||||
|
|
||||||
This can help us with our analysis. Participants of the Microsoft Active Protection Service (MAPS) may occasionally receive these requests. The requests will stop once our systems have received and processed the file.
|
This can help us with our analysis. Participants of the [Microsoft Active Protection Service (MAPS)](https://www.microsoft.com/msrc/mapp) may occasionally receive these requests. The requests will stop once our systems have received and processed the file.
|
||||||
|
|
||||||
## Why does Microsoft classify my installer as a software bundler?
|
## Why does Microsoft classify my installer as a software bundler?
|
||||||
|
|
||||||
It contains instructions to offer a program classified as unwanted software. You can review the criteria we use to check applications for behaviors that are considered unwanted.
|
It contains instructions to offer a program classified as unwanted software. You can review the [criteria](criteria.md) we use to check applications for behaviors that are considered unwanted.
|
||||||
|
|
||||||
## Why is the Windows Firewall blocking my program?
|
## Why is the Windows Defender Firewall blocking my program?
|
||||||
|
|
||||||
This is not related to Microsoft Defender Antivirus and other Microsoft antimalware. You can find out more about Windows Firewall from the Microsoft Developer Network.
|
This is not related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security).
|
||||||
|
|
||||||
## Why does the Windows Defender SmartScreen say my program is not commonly downloaded?
|
## Why does the Microsoft Defender SmartScreen say my program is not commonly downloaded?
|
||||||
|
|
||||||
This is not related to Microsoft Defender Antivirus and other Microsoft antimalware. You can find out more from the [SmartScreen website.](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)
|
This is not related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)
|
||||||
|
|||||||
@ -27,7 +27,7 @@ manager: dansimp
|
|||||||
Microsoft Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. But what happens when another antivirus/antimalware solution is used? It depends on whether you're using [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) together with your antivirus protection.
|
Microsoft Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. But what happens when another antivirus/antimalware solution is used? It depends on whether you're using [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) together with your antivirus protection.
|
||||||
- If your organization's endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender ATP is not used, then Microsoft Defender Antivirus automatically goes into disabled mode.
|
- If your organization's endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender ATP is not used, then Microsoft Defender Antivirus automatically goes into disabled mode.
|
||||||
- If your organization is using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) together with a non-Microsoft antivirus/antimalware solution, then Microsoft Defender Antivirus automatically goes into passive mode. (Real-time protection and threats are not remediated by Microsoft Defender Antivirus.)
|
- If your organization is using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) together with a non-Microsoft antivirus/antimalware solution, then Microsoft Defender Antivirus automatically goes into passive mode. (Real-time protection and threats are not remediated by Microsoft Defender Antivirus.)
|
||||||
- If your organization is using Microsoft Defender ATP together with a non-Microsoft antivirus/antimalware solution, and you have [EDR in block mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/shadow-protection) (currently in private preview) enabled, then Microsoft Defender Antivirus runs in the background and blocks/remediates malicious items that are detected, such as during a post-breach attack.
|
- If your organization is using Microsoft Defender ATP together with a non-Microsoft antivirus/antimalware solution, and you have [EDR in block mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode) (currently in private preview) enabled, then Microsoft Defender Antivirus runs in the background and blocks/remediates malicious items that are detected, such as during a post-breach attack.
|
||||||
|
|
||||||
## Antivirus and Microsoft Defender ATP
|
## Antivirus and Microsoft Defender ATP
|
||||||
|
|
||||||
|
|||||||
@ -29,8 +29,8 @@ Directory enables enforcing Device compliance and Conditional Access policies
|
|||||||
based on device risk levels. Microsoft Defender ATP is a Mobile Threat Defense
|
based on device risk levels. Microsoft Defender ATP is a Mobile Threat Defense
|
||||||
(MTD) solution that you can deploy to leverage this capability via Intune.
|
(MTD) solution that you can deploy to leverage this capability via Intune.
|
||||||
|
|
||||||
For more information on how to setup Microsoft Defender ATP for Android and Conditional Access, see [Microsoft Defender ATP and
|
For more information about how to set up Microsoft Defender ATP for Android and Conditional Access, see [Microsoft Defender ATP and
|
||||||
Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#configure-web-protection-on-devices-that-run-android).
|
Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection).
|
||||||
|
|
||||||
|
|
||||||
## Configure custom indicators
|
## Configure custom indicators
|
||||||
|
|||||||
@ -31,7 +31,7 @@ Attack surface reduction rules target software behaviors that are often abused b
|
|||||||
- Running obfuscated or otherwise suspicious scripts
|
- Running obfuscated or otherwise suspicious scripts
|
||||||
- Performing behaviors that apps don't usually initiate during normal day-to-day work
|
- Performing behaviors that apps don't usually initiate during normal day-to-day work
|
||||||
|
|
||||||
These behaviors are sometimes seen in legitimate applications; however, they are considered risky because they are commonly abused by malware. Attack surface reduction rules can constrain these kinds of risky behaviors and help keep your organization safe.
|
Such behaviors are sometimes seen in legitimate applications; however, they are considered risky because they are commonly abused by malware. Attack surface reduction rules can constrain these kinds of risky behaviors and help keep your organization safe.
|
||||||
|
|
||||||
Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity.
|
Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity.
|
||||||
|
|
||||||
@ -96,7 +96,7 @@ The following sections describe each of the 15 attack surface reduction rules. T
|
|||||||
|[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
|[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
|[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Not supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||||
@ -191,9 +191,6 @@ This rule prevents scripts from launching potentially malicious downloaded conte
|
|||||||
|
|
||||||
Although not common, line-of-business applications sometimes use scripts to download and launch installers.
|
Although not common, line-of-business applications sometimes use scripts to download and launch installers.
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> File and folder exclusions don't apply to this attack surface reduction rule.
|
|
||||||
|
|
||||||
This rule was introduced in:
|
This rule was introduced in:
|
||||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||||
@ -385,6 +382,9 @@ GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c`
|
|||||||
|
|
||||||
This rule prevents malware from abusing WMI to attain persistence on a device.
|
This rule prevents malware from abusing WMI to attain persistence on a device.
|
||||||
|
|
||||||
|
> [!IMPORTANT]
|
||||||
|
> File and folder exclusions don't apply to this attack surface reduction rule.
|
||||||
|
|
||||||
Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
|
Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
|
||||||
|
|
||||||
This rule was introduced in:
|
This rule was introduced in:
|
||||||
|
|||||||
@ -29,7 +29,7 @@ ms.collection:
|
|||||||
When [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) in block mode is enabled, Microsoft Defender ATP leverages behavioral blocking and containment capabilities by blocking malicious artifacts or behaviors that are observed through post-breach protection. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.
|
When [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) in block mode is enabled, Microsoft Defender ATP leverages behavioral blocking and containment capabilities by blocking malicious artifacts or behaviors that are observed through post-breach protection. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> EDR in block mode is currently in preview. To get the best protection, make sure to **[deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
> EDR in block mode is currently in private preview. To get the best protection, make sure to **[deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
||||||
|
|
||||||
## What happens when something is detected?
|
## What happens when something is detected?
|
||||||
|
|
||||||
|
|||||||
@ -60,19 +60,21 @@ For more information about disabling local list merging, see [Prevent or allow u
|
|||||||
## Intune
|
## Intune
|
||||||
|
|
||||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
|
||||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
|
||||||
|
|
||||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Enable**.
|
|
||||||
1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.
|
|
||||||
|
|
||||||
|
2. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||||
|
|
||||||
|
3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. <br/>  <br/>
|
||||||
|
|
||||||
|
4. Click **Configure** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Enable**.
|
||||||
|
|
||||||
|
5. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.<br/> <br/>
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.
|
> Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.
|
||||||
|
|
||||||
1. Click **OK** to save each open blade and click **Create**.
|
6. Click **OK** to save each open blade and click **Create**.
|
||||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
|
||||||
|
7. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||||
|
|
||||||
## MDM
|
## MDM
|
||||||
|
|
||||||
@ -81,12 +83,17 @@ Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](htt
|
|||||||
## Microsoft Endpoint Configuration Manager
|
## Microsoft Endpoint Configuration Manager
|
||||||
|
|
||||||
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
|
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
|
||||||
|
|
||||||
2. Click **Home** > **Create Exploit Guard Policy**.
|
2. Click **Home** > **Create Exploit Guard Policy**.
|
||||||
|
|
||||||
3. Enter a name and a description, click **Controlled folder access**, and click **Next**.
|
3. Enter a name and a description, click **Controlled folder access**, and click **Next**.
|
||||||
|
|
||||||
4. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**.
|
4. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**.
