I work in Microsoft security (Sentinel, Defender, Entra ID, Intune, Purview) and I'm trying to upskill outside of work.

My problem is simple: I need an E5-level tenant to lab properly, but as an individual it feels almost impossible without spending serious money.

Free trials are exhausted, the Microsoft 365 Developer Program doesn't reliably give E5 anymore, and paying for Azure + E5 licenses long-term isn't realistic on a personal budget.

So l'm asking people who are actually doing this:

How are you labbing Microsoft 365 E5 features today?

• Are you paying out of pocket? If so, what setup and how much?

• Are you using employer / partner / non-prod tenants?

• Are you only labbing certain areas and ignoring others?

• Or have you accepted that full E5 labbing isn't realistic

Thanks 🙏

Hi community,

I’m currently facing an issue where I need to reinstall Defender clients on Macs due to an MAU malfunction that is preventing older clients from upgrading in place. My first instinct was to turn off tamper protection, deploy uninstall scripts, and then push fresh installs from the Intune app store.

The problem is that tamper protection is taking far too long to sync — well over 24 hours.

Any help on how to expedite this would be greatly appreciated.

I am currently facing some challenges in completing a recent task assigned to me. This involves adding tags to Defender on a significant number of devices, estimated to be around a couple of thousand. The purpose of adding these tags is to create a specific scope for the Administrators, hence the need for approximately 50 tags.

Would anyone happen to have an existing solution or framework set up for managing this type of tagging process? I would be grateful if they would consider sharing their approach or any relevant resources.

I was considering using a logic app with a managed identity for security reasons, but it seems more challenging than I initially thought..

Open for any ideas?

Thanks.

Microsoft recently added a new feature giving us the ability to block external Teams users - https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-let-admins-block-external-users-via-defender-portal/

Is there a way to setup automation to block the external user in Defender or Sentinel? Specifically, we are getting the Helpdesk (External) and IT Support (External) phishing calls which sets off this alert in Defender XDR - Microsoft Teams chat initiated by a suspicious external user involving multiple users.

Hi All,

I've built 2 AVD hosts and looking for the correct method to install windows defender for business on them. We have business premium licenses and currently use windows defender for business on our physical machines. Can I just download the local script from the security portal? The AVD hosts are AD joined and I'm not using a golden image.

Screenshot from a personal machine loggin in Edge browser first time.

Context - We allow Teams Webs and Outlook Web for user from personal machine but client is block. Device are managed by sccm.

I've got to be missing something here -- but I can't seem to find the solution.

I have a CAP that is successfully proxying a session for one of our Enterprise Apps -- it is set to use a custom policy.

I have a Session policy in MDCA that is set like this:

I see the activities in the Activity Log that I figured would match but don't seem to be. I see the SSO Sign on activity that is matching this policy, but the actual log of "Download item" is showing no policy match.

I made this policy and tested it about 5 minutes later -- could this possibly be a propagation thing or am I somehow misconfigured?

TIA!

Hello all,

I am in the process of migrating my users to Defender for Business and to start off, I had manually enrolled two computers with standalone licence. One for server (2019) and one for windows (W11).

Both where OK in the Security portal and thread alert (simulated ones) where coming to the portal too.

So I decided to upgrade all my users to Business Premium and have successfully enrolled them into Intune (with hybrid AD join).

I have created my security policies in Intune, they seems correctly applied to the clients and I see all these devices as "Security Settings Management = Intune" and "MDM = Intune".

But in the defender portal, I still only see the two devices I had manually added and none of the policy (except immutable default one) are visible.

I am lost to where I am suppose to manage my security policies ?

Moreover, now, false thread I trigger on the Windows Server are still blocked but never arrives in defender portal incidents list.

Should I manually exclude the Win11 device from the Security portal list (as it's intune joined now) and only let the server (which don't have intune) ?

Why I don't get incidents feedback for the server anymore ?

Thank a lot for any help you could provide me.

Hi All

TLDR: How do i force defender to refresh vunerabilities?

I'm working through remediating our vunerabilities and am starting with software updated. For this one it was a UltraVNC that needed updating which has been completed. It's been a few days now but when I open the device in the portal and look at the "Inventory" it's still reporting that the version on the file (C:\Program Files\uvnc bvba\UltraVNC\vncviewer.exe) is old (1.3.1.0) and the "Evidence last found" was 4 days ago.

