Skip to content

Commit 095e490

Browse files
Stacyrch140Stacyrch140
authored
Merge branch 'main' into docs-editor/network-protection-linux-1728396787
2 parents ddfb3f9 + a3aee73 commit 095e490

6 files changed

+38
-102
lines changed

‎defender-endpoint/manage-tamper-protection-intune.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ manager: deniseb
55
description: Turn tamper protection on or off for your organization in Microsoft Intune.
66
ms.service: defender-endpoint
77
ms.localizationpriority: medium
8-
ms.date: 08/15/2024
8+
ms.date: 10/08/2024
99
audience: ITPro
1010
ms.topic: how-to
1111
author: denisebmsft
@@ -34,13 +34,13 @@ search.appverid: met150
3434
**Platforms**
3535
- Windows
3636

37-
Tamper protection helps protect certain [security settings](prevent-changes-to-security-settings-with-tamper-protection.md#what-happens-when-tamper-protection-is-turned-on), such as virus and threat protection, from being disabled or changed. If you're part of your organization's security team, and you're using [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), you can manage tamper protection for your organization in the [Intune admin center](https://intune.microsoft.com). Or, you can use [Configuration Manager](/mem/configmgr/protect/deploy-use/endpoint-protection-configure). With Intune or Configuration Manager, you can:
37+
Tamper protection helps protect certain [security settings](prevent-changes-to-security-settings-with-tamper-protection.md#what-happens-when-tamper-protection-is-turned-on), such as virus and threat protection, from being disabled or changed. If you're part of your organization's security team, and you're using [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), you can manage tamper protection for your organization in the [Intune admin center](https://intune.microsoft.com). Or, you can use [Configuration Manager](/mem/configmgr/protect/deploy-use/endpoint-protection-configure). With Intune or Configuration Manager, you can perform the following tasks:
3838

3939
- [Turn tamper protection on (or off) for some or all devices](#turn-tamper-protection-on-or-off-in-microsoft-intune).
4040
- [Protect Microsoft Defender Antivirus exclusions from tampering](#tamper-protection-for-antivirus-exclusions) (certain requirements must be met).
4141

4242
> [!IMPORTANT]
43-
> If you're using Microsoft Intune to manage Defender for Endpoint settings, make sure to set [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge) to true on devices.
43+
> If you're using Microsoft Intune to manage Defender for Endpoint settings, make sure to set [DisableLocalAdminMerge](/windows/client-management/mdm/defender-csp#configurationdisablelocaladminmerge) to `true` on devices.
4444
>
4545
> When tamper protection is turned on, [tamper-protected settings](prevent-changes-to-security-settings-with-tamper-protection.md#what-happens-when-tamper-protection-is-turned-on) cannot be changed. To avoid breaking management experiences, including Intune (and [Configuration Manager](manage-tamper-protection-configuration-manager.md)), keep in mind that changes to tamper-protected settings might appear to succeed but are actually blocked by tamper protection. Depending on your particular scenario, you have several options available:
4646
>
@@ -55,11 +55,11 @@ Tamper protection helps protect certain [security settings](prevent-changes-to-s
5555
| Requirement | Details |
5656
|---|---|
5757
| Roles and permissions | You must have appropriate permissions assigned through roles, such as Security Administrator. See [Microsoft Entra roles with Intune access](/mem/intune/fundamentals/role-based-access-control#azure-active-directory-roles-with-intune-access). |
58-
| Device management | Your organization uses [Intune to manage devices](/mem/intune/fundamentals/manage-devices). |
58+
| Device management | Your organization uses Configuration Manager or [Intune to manage devices](/mem/intune/fundamentals/manage-devices). Co-Managed devices are not supported for this feature. |
5959
| Intune licenses | Intune licenses are required. See [Microsoft Intune licensing](/mem/intune/fundamentals/licenses). |
6060
| Operating System | Windows devices must be running Windows 10 [version 1709 or later](/lifecycle/announcements/revised-end-of-service-windows-10-1709) or Windows 11. (For more information about releases, see [Windows release information](/windows/release-health/release-information).) <br/><br/>For Mac, see [Protect macOS security settings with tamper protection](tamperprotection-macos.md). |
6161
| Security intelligence | You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version `1.287.60.0` (or later). |
62-
| Antimalware platform | Devices must be using antimalware platform version `4.18.1906.3` (or above) and anti-malware engine version `1.1.15500.X` (or later). See [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md). |
62+
| Antimalware platform | Devices must be using antimalware platform version `4.18.1906.3` (or later) and anti-malware engine version `1.1.15500.X` (or later). See [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md). |
6363
| Microsoft Entra ID | Your Intune and Defender for Endpoint tenants must share the same Microsoft Entra infrastructure. |
6464
| Defender for Endpoint | Your devices must be onboarded to Defender for Endpoint. |
6565

