Defender for Office 365: Visualisation of the Tenant Allow/Block List features

ByThomas Verheyden

During my work with customers, when I explain the tenant allow and block features in Microsoft Defender for Office 365 P1/P2, I often get the question: why did Microsoft make this so hard to understand? That comment gave me the idea to create a visual representation of the features to make them easier to understand.

You can find the visualisation below or on my github:

Defender-For-O365/MDO – Allow-Deny list.jpg at main · ThomasVrhydn/Defender-For-O365

Similar Posts

The ultimate Defender XDR RBAC visualization

ByThomas Verheyden

Do you also struggle, like I do, to assign the correct permissions in Microsoft Defender XDR RBAC when designing your RBAC model? I recently created a visual overview of the current roles and their functions. It helped me a lot in understanding how to structure RBAC properly and I hope it can help you too!…

Defender for Endpoint for Linux: new capabilities and enhancements

ByThomas Verheyden

Intro Microsoft published this summer new capabilities and enhancements for Defender for Endpoint on linux. In my opinion Defender for Endpoint on linux is a lot of times overlooked and the new features are a very good improvement to the performance of Defender for Endpoint on linux which deserve more exposure. In this blog i…

|

MDI-configurator v1.0 is out !

ByThomas Verheyden

A user-friendly graphical interface for managing Microsoft Defender for Identity (MDI) configurations using PowerShell. This PowerShell script provides a comprehensive WPF-based GUI wrapper around the Microsoft Defender for Identity PowerShell module. It simplifies the configuration, testing, and management of MDI deployments through an intuitive interface, eliminating the need to remember complex PowerShell commands. Download: v3rtho/MDI-configurator:…

|

Remotely Intune wipe devices in Defender for Endpoint isolation mode!

ByThomas Verheyden

Intro Microsoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about possible use cases for this new feature. Together with Bjorn Claes, we explored whether it’s possible to exclude the Intune wipe process from isolation mode. If this works, it would allow us to remotely…

|

MDE-Troubleshooter v1.6.1 available

ByThomas Verheyden

What’s new:– Inspired by Yong Rhee “Resolving High CPU Utilization in MDE” session, added additional options to run the Performance analyzer, Overview is now by default.– Added ASR rules that went GA– Added a check if DeviceControl is enabled– Added Proxy ULR/PAC check– Added check to see if signature update are out of date Download:GitHub…

|

Identity threat detection and response: Linking accounts

ByThomas Verheyden

Intro This blog post covers a Defender for Identity feature that hasn’t received much attention. Despite flying under the radar, it’s a valuable setting for security teams who want to see all user identities across the organization in one unified view. Scattered Identities In corporate settings, user identities tend to be scattered across multiple platforms….

Leave a Reply