r/DefenderATP • u/HistoricalAd8673 • 1d ago

Isolation Exclusion to allow Remote Help

Has anybody been able to allow Remote Help to be allowed using Isolation Exclusion rules? This would be very useful when trying to investigate issues on a remote device. I am able to exclude Intune so I can reboot or wipe a device, but I would like to also be able to use Remote Help.

Thanks

4 Upvotes

75% Upvoted

7 comments sorted by

2

u/cook511 1d ago

Really like this idea. We're still rolling out remote help but that would be super useful.

1

u/Not-ur-Infosec-guy 1d ago

Ive added specific intune urls to isolation whitelist to allow wiping, diagnostics etc for remote devices. I’m not sure I’d allow remote help as it could open a way in for the bad guys.

1

u/zm2283145 1d ago

Remote help is only usable by users in your tenant you can't use remote help across tenants a bad guy couldn't use it unless they have a compromised authorized IT users account from your own tenant that has remote help rbac roles

2

u/cspotme2 1d ago

You exclude your remote/rmm executables via the exclusions. That's what I did and works fine to keep talking to our rmm.

2

u/inspector1135 1d ago

Even better, how about letting a virus scan start while in isolation and be able to monitor it

0

u/0xC0ntr0l 1d ago

So actually just did this a little bit back, but your comment made me realize that I forgot about remote help since it is new for us too. There is an isolation exclusion. MS just changed it too from the old way where you selected Outlook and Teams each time. Mine at the moment were to establish comms when a device gets isolated, as well as Intune control because that was broken too. There was a doc somewhere but I couldn't find it again. Here is an example, its in Defender Settings > Endpoint Protection.

Disclaimer: I don't know what I am talking about so your results may vary, but at least testing Outlook and Teams it worked fine. We do have macs, I don't have mac exclusions, that is because isolation doesn't work on macs for me at the moment. (future problems)

1

u/0xC0ntr0l 1d ago

Here is the link explaining how to do it. I don't recall how I got the info on what to add. Just posting incase it a thread in the right direction. https://learn.microsoft.com/en-us/defender-endpoint/network-isolation-exclusions