Welcome to the third part of my blog series. In this blog series, I’ll give you a tour through the features that Microsoft Endpoint Manager offers us. In the last two blogs, we looked at the topics of device and application management. Today we would like to take a look at device security. The biggest goal companies have is to protect their devices and data from outsiders. Every day there are new attack methods or threats that companies need to protect against. MEM provides many features that use the power of the cloud to achieve this goal. At the center of this is Microsoft Defender for Endpoint.

More blogs from this series:

• Part 1 – Devices
• Part 2 – Applications
• Part 3 – Endpoint Security – this blog
• Part 4 – Reports
• Part 5 – User and Groups

Where can I find the security features in MEM Portal?

These features can be found in the Endpoint Security menu on the left side of the MEM portal. At the center of this is Microsoft Defender for Endpoint.

When you open this menu, you will land on an Overview page. Here you will get tips for the first steps and a short explanation of what Endpoint Security is. The description from Microsoft is as follows:
Enable, configure, and deploy Microsoft Defender for Endpoint to help prevent security breaches and gain visibility into your organization’s security posture.

All devices

A similar menu is already familiar to us from the previous blogs. Here you get an overview of all devices and their security status. You can see the compliance state of the devices, which OS build they are running and when the last check-in to Intune was.

Security baselines

Security baseline are predefined security settings to make the start into a modern management with Windows 10 easier and secure. These policies were created by security experts from the industry. These baselines are updated by Microsoft with each release of a new Windows version. You can still customize the predefined settings when you create them.

Security tasks

Microsoft Defender for Endpoint can be used to scan the entire environment for current threats. If a security event is detected in the Microsoft Defender Security Center that needs to be fixed in MDM, a security colleague can create a task to have an MDM colleague look at it. When the task is done, it can also be marked as done.

Antivirus

In this section you have on the one hand several reports and on the other hand you can create antivirus policies. On the home page you can see the health status of the endpoints and a count of active malware.

With the “Unhealthy endpoints” report you get a list of clients where the security status is not given, e.g.
Signature update overdue. In the “Active malware” report you get a list of active malware in your company.

You also have the possibility to distribute antivirus configurations for server operating systems. These must be integrated into the ConfigMan.

There are 4 types of policies that can be created:

• Microsoft Defender Antivirus exclusions (Windows 10)
• Windows Defender Antivirus (Windows 10)
• Windows Security experience (Windows 10)
• Antivirus (macOS)

Disk encryption

In this section you can configure Bitlocker on Windows or FileVault on Mac. Disk Encryption helps you protect your data on the device in case the device is lost or stolen.
Here you can configure the security as well as the usability of both services. The encryption keys are backed up in the MEM.

Firewall

ere you have 2 types of configuration. You can configure the general behavior of the firewall via “Microsoft Defender Firewall” and you can allow or block individual connections via “Microsoft Defender Firewall rules”.

Endpoint detection and response

This feature provides advanced attack detection by collect cyber telemetry data that is applied in near real time. This data is retained for up to 6 months and provides analysts with the ability to go back to specific times when an attack occurred. This data can also be used for forensic capabilities. Here the options “Sample sharing for all files” and “Expedite telemetry reporting frequency” can be configured.

Attack surface reduction

ASR policies are mitigation options for known attack surfaces. As of today, there are 6 different types of policies that can be created.

Account protection

This feature is a preview feature. Here is a second place where you can configure Windows Hello for Business. The login with security keys and the credential guard can also be activated in this menu. Windows Defender Credential Guard can be used to additionally secure credentials under Windows 10 and protect them from attacks. In this option

Device compliance

Compliance Policy can ensure the security of devices and the protection of corporate data. With the help of this policy, devices can be marked as compliant or not compliant. These are rules that define what a device must comply with, such as Bitlocker encryption, a minimum OS version, etc.

 This device status can be used for conditional access.

There are the following submenus for the compliance policies area:

Conditional access

Access policies are definitions/instructions that a user or device must meet in order to access certain resources. For example, if you need to access certain data, a pre requisite may be that your device must be complaint.

A other example: if a user is outside the company network a multi factor authentication is required.

 

Assignment failures

Policies for which the assignment failed are displayed here. This can be a security risk if certain policies do not take effect on devices.

Microsoft Defender for Endpoint

In this menu you can enable Windows Defender Advance Threat Protection and connect it to Intune. Additionally you have here the possibility to provide the machine risk score for compliance policies. You will also find a reporting on how many devices defender is installed on.

Help and support

This menu can be found in several places in the MEM portal. Here you have the possibility to get help, to open tickets or to access already opened tickets.

In the last year, Microsoft has seen a 40% growth in sales in the security sector. Microsoft also invests over one million euros in this area every year. This can also be seen in Intune. There are also countless features to increase the security in your company. Here we can also expect many new features in the future.

Thank you very much for reading this blog. If you like this blog I would be very happy about a like or a share.

We hear us in the next part of this series.
Until then:

Stay healthy, Cheers
Jannik