Unmanaged device protection capabilities are now generally available

Published Jun 22 2021 05:00 AM 16.3K Views
Microsoft

Two months ago, we announced the public preview of a new set of capabilities that would give Microsoft Defender for Endpoint customers visibility over unmanaged devices running on their networks. It’s devices like these that introduce some of the greatest risks to an organization’s cybersecurity posture.

 

“The riskiest threat is the one you don’t know about. Unmanaged devices are literally one of your weakest links.

Smart attackers go there first.” - David Weston, Microsoft Director of Enterprise and OS Security

 

We are pleased to announce that starting today, these capabilities are generally available to all our customers worldwide!

 

With this release we deliver a rich set of new capabilities, including:

 

  • Discovery of endpoints and network devices connected to your corporate network

This capability provides Defender for Endpoint with the ability to discover unmanaged workstations, servers, and mobile endpoints (Windows, Linux, macOS, iOS, and Android) that haven’t been onboarded and secured. Additionally, network devices (e.g.: switches, routers, firewalls, WLAN controllers, VPN gateways and others) can be discovered and added to the device inventory using periodic authenticated scans of preconfigured network devices.

 

  • Onboard discovered devices and secure them using integrated workflows

Once discovered, unmanaged endpoint and network devices connected to your networks can be onboarded to Defender for Endpoint. Integrated new workflows and new security recommendations in the threat and vulnerability management experience make it easy to onboard and secure these devices.

 

  • Review assessments and address threats and vulnerabilities on newly discovered devices

Once endpoints and network devices have been discovered, assessments can be run using Defender for Endpoint’s threat and vulnerability management capabilities. These security recommendations can be used to address issues on devices helping to reduce an organization’s threat and risk exposure.

 

Now that these features have reached general availability, you will notice that endpoint discovery is already enabled on your tenant. This is indicated by a banner that appears in the Endpoints\Device inventory section of the Microsoft 365 Defender console.

 

Figure 1: Device inventory view listing "Can be onboarded" devices and option to enable Standard Mode discovery.Figure 1: Device inventory view listing "Can be onboarded" devices and option to enable Standard Mode discovery.

 

This banner will be available until July 19, 2021 which is when the default behavior for discovery will be switched from Basic to Standard. At this time, Standard discovery will enable the collection of a broader range of device related properties and it will also perform improved device classification. The switch to Standard mode was verified as having negligible network implications during the public preview. More information about the discovery and its two modes can be found in our previous blog.

 

We’re excited for you to take a look and start using these capabilities and we look forward to your feedback on them. If you have any questions or feedback feel free to leave them in the comment section below. For more information please review the device discovery and network discovery documentations on Microsoft Docs.

 

To read more about our new device discovery and assessment capabilities, check out:

 

Microsoft Defender for Endpoint is an industry-leading, cloud-powered endpoint security solution offering vulnerability management, endpoint protection, endpoint detection and response, and mobile threat defense. With our solution, threats are no match. If you are not yet taking advantage of Microsoft’s unrivaled threat optics and proven capabilities, sign up for a free trial of Microsoft Defender for Endpoint today.

 

 

 

 

 

 

 

 

5 Comments
Occasional Contributor

love the new feature, but 3 things comes to mind.

 

1.  i would love to be able to add ipaddress as a column so its easier to see where it has been detected, saves time and clicks.

2.  to be able to see the source "detector", so you can be able to link to same network as to which device found it, as endpoints seem to scan when devices are in "home" office aswell.

2. I see a few devices that is registered as "can be onboarded", when they actually are already onboarded according to my "Intune", so not sure why they are showing there.

Microsoft

Hi Thomas, thank you for the comment!

 

Regarding #1 that seems like a good request. I'll make sure the product team receives the feedback. For #3 there can be cases where a device that is managed by Intune may not be onboarded with MDE. It's needs to be setup to make it automatic. This link may help get you headed in the right direction: Configure Microsoft Defender for Endpoint in Microsoft Intune - Azure | Microsoft Docs. Regarding #2 I'm going to tap in someone from the PG to weigh in on it. 

