Microsoft Defender SmartScreen Deep Dive

Microsoft Defender SmartScreen is the frontline defense against all threats. Did I put that right? It truly is the frontline protector in the Windows computer and the Edge browser on any OS platform. I've been dealing with a lot of SmartScreen configuration tasks, and troubleshooting scenarios when working with customers and I wanted to write … Continue reading Microsoft Defender SmartScreen Deep Dive

New and Updated Microsoft Intune Device Control Policy Settings

New day new blog post. This is more of an updated guide to what I've written some time ago (check below) https://shehanperera.com/2022/08/06/mem-device-control-1/ What I Will Be Covering? 👇🏽 What's New?🌟 Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria🌟 Removable Storage Access🌟 Defender Scanning (this setting can … Continue reading New and Updated Microsoft Intune Device Control Policy Settings

Configure “Enhanced Phishing Protection in Microsoft Defender SmartScreen” in Windows 11 22H2 via Endpoint Manager

Windows 11 22H2 update brought a lot of good stuff and as a tech enthusiast I really appreciate what Microsoft is doing to ensure the end user devices are protected. Enhanced Phishing Protection in Microsoft defender SmartScreen is one of them. While the features are available to the standard Windows Home user, I tested these … Continue reading Configure “Enhanced Phishing Protection in Microsoft Defender SmartScreen” in Windows 11 22H2 via Endpoint Manager

Microsoft Intune and Defender for Endpoint Relationship Simplified

I stumbled upon this so many times, tripped and fell, read things over, test things again and again, and finally thought to write about it. Without understanding the high-level architecture and how these two services talk to each other, using this in day-to-day tech life can be challenging. Especially if you are coming from a … Continue reading Microsoft Intune and Defender for Endpoint Relationship Simplified

Microsoft 365 Defender – Advanced Threat Hunting Basics

With this post, I'm focussing anyone who is keen on knowing more about advanced features of MDE and how to get into that realm of threat hunting, and what are the controls available. So you have proper licensing enabled, and you have Microsoft Defender for Endpoint on your users' devices and they are onboarded to … Continue reading Microsoft 365 Defender – Advanced Threat Hunting Basics

An Attempt to Configure Defender for Endpoint and Endpoint Manager With the Same Device Tag

Most often the device tagging requirements are simple or you do have a set of tags for the devices that are enrolled in Intune and a set of tags for the devices onboarded in Defender for Endpoint. However there can be situations where you need both services to have the same device tagging setup. This … Continue reading An Attempt to Configure Defender for Endpoint and Endpoint Manager With the Same Device Tag

Web Content Filtering with Microsoft Defender for Endpoint Advanced Features

I recently realised I haven't done much writing on Microsoft Endpoint Manager (MDE) side of things for a while. Web Content Filtering via MDE is a straight forward implementation and this will work on the devices that are onboarded currently. MDE has a lot of good features that makes it a next level XDR and … Continue reading Web Content Filtering with Microsoft Defender for Endpoint Advanced Features

Microsoft Defender for Identity – Install and Configure Sensors (Azure ATP Sensors)

I will cut to the chase. MDI or Microsoft Defender for Identity is a great tool for identifying Identity threats in the local AD environment. Once the sensor is setup, you can monitor for the behavior and have the ability to configure in a way so that the bad actors aren't able to compromise your … Continue reading Microsoft Defender for Identity – Install and Configure Sensors (Azure ATP Sensors)

How To Set Defender For Endpoint To Work In Parallel When Defender Is Not The Primary A/V In The Workstation/ Server

EDR in Block Mode EDR stands for Endpoint Detection and Response. MDE has the capability to work in parallel to the 3rd party A/V running in the device. While this will not provide 100% of the tasks done by an A/V which includes real-time protection, it will help to report malicious activities.Because there is a … Continue reading How To Set Defender For Endpoint To Work In Parallel When Defender Is Not The Primary A/V In The Workstation/ Server

How to Configure Attack Surface Reduction (ASR) Rules using MEM

In this section, I would like to discuss one of MDE's important set of settings and how to set these up. Namely ASRs rules or Attarck Surface Reduction rules. As the name implies, it helps closes any security holes in the device. Some notes on ASR rules to keep in handy Device COmpatibility Windows 10 … Continue reading How to Configure Attack Surface Reduction (ASR) Rules using MEM

I’ve completed the MDE Ninja Training and it was great! (my thoughts and experience)

It took me sometime, but finally completed the MDE Ninja training. I got to know about this course from a local user group meetup and it hit me. This certificate is not a standard Microsoft certificate, but I would say more of an achievement celebration from Microsoft for the effort we put to learn the … Continue reading I’ve completed the MDE Ninja Training and it was great! (my thoughts and experience)

How to Onboard Windows Devices to Microsoft Defender for Endpoint

To start hunting for threats and act on alerts, first the devices in the organisation must be onboarded to MDE. There are few onboarding methods that suites the organisation and I will be showcasing the steps of the commonly used setups. I will be focusing on Windows 10 devices in this article. And finally the … Continue reading How to Onboard Windows Devices to Microsoft Defender for Endpoint