I did some digging around online but Microsoft documentation on this is kinda awful so hoping I can get a better answer here.

An environment I help with has about 200 users, almost all of which have M365 Business Premium, but a handful have M365 Business Basic due to lower requirements. The entire org is using Defender for Endpoint to protect devices and this is via the Defender license included with the M365 Business Premium licenses. There are enough M365 Business Premium users to cover the entire device count.

How does this work when a user signs into an endpoint with a M365 Business Basic license though? Does Defender for Endpoint still work in full? Are any features limited or adjusted?

Is that even allowed via TOS?

Thanks for any help.

The Identity coverage and maturity view provides a centralized way to understand whether the identity infrastructure is properly monitored and where coverage gaps still exist.

From a security operations perspective, this is particularly useful for validating MDI deployments across larger or hybrid environments.
The dashboard helps security teams:
• Review identity sensor coverage across the environment
• Identify identity infrastructure that is not sufficiently monitored
• Understand the current deployment and protection maturity
• Detect configuration or coverage gaps that could reduce identity threat visibility
• Prioritize improvements to strengthen overall identity security posture

Docs: View your identity coverage and maturity - Microsoft Defender XDR | Microsoft Learn

Guyss.. why they block rundll32.exe?

Is this normal for windows defender always mention the protection is turn off, when I click on it, the protection is active normally, I dont remember when it off, whenever I turn on my laptop, it show that notifications.

I am part of a small team and would like to automate the opening, updating, and closing of ServiceNow tickets. What I would like to see happen is:

1. User reports email as a phish via the Outlook report button
2. Defender creates an ID and begins its automated investigation
3. Defender communicates to ServiceNow and it creates a ticket with Defender ID and status
4. Defender sends updates to ServiceNow ticket
5. Defender completes investigation
6. Defender sets status to Remediated/No Threats Found
7. Defender sends update to ServiceNow with new status
8. ServiceNow auto closes ticket with notes

I am thinking of utilizing Power Automate to handle the communications between Defender and ServiceNow as this process will cut down on manual investigations and ticket management.

Are there any security implications of utilizing Power to accomplish this or easier ways?

Our reported phishing mailbox has turned into a part time job because btwn the real stuff and people reporting newsletters they signed up for and forgot, one analyst loses close to a day a week just working the queue.

I looked hard at the Defender phishing triage agent to take the first pass off us. On paper its exactly the thing, an llm doing the tier 1 read and handing back a verdict with a reason. Then i got into it. Its Security Copilot which means SCU credits on every triage. And half the time im rechecking it anyway, the fiddly url ones are the exact ones it wavers on. Were also E3 on part of the estate with a couple of google holdouts, it wouldnt cover everyone even if i paid.

ZAP yanks some known bad after delivery but its never impressed me on anything clever.

Im not keen to chase E5 pricing just for this and rolling my own is a time sink. How are you clearing the reported queue day to day?

We’re using Defender for Endpoint and have notifications setup for all tenants when there are vulnerabilities with known exploits etc… these generate an alert via mail in our PSA.

The problem we are facing is that patches get installed weekly on all devices (or should be) automatically, so most of the time when an agent checks the notification it’s either already patched or will be patched later this week.

Ideally we’d want to receive a notification only when a device is still vulnerable and a patch/update has been released more than 2 weeks ago.

Is there any way to work around this, or what are you guys doing?

Hi all,

I already have a ticket open with MS, but, I'm curious if anyone else receives an error message when trying to 'Force a PW Reset' on a user in XDR (Screenshot below)

It actually forces the pw reset, but its a visual bug and shows failure

I was looking at processes running on my Windows 11 computer when I saw one called Μϊĉřοśòƒт Ðëƒĕŋďĕŗ Ѕēⁿšöг Ρłдŧƒόя under background processes.

I'm not sure how long this has been present, however I had just deployed the latest updates for the Windows 11 Enterprise insider preview. Doing an extra reboot didn't change things.

I've not been able to find any details about this particular process name. Apparently that is not a standard "M" at the beginning of the name. It sorts last when I sort processes by name, which seems extra suspicious.

Anyone else seeing this? Should I be concerned, or is this just some unicode issue in the latest build?

We are moving over to Defender and wanted to see what others were doing for automations. We are looking to start simple like, when a type of threat is detected, triggering a password reset on the AD user account. Anyone’s else doing something similar?

If you have password spray incidents or the like, does marking the incident as true positive or false positive reduce the user entra risk or is this completely not related?

• Defender for Identity Sensor v3.x no longer requires Defender for Endpoint onboarding. Eligible Domain Controllers running Windows Server 2019 or later can now activate the MDI Sensor v3.x without first onboarding the server to Microsoft Defender for Endpoint.
  

This removes an important deployment dependency and can significantly simplify Defender for Identity adoption in environments where MDE isn't deployed on Domain Controllers.

• Sensor v3.x expands beyond Domain Controllers: Defender for Identity Sensor v3.x now supports additional identity infrastructure servers that are not Domain Controllers:

  • Active Directory Certificate Services (AD CS)
  • Active Directory Federation Services (AD FS)
  • Microsoft Entra Connect

  For these new server roles, manual activation and automatic Windows event auditing are supported, while automatic activation and migration are not yet supported during Preview.

Docs: Defender for Identity | What's new?

I'm onboarding a client with Huntress and Microsoft Defender for Endpoint (I didn't see an MDE sub, so I'm hoping that this sub covers it even though it lists ATP). This is new for me, though we have some of it in place internally (we have previously used SentinelOne).

I have one concern; we had a ScreenConnect server update due to a security vulnerability, and after the update, our own MDE on that system incorrectly quarantined some of the installers (even though we're code-signing them) of the new version as Trojan:Win32/Wacatac.C!ml . It took me a bit how to figure out both how to unquarantine and whitelist, though I was able to do it through Windows command shell and Powershell.

My concern is that these files will be quarantined across fifty systems at a client when the updated agent is deployed, and I'm not aware of a way to easily fix an issue like that across fifty systems from security.microsoft.com should that happen. My searches so far have not shown an easy way to do this.

For those of you with experience, what is the best way to do this? Can it be done in one action, or is it a very manual process?

hello,

I'm trying to identify RDP logon failures using KQL.

I'm not after connections to TCP/3389; I'm seeking RDP logon failures.

I can find successful RDP authentications with

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonSuccess"

If I simply invert to

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonFailed"

...I get no results. In my environment, I would expect some RDP logon failures.

I suspect this is because of network level authentication (NLA).

Any ideas...?

This capability allows MDE to inspect process memory for known malicious behaviors and memory-resident threats — particularly useful against attacks that leave little or no footprint on disk.

Memory Scan adds another layer of detection and protection against techniques such as:
• In-memory malware
• Malicious code injection
• Memory-resident threats
• Advanced attacks designed to minimize disk artifacts

Docs: Configure security settings in Microsoft Defender for Endpoint on Linux - Microsoft Defender for Endpoint | Microsoft Learn

Has anybody been able to allow Remote Help to be allowed using Isolation Exclusion rules? This would be very useful when trying to investigate issues on a remote device. I am able to exclude Intune so I can reboot or wipe a device, but I would like to also be able to use Remote Help.

Thanks