Microsoft Defender for Endpoint: onboarding, antivirus modes, ASR rules and exclusions

Skills you'll practise

• Onboard devices in rings and verify them with the device inventory and a detection test
• Interpret Inactive, Impaired communications and No sensor data states and choose the next check
• Predict whether Microsoft Defender Antivirus runs active, passive or disabled and what that means for ASR rules and EDR in block mode
• Explain what tamper protection locks and how to make an approved change to a protected setting
• Plan an ASR rule rollout from Audit to Block, distinguishing standard protection rules from others
• Place devices in ranked device groups and decide between alert suppression, exclusions and indicators

Course outline

1. 1.Microsoft Defender for Endpoint administrationVideo · 3 min
2. 2.Onboarding and sensor healthLesson · 16 min
3. 3.Antivirus modes, EDR in block mode and tamper protectionLesson · 17 min
4. 4.ASR rules, device groups, exclusions and indicatorsLesson · 17 min
5. 5.Microsoft Defender for Endpoint: onboarding, antivirus modes, ASR rules and exclusions: knowledge checkKnowledge check · 22 questions
6. 6.Final exam11 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: Microsoft Defender for Endpoint (overview and licensing options)
• Microsoft Learn: Onboard devices to Microsoft Defender for Endpoint (ring-based deployment, exit criteria)
• Microsoft Learn: Run a detection test on a device recently onboarded to Defender for Endpoint
• Microsoft Learn: Fix unhealthy sensors in Microsoft Defender for Endpoint
• Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products (active, passive, disabled)
• Microsoft Learn: Endpoint detection and response (EDR) in block mode
• Microsoft Learn: Cloud protection and Microsoft Defender Antivirus
• Microsoft Learn: Tamper protection overview
• Microsoft Learn: Attack surface reduction (ASR) rules overview (modes, requirements, exclusions)
• Microsoft Learn: ASR rules deployment guide (plan, test, enable, manage)
• Microsoft Learn: Overview of exclusions and indicators in Microsoft Defender for Endpoint
• Microsoft Learn: Create and manage device groups in Microsoft Defender for Endpoint
• Microsoft Learn: Automation levels in automated investigation and remediation