#Modern Workplace

Every now and then, I get asked by customers for ways of offboarding devices from Defender for Endpoint for various reasons. Most of the time it involves troubleshooting of some sort which requires going off MDE altogether. While I normally recommend to use put the device in troubleshooting mode, sometimes, it is just not the way to go. And therefore, one finds themselves offboarding the devices.  Until now, I had been using the OMA-URI way of offboarding a device in Intune, but recently I stumbled upon another way which I had no idea it ever existed. Did you know that you can use EDR to offboard a device? Surprise, surprise. I always used EDR under endpoint security in Intune, to use the blob connector to onboard a device. However, the same EDR profile also allows offboarding devices using value from the WindowsDefenderATP offboarding package. Here is how you can go about - 1. Head over to the Microsoft Defender admin portal. 2. Navigate to Settings > Endpoints > Offboardin...

I recently worked on a project that required setting up Intune and Defender for Endpoint enrolment policies for iPadOS. While some might say that this is a pretty routine task and in an absolute sense, it may very well be to some extent, I actually went another way. Let me start by mentioning that the iPadOS devices in scope were existing devices and in some come cases BYO so resetting them was not an option. Therefore, a user based enrolment had to be the choice of enrolment. Now back in the days, one would normally enroll the iOS\iPadOS devices using Company Portal and while this is still supported, with the introduction of support of Single Sign On extensions (SSO) of Apple devices, I chose to configure Web based device enrolment together with Just-in-time (JIT) for iPadOS devices. Web-based enrolment utilizes just in time (JIT) registration with the Apple single sign-on (SSO) extension to facilitate Microsoft Entra registration within the work apps thus reducing the number of authe...

  Microsoft Defender XDR (Rebranded and formerly known as Microsoft 365 Defender) has many features and as part of Advanced hunting under incident & response, Custom detections is a great way to create rules to monitor events and system states proactively, including suspected breach activity and misconfigured endpoints. One can then enable & configure response actions using various device & identity attributes and set them to run at regular intervals, generating alerts. Custom detections uses Advanced hunting which is based on the Kusto Query Language (KQL) which is a powerful tool that uses schema entities organized in a hierarchy similar to SQL. The language is expressive, easy to read and understand. To manage custom detections, you need to be assigned one of these roles permissions at a minimum: - Security settings - Security administrator - Security operator To understand Custom detections better, I wanted to explore the possibility of initiating a response a...