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.
|
> Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.
|
||||||
|
|
||||||
5. Review the settings and click **Next** to create the policy.
|
5. Review the settings and click **Next** to create the policy.
|
||||||
|
|
||||||
6. After the policy is created, click **Close**.
|
6. After the policy is created, click **Close**.
|
||||||
|
|
||||||
## Group Policy
|
## Group Policy
|
||||||
|
|||||||
@ -108,13 +108,18 @@ The result will be that DEP will be enabled for *test.exe*. DEP will not be enab
|
|||||||
## Intune
|
## Intune
|
||||||
|
|
||||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||||
|
|
||||||
2. Click **Device configuration** > **Profiles** > **Create profile**.
|
2. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||||
3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
|
||||||
|
3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.<br/>
|
||||||
|
<br/>
|
||||||
|
|
||||||
4. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**.
|
4. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**.
|
||||||
5. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:
|
|
||||||
|
5. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:<br/><br/>
|
||||||
|
|
||||||
6. Click **OK** to save each open blade and click **Create**.
|
6. Click **OK** to save each open blade and click **Create**.
|
||||||
|
|
||||||
7. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
7. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||||
|
|
||||||
## MDM
|
## MDM
|
||||||
@ -124,19 +129,26 @@ Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](htt
|
|||||||
## Microsoft Endpoint Configuration Manager
|
## Microsoft Endpoint Configuration Manager
|
||||||
|
|
||||||
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
|
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
|
||||||
1. Click **Home** > **Create Exploit Guard Policy**.
|
|
||||||
1. Enter a name and a description, click **Exploit protection**, and click **Next**.
|
2. Click **Home** > **Create Exploit Guard Policy**.
|
||||||
1. Browse to the location of the exploit protection XML file and click **Next**.
|
|
||||||
1. Review the settings and click **Next** to create the policy.
|
3. Enter a name and a description, click **Exploit protection**, and click **Next**.
|
||||||
1. After the policy is created, click **Close**.
|
|
||||||
|
4. Browse to the location of the exploit protection XML file and click **Next**.
|
||||||
|
|
||||||
|
5. Review the settings and click **Next** to create the policy.
|
||||||
|
|
||||||
|
6. After the policy is created, click **Close**.
|
||||||
|
|
||||||
## Group Policy
|
## Group Policy
|
||||||
|
|
||||||
1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||||
|
|
||||||
1. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||||
2. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
|
|
||||||
3. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**.
|
3. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
|
||||||
|
|
||||||
|
4. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**.
|
||||||
|
|
||||||
## PowerShell
|
## PowerShell
|
||||||
|
|
||||||
|
|||||||
Binary file not shown.
|
After Width: | Height: | Size: 51 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 102 KiB |
@ -29,12 +29,20 @@ Managing incidents is an important part of every cybersecurity operation. You ca
|
|||||||
Selecting an incident from the **Incidents queue** brings up the **Incident management pane** where you can open the incident page for details.
|
Selecting an incident from the **Incidents queue** brings up the **Incident management pane** where you can open the incident page for details.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You can assign incidents to yourself, change the status and classification, rename, or comment on them to keep track of their progress.
|
You can assign incidents to yourself, change the status and classification, rename, or comment on them to keep track of their progress.
|
||||||
|
|
||||||
|
> [!TIP]
|
||||||
|
> For additional visibility at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. This allows you to quickly understand the scope of the incident.
|
||||||
|
>
|
||||||
|
> For example: *Multi-stage incident on multiple endpoints reported by multiple sources.*
|
||||||
|
>
|
||||||
|
> Incidents that existed prior the rollout of automatic incident naming will not have their name changed.
|
||||||
|
>
|
||||||
|
> Learn more about [turning on preview features](preview.md#turn-on-preview-features).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Assign incidents
|
## Assign incidents
|
||||||
If an incident has not been assigned yet, you can select **Assign to me** to assign the incident to yourself. Doing so assumes ownership of not just the incident, but also all the alerts associated with it.
|
If an incident has not been assigned yet, you can select **Assign to me** to assign the incident to yourself. Doing so assumes ownership of not just the incident, but also all the alerts associated with it.
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: Threat & Vulnerability Management
|
title: Threat and vulnerability management
|
||||||
description: This new capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
description: This new capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
||||||
keywords: threat & vulnerability management, threat and vulnerability management, MDATP TVM, MDATP-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, microsoft defender atp, microsoft defender atp, endpoint vulnerabilities, next generation
|
keywords: threat & vulnerability management, threat and vulnerability management, MDATP TVM, MDATP-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, microsoft defender atp, microsoft defender atp, endpoint vulnerabilities, next generation
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
|
|
||||||
# Threat & Vulnerability Management
|
# Threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -25,17 +25,17 @@ ms.topic: conceptual
|
|||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||||
|
|
||||||
Effectively identifying, assessing, and remediating endpoint weaknesses is pivotal in running a healthy security program and reducing organizational risk. Threat & Vulnerability Management serves as an infrastructure for reducing organizational exposure, hardening endpoint surface area, and increasing organizational resilience.
|
Effectively identifying, assessing, and remediating endpoint weaknesses is pivotal in running a healthy security program and reducing organizational risk. Threat and vulnerability management serves as an infrastructure for reducing organizational exposure, hardening endpoint surface area, and increasing organizational resilience.
|
||||||
|
|
||||||
It helps organizations discover vulnerabilities and misconfigurations in real-time, based on sensors, without the need of agents or periodic scans. It prioritizes vulnerabilities based on the threat landscape, detections in your organization, sensitive information on vulnerable devices, and business context.
|
It helps organizations discover vulnerabilities and misconfigurations in real-time, based on sensors, without the need of agents or periodic scans. It prioritizes vulnerabilities based on the threat landscape, detections in your organization, sensitive information on vulnerable devices, and business context.
|
||||||
|
|
||||||
Watch this video for a quick overview of Threat & Vulnerability Management.
|
Watch this video for a quick overview of threat and vulnerability management.
|
||||||
|
|
||||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4mLsn]
|
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4mLsn]
|
||||||
|
|
||||||
## Next-generation capabilities
|
## Next-generation capabilities
|
||||||
|
|
||||||
Threat & Vulnerability Management is built-in, real-time, cloud-powered, fully integrated with Microsoft endpoint security stack, the Microsoft Intelligent Security Graph, and the application analytics knowledge base.
|
Threat and vulnerability management is built-in, real-time, cloud-powered, fully integrated with Microsoft endpoint security stack, the Microsoft Intelligent Security Graph, and the application analytics knowledge base.
|
||||||
|
|
||||||
It is the first solution in the industry to bridge the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft Microsoft Endpoint Configuration Manager.
|
It is the first solution in the industry to bridge the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft Microsoft Endpoint Configuration Manager.
|
||||||
|
|
||||||
@ -47,7 +47,7 @@ It provides the following solutions to frequently-cited gaps across security ope
|
|||||||
|
|
||||||
### Real-time discovery
|
### Real-time discovery
|
||||||
|
|
||||||
To discover endpoint vulnerabilities and misconfiguration, Threat & Vulnerability Management uses the same agentless built-in Microsoft Defender ATP sensors to reduce cumbersome network scans and IT overhead, and provides:
|
To discover endpoint vulnerabilities and misconfiguration, threat and vulnerability management uses the same agentless built-in Microsoft Defender ATP sensors to reduce cumbersome network scans and IT overhead, and provides:
|
||||||
|
|
||||||
- Real-time device inventory. Devices onboarded to Microsoft Defender ATP automatically report and push vulnerability and security configuration data to the dashboard.
|
- Real-time device inventory. Devices onboarded to Microsoft Defender ATP automatically report and push vulnerability and security configuration data to the dashboard.
|
||||||
- Visibility into software and vulnerabilities. Optics into the organization's software inventory, and software changes like installations, uninstalls, and patches. Newly discovered vulnerabilities are reported with actionable mitigation recommendations for 1st and 3rd party applications.
