Microsoft Security Microsoft Defender Microsoft Defender for Cloud

1 answer

are Agentless scanning for machines and vulnerability assessment for machines features available under azure gov (GCCH)?

The defender for server P2 is activated on my subscription; however, I am not seeing any option to enabled these two features: Agentless scanning for machines vulnerability assessment for machines I wonder if these are available on GCCH or only…

asked

Leonord Joseph 20

accepted

Leonord Joseph 20

2 answers

Offboarding VMs from Defender for Servers Plan 2

After enabling Defender for Servers Plan 2 on a subscription for testing, the plan has been deactivated; however, the servers are still visible in the Defender for Server Portal. In the Azure portal, the MDE.Windows extension remains installed on the VM.…

asked

PM 0

commented

Navya 20,730 Microsoft External Staff Moderator

1 answer

Required Configuration in Microsoft Defender Suite for Microsoft RaMP Integration

Hi All, We are planning to deploy Microsoft Defender Suite in an organization, We would like to understand what are the necessary configurations required across the Microsoft Defender suite—including Defender for Endpoint, Defender for Identity, Defender…

asked

Subhash Kumar Mahato 265

accepted

Subhash Kumar Mahato 265

1 answer

Attack Simulation Training in Microsoft Defender

We have deployed phishing campaigns and some users have been not been compromised and have successfully reported the phish. The issue is that after been sent successfully completed acknowledgment, these users receive a Training assignment notification,…

asked

Farrukh Riaz 0

commented

Vigneshwar Duvva 2,225 Microsoft External Staff Moderator

1 answer

Meaning of "Previously assigned" training completion status in Attack Simulator

Does the "Previously assigned" training completion status in Attack Simulator mean that the training has NOT been completed by the user?

asked

Farrukh Riaz 0

commented

Goutam Pratti 6,170 Microsoft External Staff Moderator

2 answers

How to fully Uninstall/Clean-up Microsoft Defender Endpoint

Hello, We are having issues trying to use a migration tool to move our devices to another Microsoft tenant. It seems to be struggling gaining access and deleting a regkey that is link to a service for MDE. The tool is running and using the system…

asked

Dan Beeney 0

commented

Yharim 0

1 answer

Defender for cloud inventory health is reporting vulnerability findings that according to update history on the VM's have been installed.

All the vulnerability findings are related to .net or .net core. Some going back to 2023. Are these false positives? Highs and Meds so really want to make this go away. All windows updates have been installed and show in windows update history. Any…

asked

jbutler 0

answered

Andrew Blumhardt 10,056 Microsoft Employee

1 answer

Can the Microsoft Defender portal show the server details as per security group?

I'm using Microsoft Defender to monitor the servers. I have multiple groups of people working from various other vendors. I would like create multiple security groups and add people based on their company and configure the defender such a manner that…

asked

Ro_009 0

commented

Jyotishree Moharana 1,845 Microsoft External Staff Moderator

1 answer

Defender for Cloud - Disabled accounts with read and write permissions on Azure resources should be removed - removing permissions from accounts automatically

Hello, To complete recommendation from DfC "Disabled accounts with read and write permissions on Azure resources should be removed", I'd like to set autoschedule to remove permissions assigned to disabled accounts, which sign-ins aren't logged…

asked

SS97 40

edited an answer

Ryan Hill 30,291 Microsoft Employee Moderator

1 answer

Microsoft Defender XDR False Positive for SharePoint/OneDrive File Downloads

Multiple Microsoft Defender alerts have been triggered, indicating users downloading a large number of files within a short timeframe (ranging from a couple of hundred to thousands). When reaching out to the users, confirmations have indicated that they…

asked

brichardi 361

commented

Jyotishree Moharana 1,845 Microsoft External Staff Moderator

1 answer

Our Email Group Getting Status 500 error code

Email group attempting to approve or reject somethings in the Action Center but its giving them approve remediation pending action failed - with status code of 500 ?? Is there a bug all team members attempted gives them all error.

asked

CYB5478 0

commented

Goutam Pratti 6,170 Microsoft External Staff Moderator

1 answer

Legitimacy and Purpose of Azure Defender PowerShell Script Execution

Hello Microsoft Community, I noticed that on my Windows Server, the following file is triggering PowerShell script execution: C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.9.1\HandlerUtilities.psm1 This script seems to be…

asked

Hitesh Sungar 0

edited a comment

Sanoop M 4,310 Moderator

1 answer

Anonymous User Succeeded Download Limit

My company received an alert that a user succeeded the file download limit (total was 58/min). Upon investigating the alert in Defender, the user ID is displaying as…

asked

ShallowCopy 25

commented

Bandela Siri Chandana 3,055 Microsoft External Staff Moderator

1 answer

How do I remediate the Secure Score recommendation to enable automatic updates in office now that admin templates are deprecated in intune?

