Can Defender for Endpoint policies and features on Azure Stack HCI hosts be managed by MDE or SCCM?

Question

I am curious whether MDE or SCCM can be used to manage Defender for Endpoint policies and features on Azure Stack HCI hosts. Also, does Azure Stack support the use of ASR rules via Defender for Endpoint? Will enabling ASR impact the functioning of Azure Stack HCI?

Answer 1

Hello Jamie Childs

Welcome to Microsoft Q&A Platform, thanks for posting your query here.

I just checked with internal team on this. If you are referring to M365D to manage MDE (Defender for Endpoint), global policies like tampering, web browsing etc works just fine and if you are referring to “configuration policies” they are not exposed on server (requires Intune) only for clients.

MDE on HCI is supported with limitations.

You can use MDE, and can license it in any ways you have, including MDC (Server Plans).

You can expect a limited functionality around M365D management, around vulnerability managements and related items (scoring, recommended security settings, KB installed).

Ref:

Defender support for Azure Stack HCI 23H2 is explained here : https://learn.microsoft.com/en-us/azure-stack/hci/manage/manage-security-with-defender-for-cloud

Azure Stack HCI supports ASR in a preview fashion is explained here : https://learn.microsoft.com/en-us/azure-stack/hci/manage/azure-site-recovery

Hope this helps.