|
- Visibility into software and vulnerabilities. Optics into the organization's software inventory, and software changes like installations, uninstalls, and patches. Newly discovered vulnerabilities are reported with actionable mitigation recommendations for 1st and 3rd party applications.
|
||||||
@ -56,20 +56,26 @@ To discover endpoint vulnerabilities and misconfiguration, Threat & Vulnerabilit
|
|||||||
|
|
||||||
### Intelligence-driven prioritization
|
### Intelligence-driven prioritization
|
||||||
|
|
||||||
Threat & Vulnerability Management helps customers prioritize and focus on those weaknesses that pose the most urgent and the highest risk to the organization. Rather than using static prioritization by severity scores, Threat & Vulnerability Management in Microsoft Defender ATP highlights the most critical weaknesses that need attention by fusing its security recommendations with dynamic threat and business context:
|
Threat and vulnerability management helps customers prioritize and focus on those weaknesses that pose the most urgent and the highest risk to the organization. Rather than using static prioritization by severity scores, threat and vulnerability management in Microsoft Defender ATP highlights the most critical weaknesses that need attention by fusing its security recommendations with dynamic threat and business context:
|
||||||
|
|
||||||
- Exposing emerging attacks in the wild. Through its advanced cyber data and threat analytics platform, Threat & Vulnerability Management dynamically aligns the prioritization of its security recommendations to focus on vulnerabilities that are currently being exploited in the wild and emerging threats that pose the highest risk.
|
- Exposing emerging attacks in the wild. Through its advanced cyber data and threat analytics platform, threat and vulnerability management dynamically aligns the prioritization of its security recommendations to focus on vulnerabilities that are currently being exploited in the wild and emerging threats that pose the highest risk.
|
||||||
- Pinpointing active breaches. Microsoft Defender ATP correlates Threat & Vulnerability Management and EDR insights to provide the unique ability to prioritize vulnerabilities that are currently being exploited in an active breach within the organization.
|
- Pinpointing active breaches. Microsoft Defender ATP correlates threat and vulnerability management and EDR insights to provide the unique ability to prioritize vulnerabilities that are currently being exploited in an active breach within the organization.
|
||||||
- Protecting high-value assets. Microsoft Defender ATP's integration with Azure Information Protection allows Threat & Vulnerability Management to identify the exposed devices with business-critical applications, confidential data, or high-value users.
|
- Protecting high-value assets. Microsoft Defender ATP's integration with Azure Information Protection allows threat and vulnerability management to identify the exposed devices with business-critical applications, confidential data, or high-value users.
|
||||||
|
|
||||||
### Seamless remediation
|
### Seamless remediation
|
||||||
|
|
||||||
Microsoft Defender ATP's Threat & Vulnerability Management allows security administrators and IT administrators to collaborate seamlessly to remediate issues.
|
Microsoft Defender ATP's threat and vulnerability management capability allows security administrators and IT administrators to collaborate seamlessly to remediate issues.
|
||||||
|
|
||||||
- Remediation requests to IT. Through Microsoft Defender ATP's integration with Microsoft Intune and Microsoft Endpoint Configuration Manager, security administrators can create a remediation task in Microsoft Intune from the Security recommendation pages. We plan to expand this capability to other IT security management platforms.
|
- Remediation requests to IT. Through Microsoft Defender ATP's integration with Microsoft Intune and Microsoft Endpoint Configuration Manager, security administrators can create a remediation task in Microsoft Intune from the Security recommendation pages. We plan to expand this capability to other IT security management platforms.
|
||||||
- Alternate mitigations. Threat & Vulnerability Management provides insights on additional mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
|
- Alternate mitigations. Threat and vulnerability management provides insights on additional mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
|
||||||
- Real-time remediation status. Microsoft Defender ATP provides real-time monitoring of the status and progress of remediation activities across the organization.
|
- Real-time remediation status. Microsoft Defender ATP provides real-time monitoring of the status and progress of remediation activities across the organization.
|
||||||
|
|
||||||
|
## Reduce organizational risk with threat and vulnerability management
|
||||||
|
|
||||||
|
Watch this video for a comprehensive walk-through of threat and vulnerability management.
|
||||||
|
|
||||||
|
>[!VIDEO https://aka.ms/MDATP-TVM-Interactive-Guide]
|
||||||
|
|
||||||
## Before you begin
|
## Before you begin
|
||||||
|
|
||||||
Ensure that your devices:
|
Ensure that your devices:
|
||||||
@ -78,7 +84,7 @@ Ensure that your devices:
|
|||||||
- Run with Windows 10 1709 (Fall Creators Update) or later
|
- Run with Windows 10 1709 (Fall Creators Update) or later
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Threat & Vulnerability Management can also scan devices that run on Windows 7 and Windows Server 2019 operating systems and detects vulnerabilities addressed in patch Tuesday.
|
>Threat and vulnerability management can also scan devices that run on Windows 7 and Windows Server 2019 operating systems and detects vulnerabilities addressed in patch Tuesday.
|
||||||
|
|
||||||
- Have the following mandatory updates installed and deployed in your network to boost your vulnerability assessment detection rates:
|
- Have the following mandatory updates installed and deployed in your network to boost your vulnerability assessment detection rates:
|
||||||
|
|
||||||
@ -91,11 +97,11 @@ Ensure that your devices:
|
|||||||
|
|
||||||
- Are onboarded to Microsoft Intune and Microsoft Endpoint Configuration Manager. If you are using Configuration Manager, update your console to the latest version.
|
- Are onboarded to Microsoft Intune and Microsoft Endpoint Configuration Manager. If you are using Configuration Manager, update your console to the latest version.
|
||||||
- Have at least one security recommendation that can be viewed in the device page
|
- Have at least one security recommendation that can be viewed in the device page
|
||||||
- Are tagged or marked as co-managed
|
- Are tagged or marked as co-managed
|
||||||
|
|
||||||
## APIs
|
## APIs
|
||||||
|
|
||||||
Run Threat & Vulnerability Management-related API calls such as get your organization's threat exposure score or device secure score, software and device vulnerability inventory, software version distribution, device vulnerability information, security recommendation information. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615).
|
Run threat and vulnerability management-related API calls such as get your organization's threat exposure score or device secure score, software and device vulnerability inventory, software version distribution, device vulnerability information, security recommendation information. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615).
|
||||||
See the following topics for related APIs:
|
See the following topics for related APIs:
|
||||||
|
|
||||||
- [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
- [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||||
@ -108,7 +114,7 @@ See the following topics for related APIs:
|
|||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -118,5 +124,5 @@ See the following topics for related APIs:
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
- [BLOG: Microsoft's Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time](https://www.microsoft.com/security/blog/2019/07/02/microsofts-threat-vulnerability-management-now-helps-thousands-of-customers-to-discover-prioritize-and-remediate-vulnerabilities-in-real-time/)
|
- [BLOG: Microsoft's Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time](https://www.microsoft.com/security/blog/2019/07/02/microsofts-threat-vulnerability-management-now-helps-thousands-of-customers-to-discover-prioritize-and-remediate-vulnerabilities-in-real-time/)
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: Event timeline
|
title: Event timeline in threat and vulnerability management
|
||||||
description: Event timeline is a "risk news feed" which will help you interpret how risk is introduced into the organization and which mitigations happened to reduce it.
|
description: Event timeline is a "risk news feed" which will help you interpret how risk is introduced into the organization and which mitigations happened to reduce it.
|
||||||
keywords: event timeline, mdatp event timeline, mdatp tvm event timeline, threat and vulnerability management, Microsoft Defender Advanced Threat Protection
|
keywords: event timeline, mdatp event timeline, mdatp tvm event timeline, threat and vulnerability management, Microsoft Defender Advanced Threat Protection
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Event timeline
|
# Event timeline - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||||
@ -33,23 +33,23 @@ Event timeline also tells the story of your [exposure score](tvm-exposure-score.