This information is incorrect: Go to the Devices-> Configuration profiles To update an existing policy: Click on the policy name in the list In the navigation bar, click on Properties Next to Configuration settings click on Edit Go to step…

asked

Mark Taylor 331

edited the question

Raja Pothuraju 25,115 Microsoft External Staff Moderator

1 answer

Legitimacy and Documentation of PowerShell Script in Windows Defender ATP Data Collection Path

Hi Team, We’ve observed the following script being executed on several servers: C:\ProgramData\Microsoft\Windows Defender Advanced Threat…

asked

Hitesh Sungar 0

commented

Sanoop M 4,310 Moderator

1 answer

Known file getting tagged as malicious

I have a single macros enabled excel file, every time I make changes and save it with different name Defender MDE flags it as malicious and file gets corrupted. Every time I make changes, SHA value changes and hence submitting it to Microsoft as clean…

asked

Aishwarya RM 20

edited the question

VarunTha 14,850 Microsoft External Staff Moderator

1 answer

Email sent by External User are being Quarantined by EOP

Hello, We have recently observed a significant increase in legitimate emails being quarantined by Microsoft 365 Defender (EOP) for both Exchange Online and on-premises users. These emails are being flagged by the anti-spam policies, and this behavior…

asked

Parsian02 20

commented

Bandela Siri Chandana 3,055 Microsoft External Staff Moderator

1 answer

What are all logs collected by defender for endpoint from windows endpoints and servers?

Hi Team, I have some servers from where i am collecting common event ids via AMA agent and sending it to Sentinel SIEM tool. Recently i installed defender for endpoint agent in these servers. I am now thinking of offboarding AMA agent as i already have…

asked

Supriya Nelluri 5

answered

Venkata Jagadeep 1,400 Microsoft External Staff Moderator

1 answer

Issue retrieving CVE details using responseType: reduced in Defender EASM Assets API

I'm working with the Microsoft Defender External Attack Surface Management (EASM) API, specifically the assets endpoint. When I make a request using responseType: reduced and apply a filter for a specific CVE ID, the response does not include any…

asked

Dev Parmar 20

edited a comment

Dev Parmar 20

1 answer

PCI Policy Not Displaying on Regulatory Compliance Dashboard

I enabled the PCI policy under Regulatory Compliance and initiated it, but it's still not appearing on the Regulatory Compliance dashboard.

asked

AA 5

commented

AA 5

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud

Filter

Content

1,366 questions with Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud tags

are Agentless scanning for machines and vulnerability assessment for machines features available under azure gov (GCCH)?

Offboarding VMs from Defender for Servers Plan 2

Required Configuration in Microsoft Defender Suite for Microsoft RaMP Integration

Attack Simulation Training in Microsoft Defender

Meaning of "Previously assigned" training completion status in Attack Simulator

How to fully Uninstall/Clean-up Microsoft Defender Endpoint

Defender for cloud inventory health is reporting vulnerability findings that according to update history on the VM's have been installed.

Can the Microsoft Defender portal show the server details as per security group?

Defender for Cloud - Disabled accounts with read and write permissions on Azure resources should be removed - removing permissions from accounts automatically

Microsoft Defender XDR False Positive for SharePoint/OneDrive File Downloads

Our Email Group Getting Status 500 error code

Legitimacy and Purpose of Azure Defender PowerShell Script Execution

Anonymous User Succeeded Download Limit

How do I remediate the Secure Score recommendation to enable automatic updates in office now that admin templates are deprecated in intune?

Legitimacy and Documentation of PowerShell Script in Windows Defender ATP Data Collection Path

Known file getting tagged as malicious

Email sent by External User are being Quarantined by EOP

What are all logs collected by defender for endpoint from windows endpoints and servers?

Issue retrieving CVE details using responseType: reduced in Defender EASM Assets API

PCI Policy Not Displaying on Regulatory Compliance Dashboard