 

Thanks,

Chris Hallum

Senior Product Marketing Manager

Microsoft Security   

Visitor

Hey Chris,

 

Love this new feature. Just a few questions:

  1. A device discovery function is often found in devices like IPS', Next Gen Firewalls, Vulnerability management tools (e.g. Nessus), and even CMDB software. What are the added benefits of doing device discovery using D4Ep instead of those?
  2. Can this function integrate with something like a CMDB to feed discovered device data to it?
  3. How will the discovery service behave when it's not on the corporate network; e.g. Starbucks Wifi, Home Wifi, guest WiFi at a customer site, etc. I would imagine none of those sites would want rogue device scanning going on in their networks. How configurable is this?
  4. If deployed on an enterprise network it's likely other security services/appliances might identify the scanning function as a malicious act and alert/quarantine/block the device doing the scanning. What needs to be configured on those appliances to white-list the D4Ep scanning activity?

Thanks

Microsoft

Hi @Thomas Førde !

Regarding #2 - That's a great feedback. As we differentiate between corporate networks and private networks (like home networks), we expect no "scans" will happen in the private network. We'll be happy to know about cases in which it does happen. Generally speaking, we hope to have an option that will help you identify the "source" device soon.

 

We'll be happy to get more details about item number #3 - you can post a feedback through the "Give feedback" button in the security portal, while mentioning examples for device ids that are related to your feedback. Please select also "You can contact me about this feedback" and we will reach out for more info.

 

Thanks!

Ron

Microsoft

Hi @Quaywe 

Here are some answers to your great questions:

1. The main benefit is the fact that the sensors are already in place. Device discovery requires zero configuration and control, and it happens all the time based on the network telemetry observes by the Defender for Endpoint sensors. Also - having those unmanaged devices listed in your device inventory can give you much more context for any security incident that involves both managed and unmanaged devices.

2. Unfortunately that's not supported today, but we are definitely looking into that. Would you expect having MDE data flowing into CMDB, or in the opposite direction?

3. Visit our public preview announcement blog, it has the information you are looking for under "Discovering the right devices" section. See FAQ and Monitored Networks Configuration for more info.

4. Important to say that the Standard Discovery method has a very low footprint on the network, and our probing is usually targeted (not network-wide) and lightweight. We've tested this functionality with multiple security and network analysis tools. Usually, this activity is not considered to be anomalous. If it was detected as unusual, you can exclude the script path from being monitored by the security tools, or use the Exclusions or the Select devices for Standard discovery controls in the Device Discovery settings based on the types of monitoring tools available in your network.

 