|
|||||||
|
|
||||||
You can access Event timeline mainly through three ways:
|
You can access Event timeline mainly through three ways:
|
||||||
|
|
||||||
- In the Threat & Vulnerability Management navigation menu in the Microsoft Defender Security Center
|
- In the threat and vulnerability management navigation menu in the Microsoft Defender Security Center
|
||||||
- Top events card in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md). The highest impact events (for example, affect the most machines or critical vulnerabilities)
|
- Top events card in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md). The highest impact events (for example, affect the most machines or critical vulnerabilities)
|
||||||
- Hovering over the Exposure Score graph in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- Hovering over the Exposure Score graph in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
|
|
||||||
### Navigation menu
|
### Navigation menu
|
||||||
|
|
||||||
Go to the Threat & Vulnerability Management navigation menu and select **Event timeline** to view impactful events.
|
Go to the threat and vulnerability management navigation menu and select **Event timeline** to view impactful events.
|
||||||
|
|
||||||
### Top events card
|
### Top events card
|
||||||
|
|
||||||
In the Threat & Vulnerability Management dashboard, the "Top events" card displays the three most impactful events in the last 7 days. Select **Show more** to go to the Event timeline page.
|
In the Tthreat and vulnerability management dashboard, the "Top events" card displays the three most impactful events in the last 7 days. Select **Show more** to go to the Event timeline page.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Exposure score graph
|
### Exposure score graph
|
||||||
|
|
||||||
In the Threat & Vulnerability Management dashboard, hover over the Exposure score graph to view top events from that day that impacted your machines. If there are no events, then none will be shown.
|
In the threat and vulnerability management dashboard, hover over the Exposure score graph to view top events from that day that impacted your machines. If there are no events, then none will be shown.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -118,9 +118,9 @@ A full page will appear with all the details of a specific software, including a
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -130,6 +130,6 @@ A full page will appear with all the details of a specific software, including a
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
- [Advanced hunting overview](overview-hunting.md)
|
- [Advanced hunting overview](overview-hunting.md)
|
||||||
- [All advanced hunting tables](advanced-hunting-reference.md)
|
- [All advanced hunting tables](advanced-hunting-reference.md)
|
||||||
|
|||||||
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Threat & Vulnerability Management scenarios
|
title: Scenarios - threat and vulnerability management
|
||||||
description: Learn how Threat & Vulnerability Management can be used to help security admins, IT admins, and SecOps collaborate in defending against security threats.
|
description: Learn how threat and vulnerability management can be used to help security admins, IT admins, and SecOps collaborate in defending against security threats.
|
||||||
keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase Microsoft Secure Score for Devices, increase threat & vulnerability Microsoft Secure Score for Devices, Microsoft Secure Score for Devices, exposure score, security controls
|
keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase Microsoft Secure Score for Devices, increase threat & vulnerability Microsoft Secure Score for Devices, Microsoft Secure Score for Devices, exposure score, security controls
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Threat & Vulnerability Management scenarios
|
# Scenarios - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -81,9 +81,9 @@ Examples of devices that should be marked as high value:
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -92,6 +92,6 @@ Examples of devices that should be marked as high value:
|
|||||||
- [Weaknesses](tvm-weaknesses.md)
|
- [Weaknesses](tvm-weaknesses.md)
|
||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
- [Advanced hunting overview](overview-hunting.md)
|
- [Advanced hunting overview](overview-hunting.md)
|
||||||
- [All advanced hunting tables](advanced-hunting-reference.md)
|
- [All advanced hunting tables](advanced-hunting-reference.md)
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Threat & Vulnerability Management dashboard insights
|
title: Threat and vulnerability management dashboard insights
|
||||||
description: The Threat & Vulnerability Management dashboard can help SecOps and security admins address cybersecurity threats and build their organization's security resilience.
|
description: The threat and vulnerability management dashboard can help SecOps and security admins address cybersecurity threats and build their organization's security resilience.
|
||||||
keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score
|
keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, threat and vulnerability management, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Threat & Vulnerability Management dashboard insights
|
# Threat and vulnerability management dashboard insights
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -24,13 +24,13 @@ ms.topic: conceptual
|
|||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||||
|
|
||||||
Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including:
|
Threat and vulnerability management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including:
|
||||||
|
|
||||||
- Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities
|
- Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities
|
||||||
- Invaluable device vulnerability context during incident investigations
|
- Invaluable device vulnerability context during incident investigations
|
||||||
- Built-in remediation processes through Microsoft Intune and Microsoft Endpoint Configuration Manager
|
- Built-in remediation processes through Microsoft Intune and Microsoft Endpoint Configuration Manager
|
||||||
|
|
||||||
You can use the Threat & Vulnerability Management capability in [Microsoft Defender Security Center](https://securitycenter.windows.com/) to:
|
You can use the threat and vulnerability management capability in [Microsoft Defender Security Center](https://securitycenter.windows.com/) to:
|
||||||
|
|
||||||
- View exposure and Microsoft Secure Score for Devices side-by-side with top security recommendations, software vulnerability, remediation activities, and exposed devices
|
- View exposure and Microsoft Secure Score for Devices side-by-side with top security recommendations, software vulnerability, remediation activities, and exposed devices
|
||||||
- Correlate EDR insights with endpoint vulnerabilities and process them
|
- Correlate EDR insights with endpoint vulnerabilities and process them
|
||||||
@ -38,19 +38,19 @@ You can use the Threat & Vulnerability Management capability in [Microsoft Defen
|
|||||||
- Select exception options and track active exceptions
|
- Select exception options and track active exceptions
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Devices that are not active in the last 30 days are not factored in on the data that reflects your organization's Threat & Vulnerability Management exposure score and Microsoft Secure Score for Devices.
|
> Devices that are not active in the last 30 days are not factored in on the data that reflects your organization's threat and vulnerability management exposure score and Microsoft Secure Score for Devices.
|
||||||
|
|
||||||
Watch this video for a quick overview of what is in the Threat & Vulnerability Management dashboard.
|
Watch this video for a quick overview of what is in the threat and vulnerability management dashboard.
|
||||||
|
|
||||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r1nv]
|
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r1nv]
|
||||||
|
|
||||||
## Threat & Vulnerability Management in Microsoft Defender Security Center
|
## Threat and vulnerability management in Microsoft Defender Security Center
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You can navigate through the portal using the menu options available in all sections. Refer to the following tables for a description of each section.
|
You can navigate through the portal using the menu options available in all sections. Refer to the following tables for a description of each section.
|
||||||
|
|
||||||
## Threat & Vulnerability Management navigation pane
|
## Threat and vulnerability management navigation pane
|
||||||
|
|
||||||
Area | Description
|
Area | Description
|
||||||
:---|:---
|
:---|:---
|
||||||
@ -60,11 +60,11 @@ Area | Description
|
|||||||
[**Software inventory**](tvm-software-inventory.md) | See the list of software, versions, weaknesses, whether there's an exploit found on the software, whether the software or software version has reached end-of-support, prevalence in the organization, how many were installed, how many exposed devices there are, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected device, version distribution details, and missing KBs or security updates.
|
[**Software inventory**](tvm-software-inventory.md) | See the list of software, versions, weaknesses, whether there's an exploit found on the software, whether the software or software version has reached end-of-support, prevalence in the organization, how many were installed, how many exposed devices there are, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected device, version distribution details, and missing KBs or security updates.
|
||||||
[**Weaknesses**](tvm-weaknesses.md) | See the list of common vulnerabilities and exposures, the severity, the common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed devices there are. You can select each item in the list to see a flyout panel with the vulnerability description and other details.
|
[**Weaknesses**](tvm-weaknesses.md) | See the list of common vulnerabilities and exposures, the severity, the common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed devices there are. You can select each item in the list to see a flyout panel with the vulnerability description and other details.
|
||||||
|
|
||||||
## Threat & Vulnerability Management dashboard
|
## Threat and vulnerability management dashboard
|
||||||
|
|
||||||
Area | Description
|
Area | Description
|
||||||
:---|:---
|
:---|:---
|
||||||
**Selected device groups (#/#)** | Filter the Threat & Vulnerability Management data you want to see in the dashboard and cards by device groups. What you select in the filter applies throughout the Threat & Vulnerability management pages.
|
**Selected device groups (#/#)** | Filter the threat and vulnerability management data you want to see in the dashboard and cards by device groups. What you select in the filter applies throughout the threat and vulnerability management pages.
