You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/deploy/activate-capabilities.md
+41-24Lines changed: 41 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,12 +37,6 @@ Direct Defender for Identity capabilities are supported on domain controllers on
37
37
>
38
38
> This issue is addressed in the out-of-band update [KB5037422](https://support.microsoft.com/en-gb/topic/march-22-2024-kb5037422-os-build-20348-2342-out-of-band-e8f5bf56-c7cb-4051-bd5c-cc35963b18f3).
39
39
40
-
### Defender for Endpoint onboarding
41
-
42
-
Your domain controller must be onboarded to Microsoft Defender for Endpoint.
43
-
44
-
For more information, see [Onboard a Windows server](/microsoft-365/security/defender-endpoint/onboard-windows-server).
45
-
46
40
### Permissions requirements
47
41
48
42
To access the Defender for Identity **Activation** page, you must either be a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference), or have the following Unified RBAC permissions:
@@ -55,12 +49,6 @@ For more information, see:
55
49
-[Unified role-based access control RBAC](../role-groups.md#unified-role-based-access-control-rbac)
56
50
-[Create a role to access and manage roles and permissions](/microsoft-365/security/defender/create-custom-rbac-roles#create-a-role-to-access-and-manage-roles-and-permissions)
57
51
58
-
### Connectivity requirements
59
-
60
-
Defender for Identity capabilities directly on domain controllers use Defender for Endpoint URL endpoints for communication, including simplified URLs.
61
-
62
-
For more information, see [Configure your network environment to ensure connectivity with Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-environment##enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
63
-
64
52
## Configure Windows auditing
65
53
66
54
Defender for Identity detections rely on specific Windows Event Log entries to enhance detections and provide extra information about the users performing specific actions, such as NTLM sign-ins and security group modifications.
@@ -78,42 +66,58 @@ For example, the following command defines all settings for the domain, creates
78
66
Set-MDIConfiguration -Mode Domain -Configuration All
79
67
```
80
68
81
-
## Activate Defender for Identity capabilities
69
+
## Onboarding steps
70
+
71
+
### Customers with domain controllers already onboarded to Defender for Endpoint
82
72
83
-
After ensuring that your environment is completely configured, activate the Microsoft Defender for Identity capabilities on your domain controller.
73
+
### Activate Defender for Identity capabilities
84
74
85
75
Activate the Defender for Identity from the [Microsoft Defender portal](https://security.microsoft.com).
86
76
87
77
1. Navigate to **System** > **Settings** > **Identities** > **Activation**.
88
78
89
-
The Activation page lists servers discovered in Device Inventory and identified as eligible domain controllers.
79
+
The Activation Page now displays all servers from your device inventory, including those not currently eligible for the activation of the new Defender for Identity sensor. For each server you can find its activation state.
90
80
91
-
1. Select the domain controller where you want to activate the Defender for Identity capabilities and then select **Activate**. Confirm your selection when prompted.
81
+
2. Select the domain controller where you want to activate the Defender for Identity capabilities and then select **Activate**. Confirm your selection when prompted.
92
82
93
83
:::image type="content" source="media/activate-capabilities/1.jpg" lightbox="media/activate-capabilities/1.jpg" alt-text="Screenshot that shows how to activate the new sensor.":::
94
84
95
85
> [!NOTE]
96
86
> You can choose to activate eligible domain controllers either automatically, where Defender for Identity activates them as soon as they're discovered, or manually, where you select specific domain controllers from the list of eligible servers.
97
87
98
-
1. When the activation is complete, a green success banner shows. In the banner, select **Click here to see the onboarded servers** to jump to the **Settings > Identities > Sensors** page, where you can check your sensor health.
88
+
3. When the activation is complete, a green success banner shows. In the banner, select **Click here to see the onboarded servers** to jump to the **Settings > Identities > Sensors** page, where you can check your sensor health.
99
89
100
90
:::image type="content" source="media/activate-capabilities/2.jpg" lightbox="media/activate-capabilities/2.jpg" alt-text="Screenshot that shows how to seethe onboarded servers.":::
101
91
92
+
### Customers without domain controllers onboarded to Defender for Endpoint
93
+
94
+
### Connectivity requirements
95
+
96
+
Defender for Identity capabilities directly on domain controllers use Defender for Endpoint URL endpoints for communication, including simplified URLs.
97
+
98
+
For more information, see [Configure your network environment to ensure connectivity with Defender for Endpoint](/microsoft-365/security/defender-endpoint/configure-environment##enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
99
+
100
+
### Onboard Defender for Identity capabilities
101
+
Download the Defender for Identity onboarding package from the [Microsoft Defender portal] (https://security.microsoft.com)
102
+
103
+
1. Navigate to **System** > **Settings** > **Identities** > **Activation**
104
+
2. Select Download onboarding package and save the file in a location you can access from your domain controller.
105
+
3. From the domain controller, extract the zip file you downloaded from the Microsoft Defender portal, and run the `DefenderForIdentityOnlyOnboardingScript.cmd` script as an Administrator.