@@ -115,11 +115,12 @@ You can use a registry key to determine whether the functionality to protect Mic
115115

116116
| `ManagedDefenderProductType` value | `EnrollmentStatus` value | What the value means |
117117
|---|---|---|
118-
| `6` | (any value) |The device is managed by Intune only. <br/>(*Meets a requirement for exclusions to be tamper protected.*) |
119-
| `7` | `4` | The device is managed by Configuration Manager. <br/>(*Meets a requirement for exclusions to be tamper protected.*) |
118+
| `6` | (any value) |The device is managed with Intune only. <br/>(*Meets a requirement for exclusions to be tamper protected.*) |
119+
| `7` | `4` | The device is managed with Configuration Manager. <br/>(*Meets a requirement for exclusions to be tamper protected.*) |
120+
| `7` | `3` | The device is co-managed with Configuration Manager and Intune. <br/>(*This is not supported for exclusions to be tamper protected.*) |
120121
| A value other than `6` or `7` | (any value) | The device isn't managed by Intune only or Configuration Manager only. <br/>(*Exclusions aren't tamper protected*.) |
121122

122-
3. To confirm that tamper protection is deployed and that exclusions are tamper protected, check the `TPExclusions` registry key (located at `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features` or `HKLM\SOFTWARE\Microsoft\Windows Defender\Features`).
123+
4. To confirm that tamper protection is deployed and that exclusions are tamper protected, check the `TPExclusions` registry key (located at `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features` or `HKLM\SOFTWARE\Microsoft\Windows Defender\Features`).
123124

124125
| `TPExclusions` | What the value means |
125126
|---|---|

‎defender-endpoint/mtd.md‎

Lines changed: 13 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.subservice: onboard
77
ms.author: deniseb
88
author: denisebmsft
99
ms.localizationpriority: medium
10-
ms.date: 10/08/2024
10+
ms.date: 09/05/2024
1111
manager: deniseb
1212
audience: ITPro
1313
ms.collection:
@@ -62,91 +62,21 @@ The following table summarizes how to deploy Microsoft Defender for Endpoint on
6262
- [Overview of Microsoft Defender for Endpoint on Android](microsoft-defender-endpoint-android.md), and
6363
- [Overview of Microsoft Defender for Endpoint on iOS](microsoft-defender-endpoint-ios.md)
6464

65-
**Android Enrollment Scenarios**
65+
**Android**
6666

67-
|Scenarios|Defender for Endpoint Supported?|Is the company portal app required on the device?|Protection Profile/Prerequisites|Steps|
68-
| -------- | -------- | -------- | -------- | -------- |
69-
|Android Enterprise personally owned devices using a work profile|Yes|Yes|1) It protects only the work profile section 2) To Know more about work profile [click here](/mem/intune/apps/android-deployment-scenarios-app-protection-work-profiles)|[Deployment steps](android-intune.md#deploy-on-android-enterprise-enrolled-devices)|
70-
|Android Enterprise personally owned devices using a personal profile|Yes|Yes|1) It protects the personal profile. When a customer has a scenario with work profile as well then it protects the entire device. 2) **Prerequisites:** **A**. The company portal app needs to be enabled on personal profile. **B**. Microsoft Defender must be already installed and active in work profile to enable Microsoft Defender in personal profile.|[Deployment Steps](/defender-endpoint/android-intune)|
71-
|Android Enterprise corporate owned work profile (COPE)|Yes|Yes|1) It protects only the work profile section. 2) Company Portal app and Microsoft Intune app both are auto installed| [Deployment Steps](/defender-endpoint/android-intune) |
72-
|Android Enterprise corporate owned personal profile|No|-|-|-|
73-
|Android Enterprise corporate owned fully managed - no work profile (COBO)|Yes|Yes|1) It protects the entire device. <BR> 2) Company Portal app and Microsoft Intune app both are auto installed.|[Deployment Steps](/defender-endpoint/android-intune)|
74-
|Android Enterprise corporate owned dedicated devices (COSU)(Kiosk/Shared)|No|-|-|-|
75-
|MAM|Yes|Yes, (Need to just install, setup is not required)|1) It protects only enrolled apps. 2) MAM supports with/without Device enrollment or enrolled with third party Enterprise Mobility Management.|[Deployment Steps](/defender-endpoint/android-configure-mam)|
76-
|Device Administrator|Yes|Yes|1) Intune is ending support for android device administrator management on devices with access to Google Mobile Services (GMS) on December 31, 2024.|-|
77-
|Android Open-Source Project (AOSP)|No|-|-|-|
67+
|Enrollment type |Details |
68+
|--------------------|-------------|
69+
|Android Enterprise with Intune |[Deploy on Android Enterprise enrolled devices](android-intune.md#deploy-on-android-enterprise-enrolled-devices)|
70+
|Device Administrator with Intune |[Deploy on Device Administrator enrolled devices](android-intune.md#deploy-on-device-administrator-enrolled-devices)|
71+
|Unmanaged BYOD OR devices managed by other enterprise mobility management / Set up app protection policy (MAM)|[Configure Defender risk signals in app protection policy (MAM)](android-configure-mam.md)|
7872