|
||||||
[**Exposure score**](tvm-exposure-score.md) | See the current state of your organization's device exposure to threats and vulnerabilities. Several factors affect your organization's exposure score: weaknesses discovered in your devices, likelihood of your devices to be breached, value of the devices to your organization, and relevant alerts discovered with your devices. The goal is to lower the exposure score of your organization to be more secure. To reduce the score, you need to remediate the related security configuration issues listed in the security recommendations.
|
[**Exposure score**](tvm-exposure-score.md) | See the current state of your organization's device exposure to threats and vulnerabilities. Several factors affect your organization's exposure score: weaknesses discovered in your devices, likelihood of your devices to be breached, value of the devices to your organization, and relevant alerts discovered with your devices. The goal is to lower the exposure score of your organization to be more secure. To reduce the score, you need to remediate the related security configuration issues listed in the security recommendations.
|
||||||
[**Microsoft Secure Score for Devices**](tvm-microsoft-secure-score-devices.md) | See the security posture of the operating system, applications, network, accounts and security controls of your organization. The goal is to remediate the related security configuration issues to increase your score for devices. Selecting the bars will take you to the **Security recommendation** page.
|
[**Microsoft Secure Score for Devices**](tvm-microsoft-secure-score-devices.md) | See the security posture of the operating system, applications, network, accounts and security controls of your organization. The goal is to remediate the related security configuration issues to increase your score for devices. Selecting the bars will take you to the **Security recommendation** page.
|
||||||
**Device exposure distribution** | See how many devices are exposed based on their exposure level. Select a section in the doughnut chart to go to the **Devices list** page and view the affected device names, exposure level, risk level, and other details such as domain, operating system platform, its health state, when it was last seen, and its tags.
|
**Device exposure distribution** | See how many devices are exposed based on their exposure level. Select a section in the doughnut chart to go to the **Devices list** page and view the affected device names, exposure level, risk level, and other details such as domain, operating system platform, its health state, when it was last seen, and its tags.
|
||||||
@ -77,7 +77,7 @@ See [Microsoft Defender ATP icons](portal-overview.md#microsoft-defender-atp-ico
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
@ -88,4 +88,4 @@ See [Microsoft Defender ATP icons](portal-overview.md#microsoft-defender-atp-ico
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
|
|||||||
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Exposure score
|
title: Exposure score in threat and vulnerability management
|
||||||
description: The Microsoft Defender ATP exposure score reflects how vulnerable your organization is to cybersecurity threats.
|
description: The threat and vulnerability management exposure score reflects how vulnerable your organization is to cybersecurity threats.
|
||||||
keywords: exposure score, mdatp exposure score, mdatp tvm exposure score, organization exposure score, tvm organization exposure score, threat and vulnerability management, Microsoft Defender Advanced Threat Protection
|
keywords: exposure score, mdatp exposure score, mdatp tvm exposure score, organization exposure score, tvm organization exposure score, threat and vulnerability management, Microsoft Defender Advanced Threat Protection
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Exposure score
|
# Exposure score - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -24,7 +24,7 @@ ms.topic: conceptual
|
|||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||||
|
|
||||||
Your Exposure score is visible in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) of the Microsoft Defender Security Center. It reflects how vulnerable your organization is to cybersecurity threats. Low exposure score means your devices are less vulnerable from exploitation.
|
Your exposure score is visible in the [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) of the Microsoft Defender Security Center. It reflects how vulnerable your organization is to cybersecurity threats. Low exposure score means your devices are less vulnerable from exploitation.
|
||||||
|
|
||||||
- Quickly understand and identify high-level takeaways about the state of security in your organization.
|
- Quickly understand and identify high-level takeaways about the state of security in your organization.
|
||||||
- Detect and respond to areas that require investigation or action to improve the current state.
|
- Detect and respond to areas that require investigation or action to improve the current state.
|
||||||
@ -36,7 +36,7 @@ The card gives you a high-level view of your exposure score trend over time. Any
|
|||||||
|
|
||||||
## How it works
|
## How it works
|
||||||
|
|
||||||
Threat & Vulnerability Management introduces a new exposure score metric, which visually represents how exposed your devices are to imminent threats.
|
Threat and vulnerability management introduces a new exposure score metric, which visually represents how exposed your devices are to imminent threats.
|
||||||
|
|
||||||
The exposure score is continuously calculated on each device in the organization and influenced by the following factors:
|
The exposure score is continuously calculated on each device in the organization and influenced by the following factors:
|
||||||
|
|
||||||
@ -55,13 +55,13 @@ You can remediate the issues based on prioritized [security recommendations](tvm
|
|||||||
|
|
||||||
## Reduce your threat and vulnerability exposure
|
## Reduce your threat and vulnerability exposure
|
||||||
|
|
||||||
Lower your threat and vulnerability exposure by remediating [security recommendations](tvm-security-recommendation.md). Make the most impact to your exposure score by remediating the top security recommendations, which can be viewed in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md).
|
Lower your threat and vulnerability exposure by remediating [security recommendations](tvm-security-recommendation.md). Make the most impact to your exposure score by remediating the top security recommendations, which can be viewed in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md).
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
- [Remediation and exception](tvm-remediation.md)
|
- [Remediation and exception](tvm-remediation.md)
|
||||||
@ -70,4 +70,4 @@ Lower your threat and vulnerability exposure by remediating [security recommenda
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Overview of Microsoft Secure Score for Devices in Microsoft Defender Security Center
|
title: Overview of Microsoft Secure Score for Devices in Microsoft Defender Security Center
|
||||||
description: Your score for devices shows the collective security configuration state of your devices across application, operating system, network, accounts, and security controls
|
description: Your score for devices shows the collective security configuration state of your devices across application, operating system, network, accounts, and security controls
|
||||||
keywords: Microsoft Secure Score for Devices, mdatp Microsoft Secure Score for Devices, secure score, configuration score, security controls, improvement opportunities, security configuration score over time, security posture, baseline
|
keywords: Microsoft Secure Score for Devices, mdatp Microsoft Secure Score for Devices, secure score, configuration score, threat and vulnerability management, security controls, improvement opportunities, security configuration score over time, security posture, baseline
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -23,9 +23,9 @@ ms.topic: conceptual
|
|||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
> Configuration score is now part of Threat & Vulnerability Management as Microsoft Secure Score for Devices.
|
> Configuration score is now part of threat and vulnerability management as Microsoft Secure Score for Devices.
|
||||||
|
|
||||||
Your score for devices is visible in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) of the Microsoft Defender Security Center. A higher Microsoft Secure Score for Devices means your endpoints are more resilient from cybersecurity threat attacks. It reflects the collective security configuration state of your devices across the following categories:
|
Your score for devices is visible in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md) of the Microsoft Defender Security Center. A higher Microsoft Secure Score for Devices means your endpoints are more resilient from cybersecurity threat attacks. It reflects the collective security configuration state of your devices across the following categories:
|
||||||
|
|
||||||
- Application
|
- Application
|
||||||
- Operating system
|
- Operating system
|
||||||
@ -51,7 +51,7 @@ The data in the Microsoft Secure Score for Devices card is the product of meticu
|
|||||||
|
|
||||||
You can improve your security configuration when you remediate issues from the security recommendations list. As you do so, your Microsoft Secure Score for Devices improves, which means your organization becomes more resilient against cybersecurity threats and vulnerabilities.
|
You can improve your security configuration when you remediate issues from the security recommendations list. As you do so, your Microsoft Secure Score for Devices improves, which means your organization becomes more resilient against cybersecurity threats and vulnerabilities.
|
||||||
|
|
||||||
1. From the Microsoft Secure Score for Devices card in the Threat & Vulnerability Management dashboard, select the one of the categories to view the list of recommendations related to that category. It will take you to the [**Security recommendations**](tvm-security-recommendation.md) page. If you want to see all security recommendations, once you get to the Security recommendations page, clear the search field.
|
1. From the Microsoft Secure Score for Devices card in the threat and vulnerability management dashboard, select the one of the categories to view the list of recommendations related to that category. It will take you to the [**Security recommendations**](tvm-security-recommendation.md) page. If you want to see all security recommendations, once you get to the Security recommendations page, clear the search field.
