11 KiB
title, description, keywords, search.product, search.appverid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic
| title | description | keywords | search.product | search.appverid | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | ms.author | author | ms.localizationpriority | manager | audience | ms.collection | ms.topic |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Configure advanced features in Microsoft Defender ATP | Turn on advanced features such as block file in Microsoft Defender Advanced Threat Protection. | advanced features, settings, block file, automated investigation, auto-resolve, skype, azure atp, office 365, azure information protection, intune | eADQiWindows 10XVcnh | met150 | w10 | deploy | library | security | macapara | mjcaparas | medium | dansimp | ITPro | M365-security-compliance | article |
Configure advanced features in Microsoft Defender ATP
Applies to:
Want to experience Microsoft Defender ATP? Sign up for a free trial.
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Microsoft Defender ATP with.
Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations:
Automated investigation
When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see Automated investigations.
Live response
When you enable this feature, users with the appropriate permissions can initiate a live response session on machines.
For more information on role assignments see, Create and manage roles.
Live response unsigned script execution
Enabling this feature allows you to run unsigned scripts in a live response session.
Auto-resolve remediated alerts
For tenants created on or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don’t want to have alerts auto-resolved, you’ll need to manually turn off the feature.
Tip
For tenants created prior that version, you'll need to manually turn this feature on from the Advanced features page.
Note
- The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine.
- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it.
Allow or block file
Blocking is only available if your organization uses Windows Defender Antivirus as the active antimalware solution, and if the cloud-based protection feature is enabled.
This feature enables you to block potentially malicious files in your network. Blocking a file will prevent it from being read, written, or executed on machines in your organization.
To turn Allow or block files on:
-
In the navigation pane, select Settings > Advanced features > Allow or block file.
-
Toggle the setting between On and Off.
-
Select Save preferences at the bottom of the page.
Once you have enabled this feature, you can block files via the Add Indicator tab on a file's profile page.
Custom network indicators
Enabling this feature allows you to create indicators for IP addresses, domains, or URLs which determine whether they will be allowed or blocked based on your custom indicator list.
To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform see KB 4052623.
For more information, see Manage indicators.
Note
Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data.
Show user details
When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views:
- Security operations dashboard
- Alert queue
- Machine details page
For more information, see Investigate a user account.
Skype for Business integration
Enabling the Skype for Business integration gives you the ability to communicate with users using Skype for Business, email, or phone. This can be handy when you need to communicate with the user and mitigate risks.
Note
When a machine is being isolated from the network, there's a pop-up where you can choose to enable Outlook and Skype communications which allows communications to the user while they are disconnected from the network. This setting applies to Skype and Outlook communication when machines are in isolation mode.
Azure Advanced Threat Protection integration
The integration with Azure Advanced Threat Protection allows you to pivot directly into another Microsoft Identity security product. Azure Advanced Threat Protection augments an investigation with additional insights about a suspected compromised account and related resources. By enabling this feature, you'll enrich the machine-based investigation capability by pivoting across the network from an identify point of view.
Note
You'll need to have the appropriate license to enable this feature.
Enable the Microsoft Defender ATP integration from the Azure ATP portal
To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal.
-
Login to the Azure portal with a Global Administrator or Security Administrator role.
-
Click Create a workspace or use your primary workspace.
-
Toggle the Integration setting to On and click Save.
When you complete the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page.
Office 365 Threat Intelligence connection
This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page.
When you enable this feature, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a holistic security investigation across Office 365 mailboxes and Windows machines.
Note
You'll need to have the appropriate license to enable this feature.
To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Microsoft Defender ATP settings in the Security & Compliance dashboard. For more information, see Office 365 Threat Intelligence overview.
Microsoft Threat Experts
Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability, while experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it.
Note
The Microsoft Threat Experts capability in Microsoft Defender ATP is available with an E5 license for Enterprise Mobility + Security.
Microsoft Cloud App Security
Enabling this setting forwards Microsoft Defender ATP signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data.
Note
This feature will be available with an E5 license for Enterprise Mobility + Security on machines running Windows 10, version 1709 (OS Build 16299.1085 with KB4493441), Windows 10, version 1803 (OS Build 17134.704 with KB4493464), Windows 10, version 1809 (OS Build 17763.379 with KB4489899) or later Windows 10 versions.
Azure Information Protection
Turning this setting on forwards signals to Azure Information Protection, giving data owners and administrators visibility into protected data on onboarded machines and machine risk ratings.
Microsoft Intune connection
Microsoft Defender ATP can be integrated with Microsoft Intune to enable device risk-based conditional access. When you enable this feature, you'll be able to share Microsoft Defender ATP device information with Intune, enhancing policy enforcement.
Important
You'll need to enable the integration on both Intune and Microsoft Defender ATP to use this feature. For more information on specific steps, see Configure Conditional Access in Microsoft Defender ATP.
This feature is only available if you have the following:
- A licensed tenant for Enterprise Mobility + Security E3, and Windows E5 (or Microsoft 365 Enterprise E5)
- An active Microsoft Intune environment, with Intune-managed Windows 10 devices Azure AD-joined.
Conditional Access policy
When you enable Intune integration, Intune will automatically create a classic Conditional Access (CA) policy. This classic CA policy is a prerequisite for setting up status reports to Intune. It should not be deleted.
Note
The classic CA policy created by Intune is distinct from modern Conditional Access policies, which are used for configuring endpoints.
Preview features
Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
Enable advanced features
- In the navigation pane, select Preferences setup > Advanced features.
- Select the advanced feature you want to configure and toggle the setting between On and Off.
- Click Save preferences.