79-
## Option 1: Supported Defender for Endpoint on Android enrollment scenarios
80-
The following sections describe the different scenarios for how to onboard Android devices to Defender for Endpoint.
73+
**iOS**
8174

82-
### Android Enterprise personally owned devices using a work profile
83-
#### Prerequisites
84-
- Company portal app required on the device
85-
86-
#### Protection mode
87-
- This mode only protects the work profile section Learn more: [Mobile Application Management (MAM) and Android Enterprise personally-owned work profiles in Microsoft Intune](/mem/intune/apps/android-deployment-scenarios-app-protection-work-profiles#android-enterprise-personally-owned-work-profiles)
88-
89-
#### How to deploy
90-
- [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md#deploy-on-android-enterprise-enrolled-devices)
91-
92-
### Android Enterprise personally owned devices using a personal profile
93-
#### Prerequisites
94-
- The Company portal needs to be enabled on personal profile.
95-
- Microsoft Defender must be already installed and active in work profile to enable Microsoft Defender in personal profiles.
96-
97-
#### Protection mode
98-
- This mode protects the Android personal profile. When a customer has a scenario with work profile as well this mode protects the entire device.
99-
100-
#### How to deploy
101-
- [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md#set-up-microsoft-defender-in-personal-profile-on-android-enterprise-in-byod-mode)
102-
103-
### Android Enterprise corporate-owned work profile (COPE)
104-
#### Prerequisites
105-
- The Company portal app and Microsoft Intune app both are automatically installed
106-
107-
#### Protection mode
108-
- This mode protects only the work profile section.
109-
110-
#### How to deploy
111-
- [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md#deploy-on-android-enterprise-enrolled-devices)
112-
113-
## Table Option 2
114-
| Scenario | Prerequisites | Protection mode | How to deploy|
115-
|---|---|---|---|
116-
|Android Enterprise personally owned devices using a work profile | Company portal app required on the device | This mode only protects the work profile section Learn more: [Mobile Application Management (MAM) and Android Enterprise personally-owned work profiles in Microsoft Intune](/mem/intune/apps/android-deployment-scenarios-app-protection-work-profiles#android-enterprise-personally-owned-work-profiles) | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md#deploy-on-android-enterprise-enrolled-devices) |
117-
|Android Enterprise personally owned devices using a personal profile | The Company portal needs to be enabled on personal profile and Microsoft Defender must be already installed and active in work profile to enable Microsoft Defender in personal profiles. | This mode protects the Android personal profile. When a customer has a scenario with work profile as well this mode protects the entire device. | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md#set-up-microsoft-defender-in-personal-profile-on-android-enterprise-in-byod-mode) |
118-
|Android Enterprise corporate-owned work profile (COPE) | The Company portal app and Microsoft Intune app both are automatically installed | This mode protects only the work profile section. | [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md#deploy-on-android-enterprise-enrolled-devices) |
119-
120-
### Unsupported scenarios
121-
These scenarios are not currently supported:
122-
- **Android Enterprise corporate-owned Personal profile (COPE)**
123-
- **Android Enterprise corporate owned dedicated devices (COSU) (Kiosk/Shared)**
124-
125-
126-
**iOS Enrollment Scenarios**
127-
128-
129-
|Scenarios|Is MDE supported?|Is company portal app required on device?|Protection Profile/Prerequisites|Steps|
130-
| -------- | -------- | -------- | -------- | -------- |
131-
|Supervised Devices (ADE and Apple Configurator Enrollment|Yes|Yes|1) It protects the entire device. In terms of ADE if they use Just in Time (JIT) registration - company portal app not required because app itself will enroll the device through connecting to Intune server| [Deployment Steps](/defender-endpoint/ios-install) |
132-
|Unsupervised Devices (Device Enrollment)|Yes|Yes|1) It protects the entire device. (In case of web-based device enrollment company portal app is not required because through this after managed app sign in it leads to download configuration policy and not the company portal app)|[Deployment Steps](/defender-endpoint/ios-install)|
133-
|Unsupervised Devices (User Enrollment)|Yes|Yes|1) It protects work data only. (VPN has access to entire device so can scan all app traffic)|[Deployment Steps](/defender-endpoint/ios-install)|
134-
|MAM|Yes|No|1) It protects only enrolled apps. (VPN has access to entire device so can scan all app traffic)|[Deployment Steps](/defender-endpoint/ios-install-unmanaged)|
135-
|Dedicated/Shared/Kiosk Devices|No|-|-|- |
136-
137-
**Android low touch onboarding supported scenarios**
138-
139-
1. Android Enterprise personally owned devices using a work profile
140-
141-
1. Android Enterprise corporate owned work profile (COPE)
142-
143-
1. Android Enterprise corporate owned fully managed - No work profile (COBO)
144-
145-
**iOS zero touch onboarding supported scenarios**
146-
147-
1. Supervised Devices (ADE and Apple Configurator Enrollment)
148-
149-
1. Unsupervised Devices (Device Enrollment)
75+
|Enrollment type |Details |
76+
|--------------------|-------------|
77+
|Supervised devices with Intune |1. [Deploy as iOS store app](ios-install.md)<br/>2. [Setup Web Protection without VPN for supervised iOS devices](ios-install.md#complete-deployment-for-supervised-devices)|
78+
|Unsupervised (BYOD) devices enrolled with Intune |[Deploy as iOS store app](ios-install.md)|
79+
|Unmanaged BYOD OR devices managed by other enterprise mobility management / Set up app protection policy (MAM)|[Configure Defender risk signals in app protection policy (MAM)](ios-install-unmanaged.md)|
15080

