You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/android-configure.md
+6-4Lines changed: 6 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
title: Configure Microsoft Defender for Endpoint on Android features
3
3
description: Describes how to configure Microsoft Defender for Endpoint on Android
4
4
ms.service: defender-endpoint
5
-
ms.author: priyankagill
6
-
author: priyankagill
7
-
ms.reviewer: priyankagill
5
+
ms.author: ewalsh
6
+
author: emmwalshh
7
+
ms.reviewer: denishdonga
8
8
ms.localizationpriority: medium
9
9
manager: deniseb
10
10
audience: ITPro
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: android
17
17
search.appverid: met150
18
-
ms.date: 11/22/2024
18
+
ms.date: 02/11/2025
19
19
---
20
20
21
21
# Configure Defender for Endpoint on Android features
@@ -38,6 +38,7 @@ For more information about how to set up Defender for Endpoint on Android and Co
38
38
> [!NOTE]
39
39
> Defender for Endpoint on Android only supports creating custom indicators for IP addresses and URLs/domains.
40
40
>
41
+
> IP `245.245.0.1` is an internal Defender IP and should not be included in custom indicators by customers to avoid any functionality issues.
41
42
> Also, alerts for custom indicators are currently not supported for Defender for Endpoint on Android.
42
43
43
44
Defender for Endpoint on Android enables admins to configure custom indicators to support Android devices as well. For more information on how to configure custom indicators, see [Overview of indicators](indicators-overview.md).
@@ -332,4 +333,5 @@ Use the following steps to configure the Device tags:
332
333
-[Overview of Microsoft Defender for Endpoint on Android](microsoft-defender-endpoint-android.md)
333
334
334
335
-[Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](android-intune.md)
336
+
335
337
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
Copy file name to clipboardExpand all lines: defender-endpoint/api/get-assessment-software-vulnerabilities.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.topic: reference
15
15
ms.subservice: reference
16
16
ms.custom: api
17
17
search.appverid: met150
18
-
ms.date: 01/31/2025
18
+
ms.date: 02/11/2025
19
19
---
20
20
21
21
# Export software vulnerabilities assessment per device
@@ -395,7 +395,7 @@ Each returned record contains all the data from the full export software vulnera
395
395
|ExploitabilityLevel|String|The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)|ExploitIsInKit|
396
396
|FirstSeenTimestamp|String|First time the CVE of this product was seen on the device.|2020-11-03 10:13:34.8476880|
397
397
|ID|String|Unique identifier for the record.|123ABG55_573AG&mnp!|
398
-
|LastSeenTimestamp|String|Last time the CVE was seen on the device.|2020-11-03 10:13:34.8476880|
398
+
|LastSeenTimestamp|String|Last time the software was reported on the device.|2020-11-03 10:13:34.8476880|
399
399
|OSPlatform|String|Platform of the operating system running on the device; specific operating systems with variations within the same family, such as Windows 10 and Windows 11. See Microsoft Defender Vulnerability Management supported operating systems and platforms for details.|Windows10 and Windows 11|
400
400
|RbacGroupName|String|The role-based access control (RBAC) group. If this device isn't assigned to any RBAC group, the value is "Unassigned." If the organization doesn't contain any RBAC groups, the value is "None."|Servers|
401
401
|RecommendationReference|string|A reference to the recommendation ID related to this software.|va--microsoft--silverlight|
Copy file name to clipboardExpand all lines: defender-endpoint/configure-updates.md
+13-8Lines changed: 13 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- tier2
16
16
ms.topic: conceptual
17
17
search.appverid: met150
18
-
ms.date: 01/12/2024
18
+
ms.date: 02/10/2025
19
19
---
20
20
21
21
# Create a custom gradual rollout process for Microsoft Defender updates
@@ -49,19 +49,17 @@ The following table lists the available group policy settings for configuring up
49
49
## Group Policy
50
50
51
51
> [!NOTE]
52
-
> An updated Defender ADMX template are published together with the 21H2 release of Windows 10. A non-localized version is available for download at [defender-updatecontrols](https://github.com/microsoft/defender-updatecontrols) on GitHub.
52
+
> An updated Defender ADMX template is published together with the 21H2 release of Windows 10. A non-localized version is available for download at [defender-updatecontrols](https://github.com/microsoft/defender-updatecontrols) on GitHub.
53
53
54
-
You can use [Group Policy](/windows/win32/srvnodes/group-policy?redirectedfrom=MSDN) to configure and manage Microsoft Defender Antivirus on your endpoints.
