Connecting servers without Internet access to Windows Defender ATP

Here's a relatively new blog (I would have put the URL into this thread earlier but I was travelling) that talks about the licensing for Server.  Hope it helps, and thank you for trying Windows Defender ATP!

Protecting Windows Server with Windows Defender ATP 

Jason_Leznekand others - it appears that the WDATP Server documentation has been updated to clarify the above conversation - Server 2019 includes WDATP onboarding just like a normal machine, and Azure Security Center can be added as an optional feature to even better improve security for the machine.  WS2016 is untouched in terms of onboarding (still able to freely onboard it now). https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection

Thanks!

Jason_Leznek- agreed with Joe Sanders here. It is incredibly unclear that this is in preview, as the docs.microsoft page appears as if the feature is in production.

Now that I know this, we will happily keep using the integration for Windows Server until it is taken out of preview.

Thanks.

I appreciate the feedback and will work with the documentation team to add clarity.

That being said, I'm happy that your organization likes Windows ATP and am concerned about its usage being at risk.   If you have paid for licenses through Windows E5 while thinking that they cover your servers appropriately, please contact me privately and I'll work with you to see if we can get the right licensing resolved for those servers.   My team is here to help you be both successful and happy.

That blog makes it sound like the integration from Azure is in preview, not all server support for ATP.  It is also not clear of that is / will be the only way yo acquire licensing for servers to connect to ATP.

The ATP docs for "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection" do not include the words preview or license.  This seems very misleading if you're saying support for server connected to ATP is still in preview, and I am expected to have read a blog to find that out.

I think this means ATP will be out of consideration which is unfortunate as we did like the product.

Windows Server support is in preview, not production, hence people can try it regardless of licensing.  That does not imply that when it is released that it will be for free.  Yuri Diogenes blogged on May 9th that WDATP usage rights will be included in the Azure Security Center license once WDATP support for Windows Server is released.

"At RSA Security Conference this year we announced that Security Center now harnesses the power of WDATP to provide improved threat detection for Windows Servers (this integration is currently in preview)."

Joe,

I could be the one with the misunderstanding here, but I think perhaps Jason is talking about something different.

As long as you are paying for Defender ATP user licenses for your organization, you can onboard servers (that are activated with a valid Windows Server 2016 activation key) without additional licensing costs. That's essentially what that docs.microsoft.com guide says.

I would be quite shocked if they added a licensing fee to a production service that people are already using for free in production environments.

Can you be any more specific on when the licensing details will be made public?  I asked our VAR, and they contacted MSFT, but have been unable to get an answer so far.   We're currently evaluating ATP as our current tool's renewal date is coming up this fall, but I can't even propose switching to ATP without the licensing info / cost. 

Also, I'm very disappointed that people have been allowed to on-board servers for months and the docs say nothing about forthcoming licensing announcements.  Azure puts 'free while in preview, GA pricing TBD' disclaimers on their docs, and ATP should consider add a similar warning to the 'Onboard servers to the Windows Defender ATP service' page until the details are public and easily obtainable.

Licensing information for Windows Servers will be available soon.  You should be able to reach out to your account team for more information and they email me if they're not familiar.   We have not disclosed it publicly yet.