{"id":5205,"date":"2022-08-30T21:51:34","date_gmt":"2022-08-30T19:51:34","guid":{"rendered":"https:\/\/jeffreyappel.nl\/?p=5205"},"modified":"2024-01-03T17:43:25","modified_gmt":"2024-01-03T15:43:25","slug":"microsoft-defender-for-endpoint-series-onboard-defender-for-endpoint-part3","status":"publish","type":"post","link":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-onboard-defender-for-endpoint-part3\/","title":{"rendered":"Microsoft Defender for Endpoint series \u2013 Onboard Defender for Endpoint \u2013 Part3"},"content":{"rendered":"\n

It is time for part 3<\/strong> of the ultimate Microsoft Defender for Endpoint (MDE) series. After part 2 (configuration MDE) we are now going to deep-dive more into the initial onboarding of Defender for Endpoint. In part 2 the question; how to configure Defender for Endpoint service settings <\/em>is answered \u2013 view the previous part here<\/a>.<\/p>\n\n\n\n

Important: Defender AV\/ Next Generation Protection onboarding is critical and part of the complete protection platform. All AV\/ Next Generation Protection information will be explained more in-depth including migration from other AV\/ Passive mode\/ EDR block and more. <\/p>\n\n\n\n

Introduction blog series<\/strong><\/h2>\n\n\n\n

This ultimate blog series<\/a> will contain as much information as possible based on my Defender experience in the past years. Other platforms like iOS, Android, Linux, and macOS will follow when it’s a success.<\/p>\n\n\n\n

NOTE: Blog series is focussing on features in Microsoft Defender for Endpoint P2<\/strong> all Microsoft Defender for Endpoint P1<\/strong> features are available in P2.<\/p>\n\n\n\n

Specific question or content idea part of Defender for Endpoint? Use the contact submission<\/a> form and share the post ideas.<\/strong><\/p>\n\n\n\n

\n\n\n\n

Prerequisites<\/h2>\n\n\n\n

Defender for Endpoint needs some prerequisites for correctly using the services. To avoid onboarding problems, start configuring the prerequisites and validate the configuration based on some machines. <\/p>\n\n\n\n

View all prerequisites here: Minimum requirements for Microsoft Defender for Endpoint<\/a><\/p>\n\n\n\n

Network<\/strong><\/h3>\n\n\n\n

Internet connectivity on devices is required directly or through a system proxy. The Defender for Endpoint sensor requires Microsoft Windows HTTP (WinHTTP) for communication with the Defender for Endpoint service. Defender for Endpoint sensors runs in system context based on the LocalSystem account. <\/p>\n\n\n\n

It is recommended to validate the service domains and confirm access to Defender for Endpoint service URLs<\/p>\n\n\n\n

The following downloadable spreadsheet lists the services and their associated URL that must be available for each endpoint. Confirm there are no firewalls or created network filtering rules blocking the URLs. Download the commercial spreadsheet here<\/a><\/p>\n\n\n\n

The spreadsheet contains multiple geography URLs, open all URLs where the geography column is WW and the specific location where Defender data is located (data storage location) – View part 2<\/a> for more information.<\/p>\n\n\n\n

Important: HTTPS scanning \/ SSL inspection is common in larger environments. When using HTTPS scanning make sure all URLs are excluded from the SSL inspection technique.<\/p>\n\n\n\n

For devices with no direct internet connection, the use of a proxy solution is recommended. Previously it was possible to use MMA-based solutions and the OMS gateway. With the new modern Defender for Endpoint client it is possible to configure MDE using a proxy configuration. <\/p>\n\n\n\n

For Windows devices, see Configure device proxy and Internet connectivity settings<\/a><\/p>\n\n\n\n

When there is no direct internet configuration it is possible to send all the telemetry information via the proxy. Recommended read is the blog published by Brian Baldock: <\/p>\n\n\n\n