Microsoft Defender

What is Microsoft Defender for Business?

Microsoft Defender is a comprehensive security solution built into Windows, designed to protect your devices from a wide range of cyber threats. It includes robust antivirus protection, real-time threat detection, and a firewall to safeguard your system against malware, viruses, and ransomware. Defender’s features extend beyond basic antivirus, incorporating advanced tools like cloud-based protection, which utilizes Microsoft’s vast threat intelligence network to identify and mitigate emerging threats quickly.

It also offers performance monitoring and privacy controls to ensure safe browsing and system health. Regular updates and seamless integration with Windows make Microsoft Defender a convenient choice for maintaining security without additional software. Its integration with Microsoft 365 provides enhanced security features for enterprise environments, making it a versatile solution for both personal and professional use.

MICROSOFT DEFENDER FOR OFFICE 365 DEPLOYMENT GUIDE

MICROSOFT DEFENDER FOR BUSINESS DEPLOYMENT GUIDE

Endpoint Protection
Defender for Business offers real-time protection against viruses, malware, ransomware, and other threats across all endpoints within the organization. It utilizes machine learning models and behavioral analytics to detect and block malicious activities.
Advanced Threat Protection
The solution includes advanced threat protection capabilities such as endpoint detection and response (EDR), which allows businesses to detect, investigate, and respond to advanced threats and breaches.
Endpoint Detection and Response (EDR)
Defender for Business provides EDR capabilities to enable organizations to investigate and respond to advanced threats and security incidents across their endpoints. It allows security teams to analyze endpoint activities, conduct forensic investigations, and take appropriate response actions.

What is Microsoft Defender for Business, and could it suit your Business?

Small and Medium Enterprises (SMEs) form the backbone of the Australian economy and play a crucial role in the supply chain. However, in today’s digital era, this significance also brings challenges. SMEs are increasingly targeted by malicious actors due to a fiercely competitive market and limited budgets for security measures, unlike larger corporations.

Over recent years, SMEs have embraced cloud technology for their operations, which has enhanced flexibility and mobility, positively impacting our daily lives. Yet, this shift has altered the risk landscape, emphasizing the importance of Endpoints and the necessity for a Zero Trust Architecture. The traditional notion of “trust, but verify” is outdated, especially in light of current global events.

As Endpoints gain prominence and attackers become more sophisticated, conventional Endpoint protection methods like antivirus software fall short. SMEs often struggle to afford Enterprise-grade features such as Endpoint Detection and Response (EDR) and Threat and Vulnerability Management. However, the introduction of Microsoft Defender for Business aims to address this issue, offering SMEs a more accessible solution.

Index

Microsoft Defender for Office 365

Email’s and Collaboration Policy setup

Quarantine Global settings

AntiPhishing policy setup

Microsoft Defender for Business

What is Microsoft Defender?

What does it include?

differences with P2.

Use case of Defender for Business.

License and features.

How to configure Defender for Business.

Defender for Business Policies.

Incident experience.

Device page experience.

Reporting.

Defender for Business Limitations.

Microsoft Defender for Office 365

Email And Collaboration Policy Deployment Guide

Set Global settings

– Open “security.microsoft.com”

– Navigate to “Email & collaboration”

– Select “policies and rules”

– Select “Threat Policies”

– Open “Quarantine Policies”

– Select “Global settings” at top of screen

– Select “use my company logo”

– Adjust “send end-user spam notification to “Within 4 hours.”

– Select “Save”

Setup Microsoft 365 Quarantine Policy

– Select “Add custom Policy” at top of screen

– Set name for policy, eg “Company Quarantine Policy”

– Select “next”

– Set “recipient message access” to “Set specific Access”

– Set “Select release action preference” to “Allow recipient to release a message from Quarantine”

– Tick the boxes for “delete”, “Preview”, “Block Sender”, “Allow Sender”

– Select next

– Tick the “enable box”

– leave radio button select on Don’t include quarantines messages from blocked sender address.

– Select “next

– “select “submit”.

Setup Microsoft 365 Anti-Phishing Policy

– Select “create” from the top of screen

– Set name to “Company APP”

Enter the appropriate domain names in to the “domains” section

– Set “Phishing email threshold” to “3 – More Aggressive”

– Tick the “enable users to protect” box

Enter the users you wish to protect from impersonation protection.

– Tick the “enable domain to protect” box

Enter all domain names that the business users

– Tick the “enable intelligence for impersonation protection” box

– Ensure the “enable spoof intelligence” box is ticked.

– Set “If a message is detected as user impersonation” to “Quarantine the message”

Set “Apply quarantine policy” to ” Company APP”

– Set “If a message is detected as domain impersonation” to “Quarantine the message”

Set “Apply quarantine policy” to ” Company APP”

– Set “If Mailbox Intelligence detects an impersonated user” to “Quarantine the message”

Set “Apply quarantine policy” to ” Company APP”

– Set “If the message is detected as spoof and DMARC Policy is set as p=quarantine” to to “Quarantine the message”

– Set “If the message is detected as spoof and DMARC Policy is set as p=reject” to “Reject the Message”

– Set “If the message is detected as spoof by spoof intelligence” to “Quarantine the message”

Set “Apply quarantine policy” to ” Company APP”

– Tick the boxes for

Show first contact safety tip (Recommended)

Show user impersonation safety tip

Show domain impersonation safety tip

Show user impersonation unusual characters safety tip

Show (?) for unauthenticated senders for spoof

Show “via” tag

Anti-Spam Inbound

– Select “Create Policy” at top of screen

– Select “inbound”

– Set name to “Company ASP Inbound”

– Select “Domains”

– Enter the appropriate domain names

– Set appropriate “Bulk email threshold” setting

– Set “Image links to remote websites” to “on”

– Set “Numeric IP address in URL” to “on”

– Set “URL redirect to other port” to “on”

– Set “Links to .biz or .info websites” to “on”

– Leave remainder of settings off, unless further reviewed and has been deemed to be beneficial to turn on.