55
-
56
-
In general, you can use the following procedure to configure or change Microsoft Defender Antivirus group policy settings:
54
+
You can use [Group Policy](/windows/win32/srvnodes/group-policy?redirectedfrom=MSDN) to configure and manage Microsoft Defender Antivirus on your endpoints. In general, you can use the following procedure to configure or change Microsoft Defender Antivirus group policy settings:
57
55
58
56
1. On your Group Policy management machine, open the **Group Policy Management Console**, right-click the **Group Policy Object** (GPO) you want to configure and select **Edit**.
59
57
60
58
2. Using the Group Policy Management Editor go to **Computer configuration**.
61
59
62
60
3. Select **Administrative templates**.
63
61
64
-
4. Expand the tree to **Windows components > Microsoft Defender Antivirus**.
62
+
4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus**.
65
63
66
64
5. Expand the section (referred to as **Location** in the table in this article) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes.
Use `Set-MpPreference -PlatformUpdatesChannel Beta` to configure platform updates to arrive from the Beta Channel.
95
92
96
93
For more information on the parameters and how to configure them, see [Set-MpPreference](/powershell/module/defender/set-mppreference) (Microsoft Defender Antivirus).
97
94
95
+
## Registry
96
+
97
+
These settings can be confirmed in the registry under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`:
98
+
99
+
-`EngineRing`
100
+
-`PlatformRing`
101
+
-`SignaturesRing`
102
+
98
103
> [!NOTE]
99
-
> You can also use a management tool such as Microsoft Configuration Manager to run PowerShell scripts. See [Create and run PowerShell scripts from the Configuration Manager console](/mem/configmgr/apps/deploy-use/create-deploy-scripts) for guidance on this topic.
104
+
> You can also use a management tool such as Microsoft Configuration Manager to run PowerShell scripts. See [Create and run PowerShell scripts from the Configuration Manager console](/mem/configmgr/apps/deploy-use/create-deploy-scripts).
100
105
101
106
> [!TIP]
102
107
> If you're looking for Antivirus related information for other platforms, see:
Copy file name to clipboardExpand all lines: defender-endpoint/device-health-microsoft-defender-antivirus-health.md
+16-8Lines changed: 16 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.service: defender-endpoint
6
6
ms.author: ewalsh
7
7
author: emmwalshh
8
8
ms.localizationpriority: medium
9
-
ms.date: 02/18/2024
9
+
ms.date: 02/11/2025
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -41,6 +41,8 @@ The Device Health report provides information about the devices in your organiza
41
41
>
42
42
> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](configure-server-endpoints.md#functionality-in-the-modern-unified-solution).
43
43
44
+
## View device health cards
45
+
44
46
In the Microsoft Defender portal, in the navigation pane, select **Reports**, and then open **Device health and compliance**. The [**Microsoft Defender Antivirus health** tab](#microsoft-defender-antivirus-health-tab) has eight cards that report on the following aspects of Microsoft Defender Antivirus:
45
47
46
48
-[Antivirus mode card](#antivirus-mode-card)
@@ -57,14 +59,13 @@ In the Microsoft Defender portal, in the navigation pane, select **Reports**, an
57
59
To access the Device health and antivirus compliance report in the Microsoft Defender portal, the following permissions are required:
58
60
59
61
| Permission name | Permission type |
60
-
|:---|:---|
62
+
|---|---|
61
63
| View Data | Threat and vulnerability management (TVM) |
62
64
63
65
> [!IMPORTANT]
64
66
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
65
67
66
-
67
-
To Assign these permissions:
68
+
To assign permissions, follow these steps:
68
69
69
70
1. Sign in to the <ahref="https://go.microsoft.com/fwlink/p/?linkid=2077139"target="_blank">Microsoft Defender portal</a> using account with Security administrator or Global administrator role assigned.
70
71
@@ -90,12 +91,12 @@ Two cards, [Antivirus mode card](#antivirus-mode-card) and [Recent antivirus sca
90
91
91
92
The remaining six cards report about the Microsoft Defender Antivirus status for devices in your organization:
|[Antivirus engine version card](#antivirus-engine-version-card) <br> [Antivirus security intelligence version card](#antivirus-security-intelligence-version-card) <br> [Antivirus platform version card](#antivirus-platform-version-card)|[Antivirus engine updates card](#antivirus-engine-updates-card) <br> [Security intelligence updates card](#security-intelligence-updates-card) <br> [Antivirus platform updates card](#antivirus-platform-updates-card)|
96
97
| The three version cards provide flyout reports that provide additional information, and enable further exploration. | The three up-to-date reporting cards provide links to resources to learn more. |
97
98
98
-
<sup>{[1](#fn1)}</sup> For the three `updates` cards (also known as up-to-date reporting cards), "**No data available**" (or "Unknown" value) indicates devices that aren't reporting update status. Devices that aren't reporting update status can be due to various reasons, such as:
99
+
For the three `updates` cards (also known as up-to-date reporting cards), "**No data available**" (or "Unknown" value) indicates devices that aren't reporting update status. Devices that aren't reporting update status can be due to various reasons, such as:
99
100
100
101
- Computer is disconnected from the network.
