Skip to content

Commit e80db81

Browse files
Learn Editor: Update linux-exclusions.md
1 parent 5aa365f commit e80db81

File tree

1 file changed

+6
-10
lines changed

1 file changed

+6
-10
lines changed

defender-endpoint/linux-exclusions.md

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,11 +87,11 @@ Wildcard|Description|Examples|
8787
8888
## How to configure the list of exclusions
8989

90-
You can configure exclusions using a management console, Defender for Endpoint security settings management, or the command line.
90+
You can configure exclusions using a management Json configuration, Defender for Endpoint security settings management, or the command line.
9191

9292
### Using the management console
9393

94-
To configure exclusions from Puppet, Ansible, or another management console, please refer to the following sample `mdatp_managed.json`.
94+
In enterprise environments, exclusions can also be managed through a configuration profile. Typically, you would use a configuration management tool like Puppet, Ansible, or another management console to push a file with the name `mdatp_managed.json` at the location `/etc/opt/microsoft/mdatp/managed/`. For more information, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md). Please refer to the following sample of `mdatp_managed.json`.
9595

9696
```JSON
9797
{
@@ -138,14 +138,13 @@ To configure exclusions from Puppet, Ansible, or another management console, ple
138138
}
139139
```
140140

141-
For more information, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md).
142-
143141
### Using Defender for Endpoint security settings management
144142

145143
> [!NOTE]
144+
> This method is currently in private Preview. For enabling this feature, please reach out to [email protected].
146145
> Make sure to review the prerequisites: [Defender for Endpoint security settings management prerequisites](/mem/intune/protect/mde-security-integration#prerequisites)
147146
148-
As a security administrator, you can configure Defender for Endpoint exclusions using the Microsoft Defender portal. This method is referred to as Defender for Endpoint security settings management. If you're using this method for the first time, make sure to complete the following procedures:
147+
You can use the Microsoft Intune admin center or the Microsoft Defender XDR portal to manage exclusions as endpoint security policies and assign those policies to Microsoft Entra ID groups. If you're using this method for the first time, make sure to complete the following steps:
149148

150149
#### 1. Configure your tenant to support security settings management
151150

@@ -155,18 +154,15 @@ As a security administrator, you can configure Defender for Endpoint exclusions
155154

156155
#### 2. Create a Microsoft Entra group
157156

158-
Create a dynamic Microsoft Entra group that uses the operating system type to ensure that all devices onboarded to Defender for Endpoint receive policies. Using a dynamic group allows devices managed by Defender for Endpoint to be automatically added to the group, eliminating the need for admins to create new policies manually. For more information, see the following articles:
159-
160-
- [Create Microsoft Entra Groups](/mem/intune/protect/mde-security-integration#create-microsoft-entra-groups)
161-
- [Microsoft Entra groups overview](/entra/fundamentals/concept-learn-about-groups)
157+
Create a dynamic Microsoft Entra group that uses the operating system type to ensure that all devices onboarded to Defender for Endpoint receive policies. Using a dynamic group allows devices managed by Defender for Endpoint to be automatically added to the group, eliminating the need for admins to create new policies manually. For more information, see the following article: [Create Microsoft Entra Groups](/mem/intune/protect/mde-security-integration#create-microsoft-entra-groups)
162158

163159
#### 3. Create an endpoint security policy
164160

165161
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Endpoints** > **Configuration management** > **Endpoint security policies**, and then select **Create new Policy**.
166162

167163
2. For Platform, select **Linux**.
168164

169-
3. Select the required exclusion template (**Microsoft defender global exclusion (AV+EDR) for global exclusions and Microsoft defender antivirus exclusions for antivirus exclusions**), and then select **Create policy**.
165+
3. Select the required exclusion template (`Microsoft defender global exclusions (AV+EDR)` for global exclusions and `Microsoft defender antivirus exclusions` for antivirus exclusions), and then select **Create policy**.
170166

171167
4. On the **Basics** page, enter a name and description for the profile, then choose **Next**.
172168

0 commit comments

Comments
 (0)