#Modern Workplace

  Network protection utilizes functions in SmartScreen to block phishing activities from malicious command and control sites. When an end user attempts to visit a website in an environment in which network protection is enabled, a toast notification may be presented based on the reputation of the URL. What if you don't want to give the user the ability to circumvent the blocked action at all? This is where the challenge lies, but luckily there is a way. First, let's look at the scenarios under which NP operates. 1. The URL has a known good reputation - In this case the user is permitted access without obstruction, and there's no toast notification presented on the endpoint. In effect, the domain or URL is set to Allowed. 2. The URL has an unknown or uncertain reputation - The user's access is blocked, but with the ability to circumvent (unblock) the block. In effect, the domain or url is set to Audit. The user will have access to the site for 24 hours; at which point th...

In Windows 10 and 11, the operating system can provide protection from malicious code by isolating certain processes in the PC’s memory using virtualization on supported hardware. This protection runs under Memory Integrity under Core Isolation feature. With Windows 11 22H2, Microsoft made this feature default. However, as of writing this post, Memory Integrity will only turn on new devices by default. For existing devices upgrading to Windows 11 22H2, the feature will need to be managed separately. Memory integrity is also known as Hypervisor-protected Code Integrity (HVCI). Being a device guard feature, it hasn't made to the dedicated security profiles under Endpoint Security Attack Surface Rules in Intune as a standalone policy. Official documentation by Microsoft suggests that it can be enabled as part of Applocker Code Integrity CSP .  Alternatively, one can also enable it through the Applocker policy in Application control ASR, if you want to enable Applocker policy as a w...

If you are managing Microsoft Defender AV and Microsoft Defender for Endpoint policies using Intune, then chances are that you may come across an issue where Windows Defender Real-Time Protection doesn't enable after a device has been provisioned using Autopilot. I started experiencing this issue lately which also resulted in device reporting as non-compliant.  On further investigation, I found out that Windows Defender Antimalware Real-Time Protection was not getting enabled because of the missing of Antimalware Engine. This is clearly evident under Windows Security > Settings > About section. It appears that the check for security intelligence updates was not getting initiated during and post provisioning and the updates were not coming down automatically. This is odd because I have got the policies for automatic update of Defender AV updates enabled as part of my policies in Intune. I must state that in my case the operating system is Windows 11 Enterprise and the devices ...

Recently, I had published a blog on enforcing MFA using Conditional Access policy for Windows 365 Cloud PCs . Now, in an effort to further improve the security of Cloud PCs, I am now covering the process of enforcing compliance for Microsoft Defender for Endpoint with Conditional Access, based on risk levels for Windows 365 Cloud PCs. Why enforce compliance for MDE in the first place? Short answer is - Why not? Not so short answer is that if you are licensed for MDE and have your endpoints onboarded in MDE and managed for MDE policies using Intune, then you can apply device compliance policies and use Conditional Access to identify threats. Once in place, these policies can help in identifying non-compliant devices which in turn can help in setting restrictions around access of corporate resources. Until the device risk level has fallen under the allowed level in the compliance policy, the restrictions will continue to stay in place. Let's look at the steps for putting the configur...