|
||||||
|
|
||||||
2. Select an item on the list. The flyout panel will open with details related to the recommendation. Select **Remediation options**.
|
2. Select an item on the list. The flyout panel will open with details related to the recommendation. Select **Remediation options**.
|
||||||
|
|
||||||
@ -82,9 +82,9 @@ You can improve your security configuration when you remediate issues from the s
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
- [Remediation and exception](tvm-remediation.md)
|
- [Remediation and exception](tvm-remediation.md)
|
||||||
@ -92,4 +92,4 @@ You can improve your security configuration when you remediate issues from the s
|
|||||||
- [Weaknesses](tvm-weaknesses.md)
|
- [Weaknesses](tvm-weaknesses.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Remediation and exception
|
title: Remediation activities and exceptions - threat and vulnerability management
|
||||||
description: Remediate security weaknesses and fill exceptions by integrating Microsoft Intune and Microsoft Endpoint Configuration Manager.
|
description: Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in threat and vulnerability management.
|
||||||
keywords: microsoft defender atp tvm remediation, mdatp tvm, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm
|
keywords: microsoft defender atp tvm remediation, mdatp tvm, threat and vulnerability management, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Remediation activities and exceptions
|
# Remediation activities and exceptions - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||||
@ -34,22 +34,22 @@ Lower your organization's exposure from vulnerabilities and increase your securi
|
|||||||
|
|
||||||
You can access the Remediation page a few different ways:
|
You can access the Remediation page a few different ways:
|
||||||
|
|
||||||
- Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
- Threat and vulnerability management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
||||||
- Top remediation activities card in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- Top remediation activities card in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
|
|
||||||
### Navigation menu
|
### Navigation menu
|
||||||
|
|
||||||
Go to the Threat & Vulnerability Management navigation menu and select **Remediation** to open up the list of remediation activities and exceptions found in your organization.
|
Go to the threat and vulnerability management navigation menu and select **Remediation** to open up the list of remediation activities and exceptions found in your organization.
|
||||||
|
|
||||||
### Top remediation activities in the dashboard
|
### Top remediation activities in the dashboard
|
||||||
|
|
||||||
View **Top remediation activities** in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md). Select any of the entries to go to the **Remediation** page. You can mark the remediation activity as completed after the IT admin team remediates the task.
|
View **Top remediation activities** in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md). Select any of the entries to go to the **Remediation** page. You can mark the remediation activity as completed after the IT admin team remediates the task.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Remediation activities
|
## Remediation activities
|
||||||
|
|
||||||
When you [submit a remediation request](tvm-security-recommendation.md#request-remediation) from the [Security recommendations page](tvm-security-recommendation.md), it kicks-off a remediation activity. A security task is created which will be tracked in the Threat & Vulnerability Management **Remediation** page, and a remediation ticket is created in Microsoft Intune.
|
When you [submit a remediation request](tvm-security-recommendation.md#request-remediation) from the [Security recommendations page](tvm-security-recommendation.md), it kicks-off a remediation activity. A security task is created which will be tracked in the threat and vulnerability management **Remediation** page, and a remediation ticket is created in Microsoft Intune.
|
||||||
|
|
||||||
Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete.
|
Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete.
|
||||||
|
|
||||||
@ -95,9 +95,9 @@ Select **Show exceptions** at the bottom of the **Top security recommendations**
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -106,4 +106,4 @@ Select **Show exceptions** at the bottom of the **Top security recommendations**
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
|
|||||||
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Security recommendations
|
title: Security recommendations by threat and vulnerability management
|
||||||
description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value.
|
description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value, in threat and vulnerability management.
|
||||||
keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation
|
keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Security recommendations
|
# Security recommendations - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -44,8 +44,8 @@ Each device in the organization is scored based on three important factors to he
|
|||||||
|
|
||||||
Access the Security recommendations page a few different ways:
|
Access the Security recommendations page a few different ways:
|
||||||
|
|
||||||
- Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
- Threat and vulnerability management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
||||||
- Top security recommendations in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- Top security recommendations in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
|
|
||||||
View related security recommendations in the following places:
|
View related security recommendations in the following places:
|
||||||
|
|
||||||
@ -54,11 +54,11 @@ View related security recommendations in the following places:
|
|||||||
|
|
||||||
### Navigation menu
|
### Navigation menu
|
||||||
|
|
||||||
Go to the Threat & Vulnerability Management navigation menu and select **Security recommendations** to open the list of security recommendations for the threats and vulnerabilities found in your organization.
|
Go to the threat and vulnerability management navigation menu and select **Security recommendations** to open the list of security recommendations for the threats and vulnerabilities found in your organization.
|
||||||
|
|
||||||
### Top security recommendations in the Threat & Vulnerability Management dashboard
|
### Top security recommendations in the threat and vulnerability management dashboard
|
||||||
|
|
||||||
In a given day as a Security Administrator, you can take a look at the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) to see your [exposure score](tvm-exposure-score.md) side-by-side with your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). The goal is to **lower** your organization's exposure from vulnerabilities, and **increase** your organization's device security to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
In a given day as a Security Administrator, you can take a look at the [threat and vulnerability management dashboard](tvm-dashboard-insights.md) to see your [exposure score](tvm-exposure-score.md) side-by-side with your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). The goal is to **lower** your organization's exposure from vulnerabilities, and **increase** your organization's device security to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -94,7 +94,7 @@ From the flyout, you can do any of the following:
|
|||||||
- [**Exception options**](tvm-security-recommendation.md#file-for-exception) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet.
|
- [**Exception options**](tvm-security-recommendation.md#file-for-exception) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>When a change is made on a device, it may take up to two hours for the data to be reflected in the Microsoft Defender Security Center.
|
>When a change is made on a device, it typically takes two hours for the data to be reflected in the Microsoft Defender Security Center. However, it may sometimes take longer.
|
||||||
|
|
||||||
### Investigate changes in machine exposure or impact
|
### Investigate changes in machine exposure or impact
|
||||||
|
|
||||||
@ -106,7 +106,7 @@ If there is a large jump in the number of exposed machines, or a sharp increase
|
|||||||
|
|
||||||
## Request remediation
|
## Request remediation
|
||||||
|
|
||||||
The Threat & Vulnerability Management capability in Microsoft Defender ATP bridges the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune.
|
The threat and vulnerability management capability in Microsoft Defender ATP bridges the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune.
|
||||||
|
|
||||||
### Enable Microsoft Intune connection
|
### Enable Microsoft Intune connection
|
||||||
|
|
||||||
@ -118,7 +118,7 @@ See [Use Intune to remediate vulnerabilities identified by Microsoft Defender AT
|
|||||||
|
|
||||||
1. Select a security recommendation you would like to request remediation for, and then select **Remediation options**.
|
1. Select a security recommendation you would like to request remediation for, and then select **Remediation options**.
|
||||||
|
|
||||||
2. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within Threat & Vulnerability Management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices.
|
2. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices.
|
||||||
|
|
||||||
3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment.
|
3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment.
|
||||||
|
|
||||||
@ -144,15 +144,16 @@ When an exception is created for a recommendation, the recommendation is no long
|
|||||||
|
|
||||||
The following list details the justifications behind the exception options:
|
The following list details the justifications behind the exception options:
|
||||||
|
|
||||||
- **Compensating/alternate control** - A 3rd party control that mitigates this recommendation exists, for example, if Network Firewall - - prevents access to a device, third party antivirus
|
- **Third party control** - A third party product or software already addresses this recommendation
|
||||||
- **Productivity/business need** - Remediation will impact productivity or interrupt business-critical workflow
|
- Choosing this justification type will lower your exposure score and increase you secure score because your risk is reduced
|
||||||
- **Accept risk** - Poses low risk and/or implementing a compensating control is too expensive
|
- **Alternate mitigation** - An internal tool already addresses this recommendation
|
||||||
|
- Choosing this justification type will lower your exposure score and increase you secure score because your risk is reduced
|
||||||
|
- **Risk accepted** - Poses low risk and/or implementing the recommendation is too expensive
|
||||||
- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization
|
- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization
|
||||||
- **Other** - False positive
|
|
||||||
|
|
||||||
3. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created.
|
3. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created.
