#Modern Workplace

When it comes to implementing least privilege model for Intune permissions, the most common way is to use the role-based access control (aka RBAC). As a focus for this article, I wanted to touch upon the permissions required for managing endpoint security related settings in Intune, but configured using Defender. Consider a scenario where security and endpoint teams are different. While Endpoint team will normally focus on the administration of managed enterprise devices using Microsoft Intune admin center, security analysts will focus on security aspect of resources using the Defender portal. The real challenge comes, when the two roles start to merge or overlap. This is where strong governance for access permissions can play a crucial role. While implementing RBAC in the respective administration portals is the recommended way to address this, in the off chance that an organization has not implemented this, the relevant permissions, for endpoint security in Intune in particular, can ...

Source:Microsoft While going through the Defender for Endpoint configuration in my tenant, I realized that I had Vulnerability management partially configured for iOS devices and therefore, decided to put things in order. Before I dive into the specifics, here is a little something on what MDE Vulnerability assessment of apps is really all about. As part of MDE, Vulnerability management helps in identifying, assessing, remediating vulnerabilities across all onboarded devices. It delivers asset visibility, intelligent assessments, and built-in remediation tools for Windows, macOS, Linux, Android, iOS, and network devices. With the help of capabilities like Microsoft threat intelligence, breach likelihood predictions, business contexts, and devices assessments, Defender Vulnerability Management continuously prioritizes the biggest vulnerabilities on your most critical assets and provides security recommendations to mitigate risk. In case of iOS specifically, vulnerability assessments sup...

I was recently asked by a customer about the possibility of using mixed licensing for Defender for Endpoint for endpoints. They had both MDE plan 1 and plan 2 licenses as part of M365 E3 and E5 respectively, but wanted all the Windows endpoints to be moved to MDE plan 1 capabilities until all the features under plan 2 were tested out. For a long time this was not possible and in cases of multiple subscriptions, the highest functional subscription would take precedence in the tenant. But not anymore. Microsoft now supports use of a mixture of subscriptions & licenses. Some of the most common scenarios are - 1. Mixed tenant - Different sets of capabilities for groups of users and their devices based off licenses like MDE plan 1 & plan 2, Microsoft 365 E3 & E5. 2. Mixed trial - Mixture of full and trial licenses like MDE plan 1, M365 E3 (purchased for all users) & MDE plan 2, M365 E5 trial (purchased for some users) 3. Phased upgrades - Upgrade user licenses in phases by m...

For the last week or so I have been working on addressing a recommendation flagged in the Defender portal that required configuring Potentially Unwanted Applications (PUA) for macOS. As part of the recommendation, you can either put PUA in 'Audit' or 'Block' mode. I decided to configure it in 'Block' mode and in the process also felt it will be a good time to configure custom attribute for macOS to capture the status of this setting directly in Intune. While Intune's reporting capabilities are evolving ever so much, I feel there is still a lot of catching up to do when it comes to macOS as an operating system. For example, if you want to check the onboarding or AV status in general, you can easily run a report in Intune, but only for Windows. Sure, you can get status through various other methods like Defender Portal, or even by means of custom reports outside Intune, but this is not always desirable, especially for organizations that have heavily segmented ...

If you have onboarded your macOS devices onto Defender for Endpoint, then more often than not, you will see the vulnerability recommendation flagging for ' Secure Home folders in macOS ' affecting the secure score. The potential risk here being is that allowing all users to view the top level of all networked user's home folder may not be desirable since it may lead to the revelation of sensitive information. This is because by default macOS allows all valid users into the top level of every networked user's home folder, with the ability to view the folder content and this can be a security risk. The remediation steps involves running commands in Terminal for each user account with a local home folder to modify the permissions. In my honest opinion, if the macOS devices are meant for single user use, then this recommendation may not really apply. But in case of multiple users, it is a whole different story. Regardless of the device use, if you are looking to address thi...