101
102
- Computer is powered down or in a hibernation state.
@@ -139,7 +140,7 @@ To add or remove specific types of information on the **Microsoft Defender Antiv
139
140
The following table contains a list of terms that are new to Microsoft Defender Antivirus reporting.
140
141
141
142
| Column name | Description |
142
-
|:---|:---|
143
+
|---|---|
143
144
| Security intelligence publish time | Indicates Microsoft's release date of the security intelligence update version on the device. Devices with a security intelligence publish time greater than seven days are considered out of date in the reports. |
144
145
| Last seen | Indicates date when device last had connection. |
145
146
| Data refresh timestamp | Indicates when client events were last received for reporting on: AV mode, AV engine version, AV platform version, AV security intelligence version, and scan information. |
@@ -215,9 +216,16 @@ Reports on how many devices in your organization – on the date indicated on th
215
216
Following are descriptions for each mode:
216
217
217
218
-**Active** mode - In active mode, Microsoft Defender Antivirus is used as the primary antivirus app on the device. Files are scanned, threats are remediated, and detected threats are listed in your organization's security reports and in your Windows Security app.
218
-
-**Passive** mode - In passive mode, Microsoft Defender Antivirus isn't used as the primary antivirus app on the device. Files are scanned, and detected threats are reported, but threats aren't remediated by Microsoft Defender Antivirus. IMPORTANT: Microsoft Defender Antivirus can run in passive mode only on endpoints that are onboarded to Microsoft Defender for Endpoint. See [Requirements for Microsoft Defender Antivirus to run in passive mode](microsoft-defender-antivirus-compatibility.md#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode).
219
+
220
+
-**Passive** mode - In passive mode, Microsoft Defender Antivirus isn't used as the primary antivirus app on the device.
221
+
222
+
> [!IMPORTANT]
223
+
> Microsoft Defender Antivirus can run in passive mode only on endpoints that are onboarded to Microsoft Defender for Endpoint. See [Requirements for Microsoft Defender Antivirus to run in passive mode](microsoft-defender-antivirus-compatibility.md#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode).
224
+
219
225
-**Disabled** mode - synonymous with: uninstalled, disabled, sideBySidePassive, and Low Periodic Scan. When disabled, Microsoft Defender Antivirus isn't used. Files aren't scanned, and threats aren't remediated. In general, Microsoft doesn't recommend disabling or uninstalling Microsoft Defender Antivirus.
226
+
220
227
-**Others** mode - Not running, Unknown
228
+
221
229
-**EDR in Block** mode - In endpoint detection and response (EDR) blocked mode. See [Endpoint detection and response in block mode](edr-in-block-mode.md)
222
230
223
231
Devices that are in either passive, LPS, or Off present a potential security risk and should be investigated.
3. Scroll down, and then turn on **Enable EDR in block mode**.
85
+
1. Scroll down, and then turn on **Enable EDR in block mode**.
86
86
87
87
### Intune
88
88
89
89
To create a custom policy in Intune, see [Deploy OMA-URIs to target a CSP through Intune, and a comparison to on-premises](/troubleshoot/mem/intune/deploy-oma-uris-to-target-csp-via-intune).
90
90
91
91
For more information on the Defender CSP used for EDR in block mode, see "Configuration/PassiveRemediation" under [Defender CSP](/windows/client-management/mdm/defender-csp).
92
92
93
+
### Group Policy
94
+
95
+
You can use Group Policy to enable EDR in block mode.
96
+
97
+
1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
98
+
99
+
1. Right-click the Group Policy Object you want to configure, and then select **Edit**.
100
+
101
+
2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
102
+
103
+
3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Features**.
104
+
105
+
4. Double-click **Enable EDR in block mode** and set the option to **Enabled**.
106
+
107
+
5. Select **OK**.
108
+
93
109
## Requirements for EDR in block mode
94
110
95
111
The following table lists requirements for EDR in block mode:
0 commit comments