Secure Your Devices with Defender for Endpoint - Part 1

[@seanhaynes8758]

I cant tell you how much I love your videos, your style and content.....thank you, so dam helpful!

[@MS365Admin]

Careful when using M365 maps - even though a great tool, it hasn’t been updated since July 2023. On a side note, thank you so much for these 37 minutes of pure knowledge sharing. Cheers!

[@turkiyegundemvideolar4369]

Now Update :)

[@alshishi2398]

Amazing Video, Thank you so much and waiting Part 2

[@AlexanderV-w9s]

Thank you for your work, great content and great funny delivery 😃, please keep on doing, we will wait for part 2

[@blb8547]

Fantastic Video!! I just recently found your content and I loving it! Can't wait for part 2

[@TheB1nary]

Absolutely awesome! Makes running a couple of large networks a breeze. Subscribed :)

another boss video man - i learned alot brother.

[@MaartenBoonen]

Thanks Jonathan, awesome video and have an amazing day!

[@DigitalNightsEvents]

Nice thks for this video. I wait the part 2 ;)

[@savuljesku]

nice video mate, this is a big help

[@person51035]

Great video!

[@davidadams421]

I'm struggling to reconcile the idea that 'quality software' should be 'designed secure', with all these options of changing application/system behaviour to be 'more secure'. If it's a security risk, for the sake of example, to allow office applications to spawn child processes, an 'attack surface reduction' option I noticed in your demo, then why allow the application to do this in the first place? This all just seems like over engineering to me, complexity for complexity's sake, offering only the illusion of security. I would prefer to see 'security profiles' based on protecting 80%, 90% and 95% of common real-life attack scenarios. Has anybody suffered cyber-harm from an office application spawning a child process ... ever? (rhetorical). Fantastic video! The way you describe and demo complex topics is truly inspiring. So much work must go on behind the scenes, and I for one am truly grateful.

[@it-flex8410]

Thank you very much, a very good video.

[@bearded365guy]

Glad you liked it!

[@macm3086]

Thank you so much !

[@abdurkhan6903]

Once you enable troubleshooting mode you have to do some workaround as well on endpoint side

[@BRALVisuals]

Thank you sir

[@craiganderson2815]

Great video as usual. I have learned a lot from your simple explanations. Will you be doing a video on the disk encryption? the new interface has changed from your previous video. I am assuming it will be in part 2?

[@bearded365guy]

Bitlocker video is live this Friday.

[@unkownuser2320]

excellent please cover sis terms like limitation of built in windows defender and defender for endpoint. after enabling defender for endpoint starting creating antivirus policy. possible to enable defender for endpoint for devices, it is agent less? how to configure defender for endpoint in passive mode

[@djbeeney]

Great video and very helpful, I have a question regarding the point you make at 17:27 in the video "If you leave it as Not Configured the default will kick in" I have struggled to find this confirmation or any information on any MS document, are you able to advise and point me in the right direction? :) Thanks

[@victorcermeno5658]

hello I have a question, you can deploy Microsoft Defender for Endpoint Plan 2 and manage the security part through Intune if you also have another MDM tool such as workspace One

[@Apfm141]

I work for a larger company and have assigned myself a Microsoft Defender for Endpoint P2 license but not seeing the endpoints option on the left hand side of the defender portal. Do I need any other licenses?

[@AdamskiHamski]

Great video Jonathan! Once these policies (and those planned for part 2) are configured and assigned, will we be in a position where we can remove our Defender for Endpoint Security Baseline profile?

[@bearded365guy]

@@AdamskiHamski Yes, part 2 is out Friday….. there might also be a part 3…… Defender for Business/Endpoint is the subject that keeps on giving!

[@Axiizix]

Hi, and if we don't want use Intune ? Is it possible to have a video about how to "Secure Your Devices with Defender for Endpoint whitout intune" ? :)

[@ajsp50]

Thanks! just wondering if it's possible to onboard a device running windows home edition other than upgrading to windows pro into defender?

[@bearded365guy]

Hi, unfortunately not with Home editions.

[@ccm21987]

👏👏👏

[@meopendraw]

is it required to have defender for endpoint license in an organization to see the Endpoint settings in Defender portal settings page?

[@albertpena946]

Yes, can you answer please?

[@bearded365guy]

Yes it is.

[@meopendraw]

@@bearded365guy Thanks for the reply

[@agbefii8453]

For some reason, I don't see Endpoint under settings to connect intune to Defender. I see these four options: Microsoft Defender portal, Microsoft Defender XDR, email and collaboration, and cloud apps. Can you explain what is happening in my tenant? i have subscribed to the business premium trial license and also endpoint defender plan 2 trail

[@albertpena946]

And how we manage rules and baselinea id we don’t have Intune? I’m deploying it though GPO.

[@bearded365guy]

Ah, that’s a different video….

[@albertpena946]

@ which one, please? I’m not able to find it

[@dalewalker7072]

How does the dynamic rules section work with devices that aren't company owned ones? The boss wants to use his own PC (typical boss knows best IT conflict) and we have several freelancers that we need to give access to certain Sharepoint sites. How do I make sure the rules only apply to company owned devices and what different rules would you suggest for freelancers? In Intune, we do have them separated between corporate and personal. Is it just for MDM corporate?

[@bearded365guy]

@@dalewalker7072 Yes, you could do a device ownership = corporate for this.

[@schylerjones5722]

DFB/DFE are very capable platforms but what if you want to add an MDR and 24/7 SOC/SIEM? Are there fully managed 3rd-party solutions? I know Microsoft has offerings but they seem more hands-off by offering the platform and capabilities but it’s up to the customer to manage and support it all.

[@schylerjones5722]

To clarify, by third-party solutions I’m referring to a service that layers on top of or works with DFB/DFE as the EDR, rather than competes with it like a Sentinel One.

[@bearded365guy]

@@schylerjones5722 This is a good point and one that I’ll be talking about in future videos….

[@stijnphilips]

Sophos InterceptX MDR SOC have an integration with all the M365 logs. So if you setup Defender in monitor-mode en integrate their logs with Sophos MDR team together with all the logs from InterceptX itself, you have the best of both worlds.

[@chrisrossneely]

Huntress and Connectwise both offer MDR based on MS Defender for Endpoint.

[@it-flex8410]

21:40 why didn't you configure "Signature Update Interval"?

[@JarnoMakinen]

Windows 11 24H2 deviceOSVersion starts with 10.0.26 so your rule for dynamic membership rules wouldn't work.

[@alshishi2398]

You can modify that by make a rule on Windows 11 generally to be added to dynamic group.

[@paulcrosbie6775]

I changed it to deviceOSVersion starts with 10.0.2 so it picks up all Win 11 machines and future versions (until they change the build string again 🙂)

[@ErickLorenzo-w4c]

Hello Sr, thank you for all your knowledge, and your videos, I am trying to avoid 2 things, can you show us how to avoid that the users can create groups, by example, Microsoft 365 groups, to use on teams, and the other is, i need to delete all the emails 3 month older, thank you so much

[@robertpearson5069]

Is Microsoft Defender for Business good enough to be used over things like SentinalOne and others?

[@bearded365guy]

Sentinel One is a Managed Detection and Response. Defender for Business isn’t. You can use the two solutions together. For lots of businesses, having a really good security solution (like Defender for Business) provides a commensurate level of security.

[@ianbird6997]

we use this model Sentinel One with SOC and Defender for Business we have had no issues so far.