|
||||||
|
|
||||||
4. Navigate to the [**Remediation**](tvm-remediation.md) page under the **Threat & Vulnerability Management** menu and select the **Exceptions** tab to view all your exceptions (current and past).
|
4. Navigate to the [**Remediation**](tvm-remediation.md) page under the **Threat and vulnerability management** menu and select the **Exceptions** tab to view all your exceptions (current and past).
|
||||||
|
|
||||||
## Report inaccuracy
|
## Report inaccuracy
|
||||||
|
|
||||||
@ -166,7 +167,7 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
|
|||||||
|
|
||||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||||
|
|
||||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts.
|
||||||
|
|
||||||
## Find and remediate software or software versions which have reached end-of-support (EOS)
|
## Find and remediate software or software versions which have reached end-of-support (EOS)
|
||||||
|
|
||||||
@ -176,7 +177,7 @@ It is crucial for Security and IT Administrators to work together and ensure tha
|
|||||||
|
|
||||||
To find software or software versions which have reached end-of-support:
|
To find software or software versions which have reached end-of-support:
|
||||||
|
|
||||||
1. From the Threat & Vulnerability Management menu, navigate to **Security recommendations**.
|
1. From the threat and vulnerability management menu, navigate to **Security recommendations**.
|
||||||
2. Go to the **Filters** panel and look for the tags section. Select one or more of the EOS tag options. Then **Apply**.
|
2. Go to the **Filters** panel and look for the tags section. Select one or more of the EOS tag options. Then **Apply**.
|
||||||
|
|
||||||
|
|
||||||
@ -203,12 +204,11 @@ To view a list of version that have reached end of support, or end or support so
|
|||||||
|
|
||||||
After you have identified which software and software versions are vulnerable due to its end-of-support status, remediate them to lower your organizations exposure to vulnerabilities and advanced persistent threats.
|
After you have identified which software and software versions are vulnerable due to its end-of-support status, remediate them to lower your organizations exposure to vulnerabilities and advanced persistent threats.
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Remediation and exception](tvm-remediation.md)
|
- [Remediation and exception](tvm-remediation.md)
|
||||||
@ -217,4 +217,4 @@ After you have identified which software and software versions are vulnerable du
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Software inventory
|
title: Software inventory in threat and vulnerability management
|
||||||
description: Microsoft Defender ATP Threat & Vulnerability Management's software inventory page shows how many weaknesses and vulnerabilities have been detected in software.
|
description: Microsoft Defender ATP threat and vulnerability management's software inventory page shows how many weaknesses and vulnerabilities have been detected in software.
|
||||||
keywords: microsoft defender atp, microsoft defender atp software inventory, mdatp threat & vulnerability management, mdatp threat & vulnerability management software inventory, mdatp tvm software inventory, tvm software inventory
|
keywords: threat and vulnerability management, microsoft defender atp, microsoft defender atp software inventory, mdatp threat & vulnerability management, mdatp threat & vulnerability management software inventory, mdatp tvm software inventory, tvm software inventory
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -16,14 +16,14 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Software inventory
|
# Software inventory - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||||
|
|
||||||
Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the **Software inventory** page. The software inventory includes the name of the product or vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected with it.
|
The software inventory in threat and vulnerability management is a list of all the software in your organization, including details such as the name of the vendor, number of weaknesses, threats, and number of exposed devices.
|
||||||
|
|
||||||
## How it works
|
## How it works
|
||||||
|
|
||||||
@ -33,7 +33,7 @@ Since it is real-time, in a matter of minutes, you will see vulnerability inform
|
|||||||
|
|
||||||
## Navigate to the Software inventory page
|
## Navigate to the Software inventory page
|
||||||
|
|
||||||
You can access the Software inventory page by selecting **Software inventory** from the Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md).
|
You can access the Software inventory page by selecting **Software inventory** from the threat and vulnerability management navigation menu in the [Microsoft Defender Security Center](portal-overview.md).
|
||||||
|
|
||||||
View software on specific devices in the individual devices pages from the [devices list](machines-view-overview.md).
|
View software on specific devices in the individual devices pages from the [devices list](machines-view-overview.md).
|
||||||
|
|
||||||
@ -78,13 +78,13 @@ You can report a false positive when you see any vague, inaccurate version, inco
|
|||||||
1. Open the software flyout on the Software inventory page.
|
1. Open the software flyout on the Software inventory page.
|
||||||
2. Select **Report inaccuracy**.
|
2. Select **Report inaccuracy**.
|
||||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts.
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -93,4 +93,4 @@ You can report a false positive when you see any vague, inaccurate version, inco
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Threat & Vulnerability Management supported operating systems and platforms
|
title: Supported operating systems and platforms for threat and vulnerability management
|
||||||
description: Before you begin, ensure that you meet the operating system or platform requisites for Threat & Vulnerability Management so the activities in your all devices are properly accounted for.
|
description: Before you begin, ensure that you meet the operating system or platform requisites for threat and vulnerability management so the activities in your all devices are properly accounted for.
|
||||||
keywords: threat & vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score
|
keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
# Threat & Vulnerability Management supported operating systems and platforms
|
# Supported operating systems and platforms - threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -24,7 +24,7 @@ ms.topic: article
|
|||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||||
|
|
||||||
Before you begin, ensure that you meet the following operating system or platform requisites for Threat & Vulnerability Management so the activities in your devices are properly accounted for.
|
Before you begin, ensure that you meet the following operating system or platform requisites for threat and vulnerability management so the activities in your devices are properly accounted for.
|
||||||
|
|
||||||
Operating system | Security assessment support
|
Operating system | Security assessment support
|
||||||
:---|:---
|
:---|:---
|
||||||
@ -43,8 +43,8 @@ Some of the above prerequisites might be different from the [Minimum requirement
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -54,4 +54,4 @@ Some of the above prerequisites might be different from the [Minimum requirement
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
title: Weaknesses
|
title: Weaknesses found by threat and vulnerability management
|
||||||
description: Microsoft Defender Security Center offers a Weaknesses page, which lists vulnerabilities found in the infected software running in your organization.
|
description: Lists the common vulnerabilities and exposures (CVE) ID of weaknesses found in the software running in your organization. Discovered by the Microsoft Defender ATP threat and vulnerability management capability.
|
||||||
keywords: mdatp threat & vulnerability management, mdatp tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm
|
keywords: mdatp threat & vulnerability management, threat and vulnerability management, mdatp tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -16,7 +16,7 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
# Weaknesses
|
# Weaknesses found by threat and vulnerability management
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||||
@ -25,7 +25,7 @@ ms.topic: conceptual
|
|||||||
|
|
||||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||||
|
|
||||||
Threat & Vulnerability Management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities.
|
Threat and vulnerability management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities.
|
||||||
|
|
||||||
The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization by listing the Common Vulnerabilities and Exposures (CVE) ID, the severity, Common Vulnerability Scoring System (CVSS) rating, prevalence in your organization, corresponding breach, and threat insights.
|
The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization by listing the Common Vulnerabilities and Exposures (CVE) ID, the severity, Common Vulnerability Scoring System (CVSS) rating, prevalence in your organization, corresponding breach, and threat insights.
|
||||||
|
|
||||||
@ -40,12 +40,12 @@ The **Weaknesses** page lists down the vulnerabilities found in the infected sof
|
|||||||
|
|
||||||
Access the Weaknesses page a few different ways:
|
Access the Weaknesses page a few different ways:
|
||||||
|
|
||||||
- Selecting **Weaknesses** from the Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
- Selecting **Weaknesses** from the threat and vulnerability management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
||||||
- Global search
|
- Global search
|
||||||
|
|
||||||
### Navigation menu
|
### Navigation menu
|
||||||
|
|
||||||
Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open the list of CVEs.
|
Go to the threat and vulnerability management navigation menu and select **Weaknesses** to open the list of CVEs.
|
||||||
|
|
||||||
### Vulnerabilities in global search
|
### Vulnerabilities in global search
|
||||||
|
|
||||||
@ -80,7 +80,7 @@ The threat insights icon is highlighted if there are associated exploits in the
|
|||||||
|
|
||||||
### Top vulnerable software in the dashboard
|
### Top vulnerable software in the dashboard
|
||||||
|
|
||||||
1. Go to the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time.
|
1. Go to the [threat and vulnerability management dashboard](tvm-dashboard-insights.md) and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -119,13 +119,13 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
|
|||||||
1. Open the CVE on the Weaknesses page.
|
1. Open the CVE on the Weaknesses page.
|
||||||
2. Select **Report inaccuracy**.
|
2. Select **Report inaccuracy**.
|
||||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts.