15181
### End-user onboarding
15282

‎defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ manager: deniseb
55
description: Use tamper protection to prevent malicious apps from changing important security settings.
66
ms.service: defender-endpoint
77
ms.localizationpriority: medium
8-
ms.date: 05/17/2024
8+
ms.date: 10/08/2024
99
audience: ITPro
1010
ms.topic: conceptual
1111
author: denisebmsft
@@ -55,7 +55,7 @@ When tamper protection is turned on, these tamper-protected settings can't be ch
5555
- Automatic actions are taken on detected threats.
5656
- Notifications are visible in the Windows Security app on Windows devices.
5757
- Archived files are scanned.
58-
- [Exclusions cannot be modified or added ](manage-tamper-protection-intune.md#tamper-protection-for-antivirus-exclusions) (Applies to Intune or Configuration Manager)
58+
- [Exclusions cannot be modified or added ](manage-tamper-protection-intune.md#tamper-protection-for-antivirus-exclusions) (Applies to devices managed by Intune only or by Configuration Manager only. Co-Managed devices are not supported)
5959

6060
*As of signature release `1.383.1159.0`, due to confusion around the default value for "Allow Scanning Network Files", tamper protection no longer locks this setting to its default value. In managed environments, the default value is `enabled`.*
6161

@@ -108,7 +108,7 @@ You can use Microsoft Intune and other methods to configure or manage tamper pro
108108
| Use the [Windows Security app](manage-tamper-protection-individual-device.md). | Turn tamper protection on (or off) on an individual device that isn't managed by a security team (such as devices for home use). See [Manage tamper protection on an individual device](manage-tamper-protection-individual-device.md).<br/><br/>*This method doesn't override tamper protection settings that are set in the Microsoft Defender portal, Intune, or Configuration Manager, and it isn't intended to be used by organizations.* |
109109

110110
> [!TIP]
111-
> If you're using Group Policy to manage Microsoft Defender Antivirus settings, keep in mind that any changes made to tamper-protected settings are ignored. If you must make changes to a device and those changes are blocked by tamper protection, use [troubleshooting mode](enable-troubleshooting-mode.md) to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state.
111+
> If you're using Group Policy to manage Microsoft Defender Antivirus settings, keep in mind that any changes made to tamper-protected settings are ignored. If you must make changes to a device and those changes are blocked by tamper protection, use [troubleshooting mode](enable-troubleshooting-mode.md) to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state. To change the values on tamper-protected settings permanently, disable tamper protection temporarily before turning it back on after the settings have changed. Keep in mind that this method can pose security risks, and doesn't work on devices that are offline when tamper protection was temporarily disabled. For this reason, we recommend using other management methods for Defender for Endpoint settings, such as Intune, instead of using Group Policy.
112112
113113
## Protect Microsoft Defender Antivirus exclusions
114114

0 commit comments

Comments
 (0)