Tenant setup 19 β€” Defender for Endpoint AV configuration, part 2

πŸ“˜ Complete tenant-setup cookbook in one PDF This article is part of the series. Full series + screenshots in one document: download PDF . (PDF is currently in Czech.) A week's pause but we're back.

πŸ“˜ Complete tenant-setup cookbook in one PDF
This article is part of the series. Full series + screenshots in one document: download PDF. (PDF is currently in Czech.)

A week's pause but we're back. We're returning to Defender for Endpoint AV configuration. Let's go straight into the remaining settings.

Excluded Extensions β€” file types that are skipped during scans.
Excluded Paths β€” folders or files specified by path that are skipped.
Excluded Processes β€” processes whose I/O is not scanned.

PUA Protection β€” what Defender does with potentially unwanted apps. Audit: warns the user but allows install. On: blocks and creates an incident. Goal: keep On; sometimes false-positives are an issue.
Real Time Scan Direction β€” which files are scanned in real time. Not configured isn't ideal; bi-directional is recommended.
Scan Parameter β€” full scan or quick scan.
Schedule Scan Day / Time β€” when scheduled scans run.

Signature Update Fallback Order / File Shares Sources β€” order Defender tries when fetching signature updates. I leave defaults.
Signature Update Interval β€” hours between signature updates. Set to 24.
Submit Samples Consent β€” I'm fine with sending safe samples automatically.
Disable Local Admin Merge β€” prevents local admins from overriding Intune-pushed values.
Allow On Access Protection β€” real-time file/process behavior monitoring.

The first 4 of Threat Severity Default Action drive what happens after a threat is categorized into one of four severities.
Allow Network Protection Down Level β€” networking protection on older Windows 10 builds (1703).
Allow Datagram Processing On Win Server β€” networking protection on Windows Server.
Disable Dns Over Tcp Parsing / Disable Http Parsing / Disable Ssh Parsing / Disable Tls Parsing β€” protocol parsing controls. SSH off (we don't run many Linux endpoints); HTTP/DNS/TLS on.

Engine Updates Channel / Platform Updates Channel / Security Intelligence Updates Channel β€” release channels for engine, platform, and intelligence updates.
Metered Connection Updates β€” should Defender update on metered connections.

That should be everything for security in the simple sense β€” if anything in M365 can be called simple. In the next few articles we'll tackle the great unknown for most: integrating Apple devices with Intune via Apple Business Manager.