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||||
- [Exposure score](tvm-exposure-score.md)
|
- [Exposure score](tvm-exposure-score.md)
|
||||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||||
- [Security recommendations](tvm-security-recommendation.md)
|
- [Security recommendations](tvm-security-recommendation.md)
|
||||||
@ -134,4 +134,4 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
|
|||||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||||
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Create and manage roles for role-based access control
|
title: Create and manage roles for role-based access control
|
||||||
description: Create roles and define the permissions assigned to the role as part of the role-based access control implementation
|
description: Create roles and define the permissions assigned to the role as part of the role-based access control implementation in the Microsoft Defender Security Center
|
||||||
keywords: user roles, roles, access rbac
|
keywords: user roles, roles, access rbac
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
search.appverid: met150
|
search.appverid: met150
|
||||||
@ -18,6 +18,7 @@ ms.topic: article
|
|||||||
---
|
---
|
||||||
|
|
||||||
# Create and manage roles for role-based access control
|
# Create and manage roles for role-based access control
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||||
|
|
||||||
@ -26,63 +27,58 @@ ms.topic: article
|
|||||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||||
|
|
||||||
## Create roles and assign the role to an Azure Active Directory group
|
## Create roles and assign the role to an Azure Active Directory group
|
||||||
|
|
||||||
The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups.
|
The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups.
|
||||||
|
|
||||||
1. In the navigation pane, select **Settings > Roles**.
|
1. In the navigation pane, select **Settings > Roles**.
|
||||||
|
|
||||||
2. Click **Add role**.
|
2. Select **Add item**.
|
||||||
|
|
||||||
3. Enter the role name, description, and permissions you'd like to assign to the role.
|
3. Enter the role name, description, and permissions you'd like to assign to the role.
|
||||||
|
|
||||||
- **Role name**
|
4. Select **Next** to assign the role to an Azure AD Security group.
|
||||||
- **Description**
|
|
||||||
- **Permissions**
|
|
||||||
- **View data** - Users can view information in the portal.
|
|
||||||
>[!NOTE]
|
|
||||||
>To view Threat & Vulnerability Management data, select **Threat and vulnerability management**.
|
|
||||||
|
|
||||||
- **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage device tags, and export device timeline.
|
|
||||||
- **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions.
|
|
||||||
- Security operations - Take response actions
|
|
||||||
- Approve or dismiss pending remediation actions
|
|
||||||
- Manage allowed/blocked lists for automation
|
|
||||||
- Manage allowed/blocked create Indicators
|
|
||||||
|
|
||||||
>[!NOTE]
|
5. Use the filter to select the Azure AD group that you'd like to add to this role to.
|
||||||
>To enable your Security operation personnel to choose remediation options and file exceptions, select **Threat and vulnerability management - Remediation handling**, and **Threat and vulnerability management - Exception handling**.
|
|
||||||
|
|
||||||
- **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and device groups.
|
|
||||||
|
|
||||||
> [!NOTE]
|
6. **Save and close**.
|
||||||
> This setting is only available in the Microsoft Defender ATP administrator (default) role.
|
|
||||||
|
|
||||||
- **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard devices, and manage email notifications.
|
|
||||||
|
|
||||||
- **Live response capabilities** - Users can take basic or advanced live response commands.
|
|
||||||
- Basic commands allow users to:
|
|
||||||
- Start a live response session
|
|
||||||
- Run read only live response commands on a remote device
|
|
||||||
- Advanced commands allow users to:
|
|
||||||
- Run basic actions
|
|
||||||
- Download a file from the remote device
|
|
||||||
- View a script from the files library
|
|
||||||
- Run a script on the remote device from the files library take read and write commands.
|
|
||||||
|
|
||||||
For more information on the available commands, see [Investigate devices using Live response](live-response.md).
|
|
||||||
|
|
||||||
4. Click **Next** to assign the role to an Azure AD Security group.
|
|
||||||
|
|
||||||
5. Use the filter to select the Azure AD group that you'd like to add to this role.
|
|
||||||
|
|
||||||
6. Click **Save and close**.
|
|
||||||
|
|
||||||
7. Apply the configuration settings.
|
7. Apply the configuration settings.
|
||||||
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> After creating roles, you'll need to create a device group and provide access to the device group by assigning it to a role that you just created.
|
> After creating roles, you'll need to create a device group and provide access to the device group by assigning it to a role that you just created.
|
||||||
|
|
||||||
|
### Permission options
|
||||||
|
|
||||||
|
- **View data**
|
||||||
|
- **Security operations** - View all security operations data in the portal
|
||||||
|
- **Threat and vulnerability management** - View threat and vulnerability management data in the portal
|
||||||
|
|
||||||
|
- **Active remediation actions**
|
||||||
|
- **Security operations** - Take response actions, approve or dismiss pending remediation actions, manage allowed/blocked lists for automation and indicators
|
||||||
|
- **Threat and vulnerability management - Exception handling** - Create new exceptions and manage active exceptions
|
||||||
|
- **Threat and vulnerability management - Remediation handling** - Submit new remediation requests, create tickets, and manage existing remediation activities
|
||||||
|
|
||||||
|
- **Alerts investigation** - Manage alerts, initiate automated investigations, run scans, collect investigation packages, manage device tags.
|
||||||
|
|
||||||
|
- **Manage portal system settings** - Configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and device groups.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> This setting is only available in the Microsoft Defender ATP administrator (default) role.
|
||||||
|
|
||||||
|
- **Manage security settings in Security Center** - Configure alert suppression settings, manage folder exclusions for automation, onboard and offboard devices, and manage email notifications, manage evaluation lab.
|
||||||
|
|
||||||
|
- **Live response capabilities**
|
||||||
|
- **Basic** commands:
|
||||||
|
- Start a live response session
|
||||||
|
- Perform read only live response commands on remote device (excluding file copy and execution
|
||||||
|
- **Advanced** commands:
|
||||||
|
- Download a file from the remote device
|
||||||
|
- Upload a file to the remote device
|
||||||
|
- View a script from the files library
|
||||||
|
- Execute a script on the remote device from the files library
|
||||||
|
|
||||||
|
For more information on the available commands, see [Investigate devices using Live response](live-response.md).
|
||||||
|
|
||||||
## Edit roles
|
## Edit roles
|
||||||
|
|
||||||
1. Select the role you'd like to edit.
|
1. Select the role you'd like to edit.
|
||||||
@ -99,7 +95,7 @@ The following steps guide you on how to create roles in Microsoft Defender Secur
|
|||||||
|
|
||||||
2. Click the drop-down button and select **Delete role**.
|
2. Click the drop-down button and select **Delete role**.
|
||||||
|
|
||||||
|
|
||||||
## Related topic
|
## Related topic
|
||||||
|
|
||||||
- [User basic permissions to access the portal](basic-permissions.md)
|
- [User basic permissions to access the portal](basic-permissions.md)
|
||||||
- [Create and manage device groups](machine-groups.md)
|
- [Create and manage device groups](machine-groups.md)
|
||||||
|
|||||||
@ -63,6 +63,17 @@ You can choose to limit the list of incidents shown based on their status to see
|
|||||||
### Data sensitivity
|
### Data sensitivity
|
||||||
Use this filter to show incidents that contain sensitivity labels.
|
Use this filter to show incidents that contain sensitivity labels.
|
||||||
|
|
||||||
|
## Incident naming
|
||||||
|
|
||||||
|
To understand the incident's scope at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories.
|
||||||
|
|
||||||
|
For example: *Multi-stage incident on multiple endpoints reported by multiple sources.*
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Incidents that existed prior the rollout of automatic incident naming will not have their name changed.
|
||||||
|
|
||||||
|
Learn more about [turning on preview features](preview.md#turn-on-preview-features).
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue)
|
- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue)
|
||||||
- [Manage incidents](manage-incidents.md)
|
- [Manage incidents](manage-incidents.md)
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user