You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Support phase: **Security and Critical Updates**
110
+
111
+
#### What's new
112
+
113
+
- Added an opt-out feature for Experimental Configuration Services (ECS) and One collector in the Core Service.
114
+
- Fixed an issue where occasionally exclusions deployed via Intune were not being honored when tamper protection was enabled.
115
+
- After a new engine version is released, support for older versions (N-2) will now reduce to technical support only. Engine versions older than N-2 are no longer supported.
116
+
- Improved health monitoring and telemetry for [Attack Surface Rules](overview-attack-surface-reduction.md) exclusions.
117
+
- Updated inaccurate information in [Configure exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) regarding wildcard usage with contextual exclusions.
Copy file name to clipboardExpand all lines: defender-vulnerability-management/tvm-vulnerable-components.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,6 +33,9 @@ With visibility into which vulnerable components are present on a device, securi
33
33
> [!TIP]
34
34
> Did you know you can try all the features in Microsoft Defender Vulnerability Management for free? Find out how to [sign up for a free trial](defender-vulnerability-management-trial.md).
35
35
36
+
For an overview of the vulnerable components capability, watch the following video.
37
+
<iframewidth="560"height="415"src="https://www.youtube.com/embed/QIwrpjpqrBc?si=OjweAYJo9cP1X-Yo"title="YouTube video player"frameborder="0"allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"allowfullscreen></iframe>
38
+
36
39
## Navigate to the vulnerable components page
37
40
38
41
1. Go to **Vulnerability management**\>**Inventories** in the [Microsoft Defender portal](https://security.microsoft.com).
Copy file name to clipboardExpand all lines: defender-xdr/deploy-configure-m365-defender.md
+12-11Lines changed: 12 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.topic: conceptual
16
16
search.appverid:
17
17
- MOE150
18
18
- MET150
19
-
ms.date: 03/31/2023
19
+
ms.date: 05/03/2024
20
20
---
21
21
22
22
# Setup guides for Microsoft Defender XDR
@@ -28,25 +28,26 @@ ms.date: 03/31/2023
28
28
29
29
Setup guides for Microsoft Defender XDR deployment give you tailored guidance and resources for planning and deploying security controls for your tenant, apps, and services.
30
30
31
-
All deployment guides are available in the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/?linkid=2224913) and in the [Microsoft 365 Setup portal](https://go.microsoft.com/fwlink/?linkid=2230646).
31
+
All setup guides are available in the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/?linkid=2224913) and in the [Microsoft 365 Setup portal](https://go.microsoft.com/fwlink/?linkid=2230646).
32
32
33
-
## Deployment Guides
33
+
## Setup guides
34
34
35
-
Deployment guides in the admin center require authentication to a Microsoft 365 tenant as an administrator or other role with access to the admin center, but guides in the Microsoft 365 Setup portal can be accessed by anyone. We have provided links to both locations for each guide, where available, in the tables below.
35
+
Setup guides in the admin center require authentication to a Microsoft 365 tenant as an administrator or other role with access to the admin center, but guides in the Microsoft 365 Setup portal can be accessed by anyone. The following table provides links to both locations for each guide, where available.
|[Microsoft Defender for Endpoint setup guide](https://go.microsoft.com/fwlink/?linkid=2223155)|[Microsoft Defender for Endpoint setup guide](https://go.microsoft.com/fwlink/?linkid=2224785)|The **Microsoft Defender for Endpoint setup guide** provides instructions that will help your enterprise network prevent, detect, investigate, and respond to advanced threats. Make an informed assessment of your organization's vulnerability and decide which deployment package and configuration methods are best. <br> **Note**: A Microsoft Volume License is required for Microsoft Defender for Endpoint. |
40
-
|[Microsoft Defender for Office 365 setup guide ](https://go.microsoft.com/fwlink/?linkid=2222971)|[Microsoft Defender for Office 365 setup guide ](https://go.microsoft.com/fwlink/?linkid=2224784)| The **Microsoft Defender for Office 365 setup guide** safeguards your organization against malicious threats that your environment might come across through email messages, links, and third party collaboration tools. This guide provides you with the resources and information to help you prepare and identify the Defender for Office 365 plan to fit your organization's needs. |
41
-
|[Microsoft Defender for Cloud Apps setup guide](https://go.microsoft.com/fwlink/?linkid=2222969)|[Microsoft Defender for Cloud Apps setup guide](https://go.microsoft.com/fwlink/?linkid=2224814)| The **Microsoft Defender for Cloud Apps setup guide** provides easy to follow deployment and management guidance to set up your Cloud Discovery solution. With Cloud Discovery, you'll integrate your supported security apps, and then you'll use traffic logs to dynamically discover and analyze the cloud apps that your organization uses. You'll also set up features available through the Defender for Cloud Apps solution, including threat detection policies to identify high-risk use, information protection policies to define access, and real-time session controls to monitor activity. With these features, your environment gets enhanced visibility, control over data movement, and analytics to identify and combat cyberthreats across all your Microsoft and thirdparty cloud services. |