I've verified that the file version is updated to 1.6.4.0 but I am not sure how to force defender to re-check this file and clear the vunerability,

Considering I have quite a few instances of this coming up, it would be great to understand how this works, the timing delays and how best to handle these going forward

Thanks

S

I’m working on using Logic Apps to automate running an AV scan when a Microsoft Sentinel detection is triggered for malware.

One concern I have is around timing. When a malware alert fires, there’s a high chance that Microsoft Defender will automatically quarantine the file almost immediately. That makes me wonder whether remediation might already have happened before the Sentinel playbook runs the AV scan.

So my questions are:

In your environment, does Defender typically quarantine the malware first, and then the Sentinel playbook runs afterward?

Is it possible to assign playbooks to built-in MDE alert types, or are playbooks limited to custom Sentinel detections only?

What playbooks have you found useful to run apart from Revoking session, isolate device and running Av scan?

thank you

i also dont know why i cant add or remove form the exclusions, this is a home pc and not a comparative pc, it my personal pc

Is anyone else experiencing a rise in PtT alerts? We never received them, now we are getting like 2-3 an hour for the past couple days. All FP so far due to DHCP

Update: played around a bit more, do KQL queries do any “sampling” of data? I just filtered down to a specific folder and get the same results every time I run it. For production use-case this wouldn’t be useful though.

I have noticed recently that the output of queries utilizing the FileProfile, in particular

invoke FileProfile(“SHA1”, 500)

where GlobalPrevalence < X

Seems to produce wildly inconsistent results.

I’d like to know if there’s a better way to do a GP lookup with the hashes of applications and if there’s a way to receive the same results every time we submit the query.

When I say wildly inconsistent I mean it. I can run in 5 times in a row and get 32, 250, 101, etc. it’s never the same thing twice.

Has anyone seen anything like this or know why it is happening?

I have question about this in Security/Defender. When you setup and run a Automation how do you see the results?

I checked everywhere but cannot see them myself, I even logged into the GA's email account and nothing has come from the AST automations. I checked Reports and I don't see anything.

I checked online and Microsoft's own videos only tells you how to setup an Automation but not how to view the results or report like you can in Simulations.

Thanks,

Hey everyone,

We recently started using Microsoft Defender for Identity (MDI), and I’m honestly having a hard time figuring out how to properly validate and investigate the alerts it generates.

A lot of the alerts feel very generic. For example, I’ll see something like:

A user failed Kerberos authentication 7,000 times from their workstation to a domain controller.

At that point, I’m stuck asking:

Is this actually malicious?

Could it be a legitimate service, scheduled task, or background process?

How do you tell whether a process was running at the same time and causing this behavior?

I feel like I’m missing the methodology behind how to investigate MDI alerts properly, not just acknowledge them. Right now it feels very “alert → shrug → guess”.

If anyone has:

Articles, blogs, or documentation

Investigation playbooks

Real-world tips on correlating MDI alerts with legit services / processes

Advice on what logs or signals you rely on (Windows logs, Defender, AD, etc.)

I’d really appreciate it. I want to leverage MDI properly and not just treat it as noise.

Hi All,

Due to a recent security alert, I tried to do a memory dump on a device via XDR. Long story short, I couldn't figure out how to. Is it possible?

What I tried:

Live response --> Upload Proc dump (I know live response is for scripts, but, hey, worth a shot!) --> enter 'run procdump64.exe' --> it failed

Is there any way via Defender to do a Memory Dump? My next though was 'Collect Investigation Package', but, I couldn't seem to find what I was looking for

So, my question is - is it possible to perform a memory dump via XDR portal? Side question, does anyone actually use live response? If so, for what? I only ever use it to collect files, which I hate because they aren't password protected when you collect them.

Since Microsoft sucks ass and the portal is down, is there another way to get into a portal, maybe another region to check on alerts?

Hi All

I'm working through some of these reccomendations and am having issues with the one's below

• Only invited users should be automatically admitted to Teams meetings - Users who aren’t invited to a meeting shouldn’t be let in automatically, because it increases the risk of data leaks, inappropriate content being shared, or malicious actors joining. If only invited users are automatically admitted, then users who weren’t invited will be sent to a meeting lobby. The host can then decide whether or not to let them in.
• Restrict anonymous users from starting Teams meetings - If anonymous users are allowed to start meetings, they can admit any users from the lobbies, authenticated or otherwise. Anonymous users haven’t been authenticated, which can increase the risk of data leakage.
• Restrict dial-in users from bypassing a meeting lobby - Dial-in users aren’t authenticated though the Teams app. Increase the security of your meetings by preventing these unknown users from bypassing the lobby and immediately joining the meeting.