Thanks!
Ron

%3CLINGO-SUB%20id%3D%22lingo-sub-2463796%22%20slang%3D%22en-US%22%3EUnmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2463796%22%20slang%3D%22en-US%22%3E%3CP%3ETwo%20months%20ago%2C%20%3CA%20href%3D%22http%3A%2F%2Faka.ms%2Fmde_discoveryenblog%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ewe%20announced%20the%20public%20preview%3C%2FA%3E%20of%20a%20new%20set%20of%20capabilities%20that%20would%20%3CSTRONG%3Egive%20Microsoft%20Defender%20for%20Endpoint%20customers%20%3C%2FSTRONG%3E%3CSTRONG%3Evisibility%3C%2FSTRONG%3E%20%3CSTRONG%3Eover%20unmanaged%20devices%20running%20on%20their%20networks.%3C%2FSTRONG%3E%20It%E2%80%99s%20devices%20like%20these%20that%20introduce%20some%20of%20the%20greatest%20risks%20to%20an%20organization%E2%80%99s%20cybersecurity%20posture.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%E2%80%9CThe%20riskiest%20threat%20is%20the%20one%20you%20don%E2%80%99t%20know%20about.%20Unmanaged%20devices%20are%20literally%20one%20of%20your%20weakest%20links.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3ESmart%20attackers%20go%20there%20first.%E2%80%9D%26nbsp%3B-%20David%20Weston%2C%20Microsoft%20Director%20of%20Enterprise%20and%20OS%20Security%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20are%20pleased%20to%20announce%20that%20starting%20today%2C%20these%20capabilities%20are%20generally%20available%20to%20all%20our%20customers%20worldwide!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20this%20release%20we%20deliver%20a%20rich%20set%20of%20new%20capabilities%2C%20including%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EDiscovery%20of%20endpoints%20and%20network%20devices%20connected%20to%20your%20corporate%20network%20%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3EThis%20capability%20provides%20Defender%20for%20Endpoint%20with%20the%20ability%20to%20discover%20unmanaged%20workstations%2C%20servers%2C%20and%20mobile%20endpoints%20(Windows%2C%20Linux%2C%20macOS%2C%20iOS%2C%20and%20Android)%20that%20haven%E2%80%99t%20been%20onboarded%20and%20secured.%20Additionally%2C%20network%20devices%20(e.g.%3A%20switches%2C%20routers%2C%20firewalls%2C%20WLAN%20controllers%2C%20VPN%20gateways%20and%20others)%20can%20be%20discovered%20and%20added%20to%20the%20device%20inventory%20using%20periodic%20authenticated%20scans%20of%20preconfigured%20network%20devices.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EOnboard%20discovered%20devices%20and%20secure%20them%20using%20integrated%20workflows%20%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3EOnce%20discovered%2C%20unmanaged%20endpoint%20and%20network%20devices%20connected%20to%20your%20networks%20can%20be%20onboarded%20to%20Defender%20for%20Endpoint.%20Integrated%20new%20workflows%20and%20new%20security%20recommendations%20in%20the%20threat%20and%20vulnerability%20management%20experience%20make%20it%20easy%20to%20onboard%20and%20secure%20these%20devices.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EReview%20assessments%20and%20address%20threats%20and%20vulnerabilities%20on%20newly%20discovered%20devices%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3EOnce%20endpoints%20and%20network%20devices%20have%20been%20discovered%2C%20assessments%20can%20be%20run%20using%20Defender%20for%20Endpoint%E2%80%99s%20threat%20and%20vulnerability%20management%20capabilities.%20These%20security%20recommendations%20can%20be%20used%20to%20address%20issues%20on%20devices%20helping%20to%20reduce%20an%20organization%E2%80%99s%20threat%20and%20risk%20exposure.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20that%20these%20features%20have%20reached%20general%20availability%2C%20you%20will%20notice%20that%20endpoint%20discovery%20is%20already%20enabled%20on%20your%20tenant.%20This%20is%20indicated%20by%20a%20banner%20that%20appears%20in%20the%20%3CSTRONG%3EEndpoints%5CDevice%20inventory%3C%2FSTRONG%3E%20section%20of%20the%20Microsoft%20365%20Defender%20console.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%222021%20-%20Modern%20Work%20Security%20Group%20Marketing%20Field%20Advisory%20-%20Discovery%20GA%20-%20Pic.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F289980i718384184F33330A%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%222021%20-%20Modern%20Work%20Security%20Group%20Marketing%20Field%20Advisory%20-%20Discovery%20GA%20-%20Pic.png%22%20alt%3D%22Figure%201%3A%20Device%20inventory%20view%20listing%20%26quot%3BCan%20be%20onboarded%26quot%3B%20devices%20and%20option%20to%20enable%20Standard%20Mode%20discovery.%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%201%3A%20Device%20inventory%20view%20listing%20%22Can%20be%20onboarded%22%20devices%20and%20option%20to%20enable%20Standard%20Mode%20discovery.%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20banner%20will%20be%20available%20until%20July%2019%2C%202021%20which%20is%20when%20the%20default%20behavior%20for%20discovery%20will%20be%20switched%20from%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fconfigure-device-discovery%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EBasic%20to%20Standard%3C%2FA%3E.