Blogging about (Microsoft) Security and more
Latest blogs
MicrosoftSecurity
TOP3 blog posts about Microsoft ISOC
On September 23, Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender, now in public preview. There is already a LOT of content out there about ISOC. Announcements, docs, partner …
Defender for Endpoint Controlled configuration, Tamper protection on steroids: A deep dive
What is controlled Configuration Controlled configuration is a security management capability that enforces a single, authoritative source of truth for Microsoft Defender security settings on a device. Controlled …
Microsoft Defender Unified Role based access mapper
⚠️ This tool has been retired and is no longer available. The screenshots below are kept for reference. I created a web based interactive Microsoft Defender Unified RBAC permissions mapper to make your life easier when …
Defender Unified Role-Based Access Control (RBAC) support for Microsoft Sentinel is here
Intro During my latest engagements with different customers I frequently received the question why you still have to configure Azure permissions if you want to use the unified portal experience in Defender to access log …
Defender for IdentityIdentity threat detection and response: Linking accounts
Intro This blog post covers a Defender for Identity feature that hasn’t received much attention. Despite flying under the radar, it’s a valuable setting for security teams who want to see all user identities across the …
Defender for EndpointDefender for Endpoint Migration: Troubleshooting Persistent Third-Party AV Registration
Intro I recently assisted a costumer with migrating to Defender for Endpoint. They had some windows 10/11 endpoints where the 3rd party Antivirus (AV) kept registered as primary Antivirus which by default put Defender …
Defender for Identity
MDI-configurator v1.0 is out !
A user-friendly graphical interface for managing Microsoft Defender for Identity (MDI) configurations using PowerShell. This PowerShell script provides a comprehensive WPF-based GUI wrapper around the Microsoft Defender …
Defender for EndpointRemotely Intune wipe devices in Defender for Endpoint isolation mode!
Intro Microsoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about possible use cases for this new feature. Together with Bjorn Claes, we …
Defender XDRThe ultimate Defender XDR RBAC visualization
Do you also struggle, like I do, to assign the correct permissions in Microsoft Defender XDR RBAC when designing your RBAC model? I recently created a visual overview of the current roles and their functions. It helped …
Defender for EndpointGuidance on how to manage products updates for Defender for Server on Linux distributions
Intro There are many helpful blog/videos posts about managing Microsoft Defender for Endpoint (MDE) updates on Windows, but there’s not much information available for MDE on Linux. In this blog post, I’ll share my …