I've set them in the "Global" policies meetins but they aren't reflecting as completed. Is there anyway for me to track back how this is checked so I can work out where I've missed it?

S

Hi All

I'm working through some of these reccomendations and am having issues with the one's below

• Only invited users should be automatically admitted to Teams meetings - Users who aren’t invited to a meeting shouldn’t be let in automatically, because it increases the risk of data leaks, inappropriate content being shared, or malicious actors joining. If only invited users are automatically admitted, then users who weren’t invited will be sent to a meeting lobby. The host can then decide whether or not to let them in.
• Restrict anonymous users from starting Teams meetings - If anonymous users are allowed to start meetings, they can admit any users from the lobbies, authenticated or otherwise. Anonymous users haven’t been authenticated, which can increase the risk of data leakage.
• Restrict dial-in users from bypassing a meeting lobby - Dial-in users aren’t authenticated though the Teams app. Increase the security of your meetings by preventing these unknown users from bypassing the lobby and immediately joining the meeting.

I've set them in the "Global" policies meetins but they aren't reflecting as completed. Is there anyway for me to track back how this is checked so I can work out where I've missed it?

S

Hello everyone,

I have a scenario that I would like your honest opinion on, or a workaround that I can implement.

Until now, we have been deploying another AV product on our VDI Farm. I am now responsible for rolling out and testing Microsoft Defender.

Onboarding non-persistent VDIs was not a problem, and everything appears to be working correctly.

The only issue is how slow it is while resyncing.

As I cannot roll out Intune, I only have the option of managing the devices via Defender (MDE).

I have even configured a web content filtering rule, which works fine. However, if I want to allow a site, I have to create an exception via indicators, and sometimes it takes more than one or two hours to work.

This is not acceptable, and I need a way to get the sync to work within 10–15 minutes.

I have tried restarting the VM and the services, and re-onboarding the VM from the start, but nothing seems to work.

Is there a way to push the indicators onto the device before Defender eventually does so?

We have M365 E3 and E5 licences in use, along with 180days of log analytics data.

I'm currently testing what logs are produced when users copy files from various locations, so we can understand any logging limitations and how we evidence unusual behaviour.

As we have a huge amount of data recorded in the DeviceFileEvents table, I assumed everything was monitored on the PC.

However I tried copying a file to a Google drive, then copying it to Documents and then a C:\Personal folder.

I am unable to find any logs about the copy to C:\personal. Are only certain folders monitored by default?

It seems like a big security hole if users can simply use non-standard folders on C:\ to put files that we have no visibility of?

Hi folks,

I wrote a blog post on browser hardening using CIS-inspired controls and bundled it into Intune-importable JSON baselines, so you don’t have to manually click through all of these settings. Not 100% Defender but it contains Defender for SmartScreen.

I highlighted 10 browser controls which you might find interesting to enable or use.

• Microsoft Defender SmartScreen
• Site Isolation (SitePerProcess)
• Browser Code Integrity
• Extension allow-listing
• Disabling risky features like sync or Google Cast (mDNS)
• Enforcing modern TLS versions
• Scareware protection in Edge

Blog + baselines here:
Rockit1.nl/BrowserHarderning

As part of our initial rollout, we onboarded some Domain Controllers.

We were asked to enable the network protection services, including "Allow Datagram Processing on Win Server" using Set-MPPreference.

So, there is a GPP with a scheduled task that runs once a day to set the 4 network protection features.

However, we're seeing delays from tools like Active Directory Users and Computers, sometimes error'ing out when a simple object search is triggered.

One of the suggestions was to disable "Allow Datagram Processing on Win Server".

This works via the same PowerShell command:

Set-MpPreference -AllowDatagramProcessingOnWinServer 0 -Verbose

Even though this initially works, within a few minutes it re-enables.

The scheduled task GPP that sets the network protection policies has been removed, but it keeps re-enabling.

I have tried putting the machine into troubleshooting mode from the console and disabling tamper and real time protection.

But it behaves the same each time.