You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/respond-machine-alerts.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -363,9 +363,7 @@ When an identity in your network might be compromised, you must prevent that ide
363
363
> Blocking incoming communication with a "contained" user is supported on onboarded Microsoft Defender for Endpoint Windows 10 and 11 devices (Sense version 8740 and higher), Windows Server 2019+ devices, and Windows Servers 2012R2 and 2016 with the modern agent.
364
364
365
365
> [!IMPORTANT]
366
-
> As part of the active protection provided by Microsoft Defender for Endpoint, a distributed mechanism can apply LSA Policy to prevent compromised users from accessing machines in your organization. Currently, when this policy is applied on Domain Controllers, it may cause Group Policy synchronization activity across domain controllers.
367
-
>
368
-
> We are gradually rolling out a new solution by integrating with new OS APIs. This deployment will be phased and thoroughly tested to ensure stability and security. During this rollout, LSA Policy enforcement on your servers will be temporarily removed to prevent potential GPO sync. This change will remain in effect until the rollout is complete.
366
+
> Once a **Contain user** action is enforced on a domain controller, it starts a GPO update on the Default Domain Controller policy. A change of a GPO starts a sync across the domain controllers in your environment. This is expected behavior, and if you monitor your environment for AD GPO changes, you may be notified of such changes. Undoing the **Contain user** action reverts the GPO changes to their previous state, which will then start another AD GPO synchronization in your environment. Learn more about [merging of security policies on domain controllers](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj966251(v=ws.11)#merging-of-security-policies-on-domain-controllers).
Copy file name to clipboardExpand all lines: defender-for-identity/configure-scoped-access.md
+28-22Lines changed: 28 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,8 +8,8 @@ ms. reviewer: 'LiorShapiraa'
8
8
9
9
# Configure scoped access for Microsoft Defender for Identity
10
10
11
-
As organizations grow and their identity environments become more complex, it's important to control who has access to which resources. Microsoft Defender for Identity scoping lets you focus monitoring on specific Active Directory domains. This helps improve efficiency by reducing noise from nonessential data and focusing on critical assets. You can also limit visibility to specific entities, so access matches each person's responsibilities.
12
-
Scoped access is implemented by creating a custom role using Microsoft Defender XDR Unified RBAC. During the role configuration process, you define which users or groups have access to specific Active Directory domains or Microsoft Entra ID groups.
11
+
As organizations grow and their identity environments become more complex, it's important to control who has access to which resources. Microsoft Defender for Identity scoping lets you focus monitoring on specific Active Directory domains or organizational units. This helps improve efficiency by reducing noise from nonessential data and focusing on critical assets. You can also limit visibility to specific entities, so access matches each person's responsibilities.
12
+
Scoped access is implemented by [creating a custom role using Microsoft Defender XDR Unified RBAC](/defender-xdr/create-custom-rbac-roles). During the role configuration process, you define which users or Entra ID groups have access to specific Active Directory domains or Organizational units.
13
13
14
14
## Prerequisites
15
15
@@ -25,7 +25,7 @@ Before you begin, make sure you meet the following requirements:
25
25
26
26
To enable identity scoping, follow these steps:
27
27
28
-
1. Navigate to **Permissions > Microsoft Defender XDR > Roles**.
28
+
1. Navigate to **Permissions > Microsoft Defender XDR > Roles**.
29
29
30
30
:::image type="content" source="media/custom-roles/permissions-roles.png" alt-text="Screenshot showing the roles page in the Defender XDR portal.":::
31
31
@@ -40,34 +40,40 @@ To enable identity scoping, follow these steps:
40
40
1. Select Add assignments and add the Assignment name.
41
41
1. Under **Assign users and groups**, enter the usernames or Microsoft Entra ID groups you want to assign to the role.
42
42
1. Select Microsoft Defender for Identity as the data source.
43
-
1. Under **Scope**, select the user groups (AD domains) that will be scoped to the assignment.
44
-
:::image type="content" source="media/custom-roles/add-assignment.png" alt-text="Screenshot showing how to add Defender for Identity to your scoping role.":::
45
-
1. Select **Add**.
43
+
1. Under **Scope**, select the user groups (AD domains or OU's) that will be scoped to the assignment. For an optimal experience, use the filter or search box.
44
+
45
+
46
+
47
+
48
+
49
+
1. Select **Apply** and **Add**.
46
50
47
51
48
-
### Known limitations (Preview)
49
52
50
-
Defender for Identity scoping is currently in Public preview. The following table lists the current limitations and supported scenarios for scoped access in Microsoft Defender for Identity.
53
+
### Known limitations
54
+
55
+
The following table lists the current limitations and supported scenarios for scoped access in Microsoft Defender for Identity.
51
56
52
57
> [!NOTE]
53
58
> - Custom roles apply only to new alerts and activities. Alerts and activities triggered before a custom role was created aren't retroactively tagged or filtered.
54
59
>
55
60
> - Microsoft Entra ID IP alerts aren't included within scoped MDI detections.
56
61
57
-
|Defender for Identity experience |Status |
58
-
|---------|---------|
59
-
|MDI alerts and incidents | Available
60
-
|Hunting tables: AlertEvidence+Info, IdentityInfo, IdentityDirectoryEvents, IdentityLogonEvents, IdentityQueryEvents | Available |
61
-
|User page and user global search | Available |
62
-
|MDI alerts based on XDR detection platform (detection source is XDR and service source is MDI) | Available |
63
-
|Health issues | Available |
64
-
|Identities inventory and service accounts discovery page | Available |
65
-
|Identities settings: sensors page, manual tagging, health issues notifications | Available |
Copy file name to clipboardExpand all lines: defender-for-identity/understanding-security-alerts.md
-1Lines changed: 0 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,6 @@ Alerts from the last seven days are displayed with the following information:
30
30
:::image type="content" source="media/understanding-security-alerts/filtered-alerts.png" alt-text="Screenshot showing the Alerts page in the Defender portal. Two alerts named Suspected brute-force are listed with full alert details." lightbox="media/understanding-security-alerts/filtered-alerts.png":::
31
31
32
32
33
-
34
33
## Customize the view of the alerts queue
35
34
36
35
You can customize the view of the alerts queue in a few ways. Using the tools at the top of the page, you can:
![m365-skilling-repo-management[bot]](https://avatars.githubusercontent.com/in/1161012?v=4&size=40){kind=avatar}
0 commit comments