You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can configure exclusions using a management console, Defender for Endpoint security settings management, or the command line.
90
+
You can configure exclusions using a management Json configuration, Defender for Endpoint security settings management, or the command line.
91
91
92
92
### Using the management console
93
93
94
-
To configure exclusions from Puppet, Ansible, or another management console, please refer to the following sample `mdatp_managed.json`.
94
+
In enterprise environments, exclusions can also be managed through a configuration profile. Typically, you would use a configuration management tool like Puppet, Ansible, or another management console to push a file with the name `mdatp_managed.json` at the location `/etc/opt/microsoft/mdatp/managed/`. For more information, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md). Please refer to the following sample of `mdatp_managed.json`.
95
95
96
96
```JSON
97
97
{
@@ -138,14 +138,13 @@ To configure exclusions from Puppet, Ansible, or another management console, ple
138
138
}
139
139
```
140
140
141
-
For more information, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md).
142
-
143
141
### Using Defender for Endpoint security settings management
144
142
145
143
> [!NOTE]
144
+
> This method is currently in private Preview. For enabling this feature, please reach out to [email protected].
146
145
> Make sure to review the prerequisites: [Defender for Endpoint security settings management prerequisites](/mem/intune/protect/mde-security-integration#prerequisites)
147
146
148
-
As a security administrator, you can configure Defender for Endpoint exclusions using the Microsoft Defender portal. This method is referred to as Defender for Endpoint security settings management. If you're using this method for the first time, make sure to complete the following procedures:
147
+
You can use the Microsoft Intune admin center or the Microsoft Defender XDR portal to manage exclusions as endpoint security policies and assign those policies to Microsoft Entra ID groups. If you're using this method for the first time, make sure to complete the following steps:
149
148
150
149
#### 1. Configure your tenant to support security settings management
151
150
@@ -155,18 +154,15 @@ As a security administrator, you can configure Defender for Endpoint exclusions
155
154
156
155
#### 2. Create a Microsoft Entra group
157
156
158
-
Create a dynamic Microsoft Entra group that uses the operating system type to ensure that all devices onboarded to Defender for Endpoint receive policies. Using a dynamic group allows devices managed by Defender for Endpoint to be automatically added to the group, eliminating the need for admins to create new policies manually. For more information, see the following articles:
159
-
160
-
-[Create Microsoft Entra Groups](/mem/intune/protect/mde-security-integration#create-microsoft-entra-groups)
161
-
-[Microsoft Entra groups overview](/entra/fundamentals/concept-learn-about-groups)
157
+
Create a dynamic Microsoft Entra group that uses the operating system type to ensure that all devices onboarded to Defender for Endpoint receive policies. Using a dynamic group allows devices managed by Defender for Endpoint to be automatically added to the group, eliminating the need for admins to create new policies manually. For more information, see the following article: [Create Microsoft Entra Groups](/mem/intune/protect/mde-security-integration#create-microsoft-entra-groups)
162
158
163
159
#### 3. Create an endpoint security policy
164
160
165
161
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Endpoints** > **Configuration management** > **Endpoint security policies**, and then select **Create new Policy**.
166
162
167
163
2. For Platform, select **Linux**.
168
164
169
-
3. Select the required exclusion template (**Microsoft defender global exclusion (AV+EDR) for global exclusions and Microsoft defender antivirus exclusions for antivirus exclusions**), and then select **Create policy**.
165
+
3. Select the required exclusion template (`Microsoft defender global exclusions (AV+EDR)` for global exclusions and `Microsoft defender antivirus exclusions` for antivirus exclusions), and then select **Create policy**.
170
166
171
167
4. On the **Basics** page, enter a name and description for the profile, then choose **Next**.
0 commit comments