42
-
|[Microsoft Defender for Identity setup guide](https://go.microsoft.com/fwlink/?linkid=2222970)|[Microsoft Defender for Identity setup guide](https://go.microsoft.com/fwlink/?linkid=2224783)|The **Microsoft Defender for Identity setup guide** provides security solution set-up guidance to identify, detect, and investigate advanced threats that might compromise user identities. These include detecting suspicious user activities and malicious insider actions directed at your organization. You'll create a Defender for Identity instance, connect to your organization's Active Directory, and then set up sensors, alerts, notifications, and configure your unique portal preferences.|
37
+
| Defender | Deployment guide description | Link in the [Setup Portal](https://go.microsoft.com/fwlink/?linkid=2220880)| Link in the [Admin Center](https://go.microsoft.com/fwlink/?linkid=2224913)|
38
+
|---------|---------|---------|---------|
39
+
| Microsoft Defender for Endpoint | Provides instructions that will help your enterprise network prevent, detect, investigate, and respond to advanced threats. Make an informed assessment of your organization's vulnerability and decide which deployment package and configuration methods are best. <br><br>**Note**: A Microsoft Volume License is required for Microsoft Defender for Endpoint. |[Link](https://go.microsoft.com/fwlink/?linkid=2223155)|[Link](https://go.microsoft.com/fwlink/?linkid=2224785) (may require sign-in)|
40
+
|Microsoft Defender for Office 365 | Provides you with the resources and information to help you prepare and identify the Defender for Office 365 plan to fit your organization's needs. |[Link](https://go.microsoft.com/fwlink/?linkid=2222971)|[Link](https://go.microsoft.com/fwlink/?linkid=2224784) (may require sign-in)|
41
+
|Microsoft Defender for Cloud Apps | Provides easy to follow deployment and management guidance to set up your Cloud Discovery solution. With Cloud Discovery, you'll integrate your supported security apps, and then you'll use traffic logs to dynamically discover and analyze the cloud apps that your organization uses. You'll also set up features available through the Defender for Cloud Apps solution, including threat detection policies to identify high-risk use, information protection policies to define access, and real-time session controls to monitor activity. With these features, your environment gets enhanced visibility, control over data movement, and analytics to identify and combat cyberthreats across all your Microsoft and third-party cloud services. |[Link](https://go.microsoft.com/fwlink/?linkid=2222969)|[Link](https://go.microsoft.com/fwlink/?linkid=2224814) (may require sign-in)|
42
+
|Microsoft Defender for Identity | Provides security solution set-up guidance to identify, detect, and investigate advanced threats that might compromise your on-premises user identities. These include detecting suspicious user activities and malicious insider actions directed at your organization. You'll create a Defender for Identity instance, connect to your organization's on-premises Active Directory, and then set up sensors, alerts, notifications, and configure your unique portal preferences.|[Link](https://go.microsoft.com/fwlink/?linkid=2222970)|[Link](https://go.microsoft.com/fwlink/?linkid=2224783) (may require sign-in) |
Copy file name to clipboardExpand all lines: defender-xdr/eval-defender-identity-architecture.md
+11-5Lines changed: 11 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,16 +42,22 @@ The following diagram illustrates the baseline architecture for Defender for Ide
42
42
43
43
In this illustration:
44
44
45
-
- Sensors installed on Active Directory Domain Services (AD DS) domain controllers parse logs and network traffic and send them to Microsoft Defender for Identity for analysis and reporting.
46
-
- Sensors can also parse Active Directory Federation Services (AD FS) when Microsoft Entra ID is configured to use federated authentication (dotted line in illustration).
45
+
- Sensors installed on Active Directory Domain Services (AD DS) domain controllers and Active Directory Certificate Services (AD CS) servers parse logs and network traffic and send them to Microsoft Defender for Identity for analysis and reporting.
46
+
- Sensors can also parse Active Directory Federation Services (AD FS) authentications for third-party identity providers and when Microsoft Entra ID is configured to use federated authentication (the dotted lines in the illustration).
47
47
- Microsoft Defender for Identity shares signals to Microsoft Defender XDR for extended detection and response (XDR).
48
48
49
49
Defender for Identity sensors can be directly installed on the following servers:
50
50
51
-
- Domain controllers: The sensor directly monitors domain controller traffic, without the need for a dedicated server, or configuration of port mirroring.
52
-
- AD FS: The sensor directly monitors network traffic and authentication events.
51
+
- AD DS domain controllers
53
52
54
-
For a deeper look into the architecture of Defender for Identity, including integration with Defender for Cloud Apps, see [Microsoft Defender for Identity architecture](/defender-for-identity/architecture).
53
+
The sensor directly monitors domain controller traffic, without the need for a dedicated server or the configuration of port mirroring.
54
+
55
+
- AD CS servers
56
+
- AD FS servers
57
+
58
+
The sensor directly monitors network traffic and authentication events.
59
+
60
+
For a deeper look into the architecture of Defender for Identity, see [Microsoft Defender for Identity architecture](/defender-for-identity/architecture).
0 commit comments