#Modern Workplace

Consider a scenario where an organization has different teams for managing security of devices across the board using Defender portal and another team for managing endpoints using MEM admin portal. When you have Intune integrated with Microsoft Defender for Endpoint, the security team can request remediation from MEM team in form of a ticket, which will then open a security task for action in the MEM admin portal. The activity of the same can then be monitored in MDE portal by the security team. This integration allows synergy across different teams in an organization by leveraging vulnerability management capabilities within Defender for Endpoint. After you connect Intune to Microsoft Defender for Endpoint, Defender for Endpoint receives threat and vulnerability details from managed devices. There are obviously some pre-requisites involved that you need to take care of - 1. Configure a service-to-service connection with Microsoft Defender for Endpoint. 2. Deploy a device configuration...

Continuing from my previous post on ' Controlled Folder Access - Ransomware Protection, Exclusions, Trusted apps and much more..' , I wanted to cover another application behavior involving Defender policies. The application in question is Bloomberg Excel addin which is widely used across the industry. Formally known as Bloomberg API (Applications Program Interface), is a powerful tool that allows you to deliver Bloomberg data into MS Excel spreadsheet for analysis and calculations. In the absence of exclusions and with the all relevant Defender policies switched on, users would see similar errors as shown below. As always, the best way to understand which all Defender policies are causing this, is to run the Advanced Hunting query to gather details on the device events. There are multiple ways in which a query can be formed, but since I want to know which policies are in question here, I am using a slightly generic query to get details on all possible ActionTypes causing the bl...

Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It does so by checking apps against a list of trusted apps. This is particularly important during Ransomware attacks when user data can get encrypted which is normally found in common system folders. Here is a list of Windows system folders that are protected by default: c:\Users\<username>\Documents c:\Users\Public\Documents c:\Users\<username>\Pictures c:\Users\Public\Pictures c:\Users\Public\Videos c:\Users\<username>\Videos c:\Users\<username>\Music c:\Users\Public\Music c:\Users\<username>\Favorites The protected folders also include boot sectors and you can add more folders, allow specific apps access to the protected folders or exclude them all together. I recently dealt with one such application that needed to be allowed access to the protected folders. The app in question is Symantec Encryption Desktop. The first ind...