106
+
102
107
## Onboarding Confirmation
103
108
104
109
To confirm the sensor has been onboarded:
105
110
106
-
1. Navigate to **System** > **Settings** > **Identities** > **Sensors**.
111
+
1. Navigate to **System** > **Settings** > **Identities** > **Sensors**.
107
112
108
113
2. Check that the onboarded domain controller is listed.
109
114
110
115
> [!NOTE]
111
-
> The activation doesn't require a restart/reboot. The first time you activate Defender for Identity capabilities on your domain controller, it may take up to an hour for the first sensor to show as **Running** on the **Sensors** page. Subsequent activations are shown within five minutes.
116
+
> The onboarding doesn't require a restart/reboot. The first time you activate Defender for Identity capabilities on your domain controller, it may take up to an hour for the first sensor to show as **Running** on the **Sensors** page. Subsequent activations are shown within five minutes.
117
+
> To check the onboarding on the local server you can also review the event log under **Applications and Services Logs** > **Microsoft** > **Windows** > **Sense** > **Operational**. You should receive an onboarding event:
112
118
113
119
## Test activated capabilities
114
120
115
-
The first time you activate Defender for Identity capabilities on your domain controller, it may take up to an hour for the first sensor to show as **Running** on the **Sensors** page. Subsequent activations show within five minutes.
116
-
117
121
Defender for Identity capabilities on domain controllers currently support the following Defender for Identity functionality:
118
122
119
123
- Investigation features on the [ITDR dashboard](#check-the-itdr-dashboard), [identity inventory](#confirm-entity-page-details), and [identity advanced hunting data](#test-advanced-hunting-tables)
@@ -163,7 +167,6 @@ IdentityQueryEvents
163
167
164
168
For more information, see [Advanced hunting in the Microsoft Defender portal](/microsoft-365/security/defender/advanced-hunting-microsoft-defender).
165
169
166
-
167
170
## Test Identity Security Posture Management (ISPM) recommendations
168
171
169
172
We recommend simulating risky behavior in a test environment to trigger supported assessments and verify that they appear as expected. For example:
@@ -214,17 +217,31 @@ Test remediation actions on a test user. For example:
214
217
215
218
For more information, see [Remediation actions in Microsoft Defender for Identity](../remediation-actions.md).
216
219
217
-
## Deactivate Defender for Identity capabilities on your domain controller
220
+
## Offboarding steps
221
+
222
+
### Customers with domain controllers already onboarded to Defender for Endpoint
223
+
224
+
### Deactivate Defender for Identity capabilities on your domain controller
218
225
219
226
If you want to deactivate Defender for Identity capabilities on your domain controller, delete it from the **Sensors** page:
220
227
221
-
1. In the Defender portal, select **Settings** > **Identities** > **Sensors**.
228
+
1. Navigate to **Settings** > **Identities** > **Sensors**
222
229
2. Select the domain controller where you want to deactivate Defender for Identity capabilities, select **Delete**, and confirm your selection.
223
230
224
231
:::image type="content" source="media/activate-capabilities/3.jpg" lightbox="media/activate-capabilities/3.jpg" alt-text="Screenshot that shows how to deactivate a server.":::
225
232
226
233
Deactivating Defender for Identity capabilities from your domain controller doesn't remove the domain controller from Defender for Endpoint. For more information, see [Defender for Endpoint documentation](/microsoft-365/security/defender-endpoint/).
227
234
235
+
### Customers without domain controllers onboarded to Defender for Endpoint
236
+
237
+
### Offboard Defender for Identity capabilities on your domain controller
238
+
Download the Defender for Identity offboarding package from the [Microsoft Defender portal] (https://security.microsoft.com).
239
+
240
+
1. Navigate to **Settings** > **Identities** > **Activation**
241
+
2. Select Download offboarding package and save the file in a location you can access from your domain controller.
242
+
3. From the domain controller, extract the zip file you downloaded from the Microsoft Defender portal, and run the `DefenderForIdentityOnlyOffboardingScript_valid_until_YYYY-MM-DD.cmd` script as an Administrator.
243
+
4. To fully remove the sensor, navigate to **Settings** > **Identities** > **Sensors**, select the server and click Delete.
244
+
228
245
## Next steps
229
246
230
247
For more information, see [Manage and update Microsoft Defender for Identity sensors](../sensor-settings.md).
The minimal required permission for an analyst to view Microsoft Sentinel data is to delegate permissions for the Azure RBAC Sentinel Reader role. These permissions are also applied to the unified portal. Without these permissions, the Microsoft Sentinel navigation menu isn't available on the unified portal, despite the analyst having access to the Microsoft Defender portal.
9
+
10
+
A best practice is to have all Microsoft Sentinel related resources in the same Azure resource group, then delegate Microsoft Sentinel role permissions (like the Sentinel Reader role) at the resource group level that contains the Microsoft Sentinel workspace. By doing this, the role assignment applies to all the resources that support Microsoft Sentinel.
0 commit comments