Ru Campbell MVP

Three months after the last big refresh, I’ve worked through Microsoft’s Defender documentation again and updated my cross-platform comparison of Microsoft Defender for Endpoint features by operating system.

Paul, Ian, and I just finished publishing the second edition of MDE In Depth, so to coincide, I’ve refreshed the comparison of MDE features and capabilities by OS type.

Cross-platform comparison of Microsoft Defender for Endpoint and Defender for Business features by operating system.

When we talk about Microsoft 365 security, we are talking about two things: Securing Microsoft 365 the platform, such as Exchange Online, SharePoint Online, Microsoft 365 Copilot; ensuring they are hardened and monitored in proportion to risk appetite.

April 1, 2024, seen the release of Microsoft Copilot for Security to general availability (GA).

Finally, it’s time for a refresh.

Defender for Cloud Apps (MDA) is such a hidden gem.

Signals from across Microsoft’s services and ecosystems inform Entra ID Protection to detect risk.

It’s a trope in IT circles: users forget their passwords.

Microsoft Defender Vulnerability Management (MDVM) is an often overlooked service that can be licensed standalone or is included in other Microsoft Defender licenses.

Exchange Online Protection (EOP) and Microsoft Defender for Office 365 (MDO) are the email and collaboration security services native to Microsoft 365.

Entra ID’s P2 license (previously Azure AD Premium P2) unlocks the Privileged Identity Management (PIM).

Conditional Access (CA) is front and center of any attempt to secure Microsoft 365.

In one of the biggest changes to Microsoft Defender for Endpoint (MDE) in its product history, you no longer need a separate management engine to configure endpoint settings.

Conditional Access is the most important security feature you will configure in Azure AD.

Microsoft Defender for Endpoint (MDE) is a massive stack of endpoint protection and endpoint detection and response (EDR) capabilities.

This is the updated “matrix” of OS supported for the almost 80 features, services, and important components that make up Microsoft Defender for Endpoint.

It’s been about 5 months since I last updated my comparison of Defender for Endpoint features by OS.

I recently read through an excellent article by Mandiant , which recently split with FireEye, on their findings and analysis of the continued actions of suspected nation-state actor NOBELIUM.

In July, I released v1 of The Big Comparison of Defender for Endpoint Features by Operating System (or, what I think is much catchier, TBCMDEFOS).

New protection capabilities for Microsoft Defender for Endpoint (MDE) customers have landed in public preview, Oct 7 ‘21, for Windows Server 2012 R2 and Windows Server 2016.

The basics Let’s start this article with some basic cybersecurity terminology.

Microsoft Defender for Endpoint (MDE) is a massive platform.

This will be a brief blog, as I am certainly not a DHCP expert or day-to-day administrator.

Office 365, or Microsoft 365 Apps for Enterprise, or whatever it’s called this month, can be deployed by Intune to Windows 10 devices using a built-in wizard.

In my last blog, I wrote about three considerations for your Azure Information Protection deployments and commented on often overlooked potential downsides, or at least areas with which to be cautious.

Azure Information Protection (AIP) - more accurately exposed to Microsoft 365 now as sensitivity labels- is close to the top of my favourite wins for securing your data in a Microsoft ecosystem.

The Azure Mask browser extension is a really great tool when either recording on-screen demos or sharing your screen.

As I have blogged about a lot , there are a bunch of hoops to be jumped through and prerequisites to be met for a successful hybrid Azure AD join and automatic, GPO-invoked Intune enrollment.

Most of us have had that “oh < blank >” moment where we have given someone access to someone only to immediately or later need to undo that access.

A common Conditional Access policy is to add trusted locations as an exception to multi-factor authorisation requirements.

BitLocker unique identifiers are values used to identify the ownership of an encrypted volume.

When you authenticate with Azure AD, Conditional Access policies let you apply if-then rules for licensees of Azure AD Premium P1 or P2.

Although not common, there are scenarios out where you will have LAN-only devices onboarded in Microsoft Defender for Endpoint (MDE), or at least using Microsoft Defender Antivirus (MDAV).

When configuring Defender for Endpoint (MDE) customer recently, I ran into a problem when trying to enable network protection.

With Microsoft Information Protection, you can apply sensitivity labels to files, emails, and containers such as SharePoint Libraries.

Getting your devices into Defender for Endpoint is referred to as onboarding and can be done in lots of different ways, depending on the scenario.

In Microsoft Defender for Endpoint (MDE), tags can be attached to a device for reporting, filtering, and as a dynamic attribute for membership of a device group.

To provision Windows 10 PCs using Autopilot and Intune, they must first be registered as Windows Autopilot devices in the Device Directory Service, which is really the cloud Autopilot service.

Application Guard first appeared in Windows 10 1709 (“Fall Creators Update”) to isolate Edge browser activity within a Hyper V container.

Since October 2019, Microsoft has enabled Security Defaults by default in new Microsoft 365 tenants.

As you move from on-premises or third-party infrastructure to Microsoft 365 and Azure AD, you will want to keep those BitLocker recovery keys safe.

In the name of transparency, or maybe stating the bleeding obvious, I confess I am that guy who can happily read an IT reference book or something like docs.microsoft.com or Practical 365 in the way someone else would read a popular fiction book.

Today I’m sharing a useful bit of PowerShell I gracelessly punt from script to script whenever I need to make sure a prerequisite it met before running something and to keep checking until it’s met, then run what I need: “do X when Y is ready and keep che…

Microsoft Cloud App Security (MCAS), Redmond’s cloud app security broker (CASB) offering, is a powerful tool for investigating and pro-actively controlling your SaaS estate.

After being released to Public Preview last month (July 2020), I have finally had a chance to test out Microsoft Endpoint DLP.

This blog is the last in a small series on Azure AD Premium P2’s Identity Governance toolkit.

This blog is the second in a small series on Azure AD Premium P2’s Identity Governance toolkit.

This blog is the first in a small series on Azure AD Premium P2’s Identity Governance toolkit.