In questo articolo, andremo ad illustrare come poter gestire e come poter eseguire l'onboarding dei device in Microsoft Defender for Endpoint quando non sono gestiti da dominio locale o da Microsoft Intune.
Riportiamo come prima cosa i prerequisiti che devono essere rispettati per poter implementare questa funzionalità:
Connectivity:
Devices must have access to the following URLs:
- enterpriseregistration.windows.net – For Azure AD registration.
- login.microsoftonline.com – For Azure AD
registration.
- *.dm.microsoft.com –
The use of a wildcard supports the cloud-service endpoints that are used
for enrollment, check-in, and reporting, and which can change as the
service scales.
Operating system (KB’s installed):
The following platforms are supported. Some of them
require a specific KB or higher for enabling the new management option.
- Windows
10 Professional/Enterprise: with KB5006738
- Windows
11 Professional/Enterprise
- Windows Server 2012
R2: with Microsoft Defender for Down-Level Devices
- Windows Server
2016: with Microsoft Defender for Down-Level Devices
- Windows
Server 2019: with KB5006744
- Windows
Server 2022: with KB5006745
Operating systems Not supported:
The following operating systems are currently not
supported:
- Domain controllers (
Reason: Azure Active Directory Trust is required)
- Server
Core installations
Source: Microsoft Frequently asked questions and
considerations
Active Directory joined devices:
- Authentication
with a domain controller
- Azure AD connect
configured to sync computer objects which are in scope
- Sync rule enabled for
2012 R2 ( only if 2012R2 is needed)
- Azure Active Directory
Tenant ID from Microsoft Defender for Endpoint Tenant matching SCP entry
of a domain
- Onboard
device to MDE
- Trust is established
between devices and AzureAD. Target AzureAD object is located in the
configured MDE tenant. If not already available, the process will create a
new trust.
- Devices use their Azure
AD Identity to communicate with Endpoint Manager and create objects in
MEM/Intune.
- Deploy
policies to AzureAD Group
- Apply
and report policy
·
Login con credenziali global admin https://security.microsoft.com
SETTINGS à
ENDPOINT à
ENFORCEMENT SCOPE
Abilitare le funzionalità evidenziate (è fondamentale la
spunta in “PILOT MODE”)
Secondo Step:
Login nel portale MEM https://endpoint.microsoft.com
Attivare le spunte evidenziate nella schermata sottostante
Creare un ruolo nella console di Microsoft Defender (SETTINGS --> ROLE):
Quarto step:
·
Recarsi in https://portal.azure.com
Creare un gruppo dinamico con le seguenti impostazioni:
Adesso siamo pronti per la configurazione dei profili:
Come ultimo step fondamentale bisogna creare una TAG da
assegnare ai device nel portale di DEFENDER:
Per verificare che le impostazioni si siano applicate
correttamente verificare che in MEM il device risulti gestito da MDE:
Tutte le immagini sono prese da www.microsoft.com e sono di loro propietà.
·