%20At%20this%20time%2C%20Standard%20discovery%20will%20enable%20the%20collection%20of%20a%20broader%20range%20of%20device%20related%20properties%20and%20it%20will%20also%20perform%20improved%20device%20classification.%20The%20switch%20to%20Standard%20mode%20was%20verified%20as%20having%20negligible%20network%20implications%20during%20the%20public%20preview.%20More%20information%20about%20the%20discovery%20and%20its%20two%20modes%20can%20be%20found%20in%20our%20previous%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-defender-for-endpoint%2Fendpoint-discovery-navigating-your-way-through-unmanaged-devices%2Fba-p%2F2248909%22%20target%3D%22_self%22%3Eblog%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%E2%80%99re%20excited%20for%20you%20to%20%3CA%20href%3D%22https%3A%2F%2Fsecurity.microsoft.com%2Fmachines%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Etake%20a%20look%3C%2FA%3E%26nbsp%3Band%20start%20using%20these%20capabilities%20and%20we%20look%20forward%20to%20your%20feedback%20on%20them.%20If%20you%20have%20any%20questions%20or%20feedback%20feel%20free%20to%20leave%20them%20in%20the%20comment%20section%20below.%20For%20more%20information%20please%20review%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fdevice-discovery%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Edevice%20discovery%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fnetwork-devices%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Enetwork%20discovery%3C%2FA%3E%20documentations%20on%20Microsoft%20Docs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20read%20more%20about%20our%20new%20device%20discovery%20and%20assessment%20capabilities%2C%20check%20out%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2021%2F04%2F13%2Fsecure-unmanaged-devices-with-microsoft-defender-for-endpoint-now%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ESecure%20your%20unmanaged%20devices%3C%2FA%3E%20in%20the%20Microsoft%20security%20blog%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-defender-for-endpoint%2Fendpoint-discovery-navigating-your-way-through-unmanaged-devices%2Fba-p%2F2248909%22%20target%3D%22_blank%22%3EEndpoint%20Discovery%20-%20Navigating%20your%20way%20through%20unmanaged%20devices%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-defender-for-endpoint%2Fendpoint-discovery-navigating-your-way-through-unmanaged-devices%2Fba-p%2F2248909%22%20target%3D%22_blank%22%3ENetwork%20device%20discovery%20and%20vulnerability%20assessments%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3EMicrosoft%20Defender%20for%20Endpoint%20is%20an%20industry-leading%2C%20cloud-powered%20endpoint%20security%20solution%20offering%20vulnerability%20management%2C%20endpoint%20protection%2C%20endpoint%20detection%20and%20response%2C%20and%20mobile%20threat%20defense.%20With%20our%20solution%2C%20threats%20are%20no%20match.%20If%20you%20are%20not%20yet%20taking%20advantage%20of%20Microsoft%E2%80%99s%20unrivaled%20threat%20optics%20and%20proven%20capabilities%2C%26nbsp%3B%3C%2FEM%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fmicrosoft-365%2Fsecurity%2Fendpoint-defender%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CEM%3Esign%20up%20for%20a%20free%20trial%3C%2FEM%3E%3C%2FA%3E%3CEM%3E%26nbsp%3Bof%20Microsoft%20Defender%20for%20Endpoint%20today.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2463796%22%20slang%3D%22en-US%22%3E%3CP%3EUnmanaged%20endpoint%20and%20network%20device%20discovery%20has%20just%20reached%20general%20availability%20for%20customers%20worldwide.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%222021%20-%20Modern%20Work%20Security%20Group%20Marketing%20Field%20Advisory%20-%20Discovery%20GA%20-%20Pic.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F289984i0D940690241BF866%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%222021%20-%20Modern%20Work%20Security%20Group%20Marketing%20Field%20Advisory%20-%20Discovery%20GA%20-%20Pic.png%22%20alt%3D%222021%20-%20Modern%20Work%20Security%20Group%20Marketing%20Field%20Advisory%20-%20Discovery%20GA%20-%20Pic.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2463796%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EDiscovery%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Defender%20for%20Endpoint%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EThreat%20%26amp%3B%20Vulnerability%20Management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2469184%22%20slang%3D%22en-US%22%3ERe%3A%20Unmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2469184%22%20slang%3D%22en-US%22%3E%3CP%3Elove%20the%20new%20feature%2C%20but%203%20things%20comes%20to%20mind.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%26nbsp%3B%20i%20would%20love%20to%20be%20able%20to%20add%20ipaddress%20as%20a%20column%20so%20its%20easier%20to%20see%20where%20it%20has%20been%20detected%2C%20saves%20time%20and%20clicks.%3C%2FP%3E%3CP%3E2.%26nbsp%3B%20to%20be%20able%20to%20see%20the%20source%20%22detector%22%2C%20so%20you%20can%20be%20able%20to%20link%20to%20same%20network%20as%20to%20which%20device%20found%20it%2C%20as%20endpoints%20seem%20to%20scan%20when%20devices%20are%20in%20%22home%22%20office%20aswell.%3C%2FP%3E%3CP%3E2.%20I%20see%20a%20few%20devices%20that%20is%20registered%20as%20%22can%20be%20onboarded%22%2C%20when%20they%20actually%20are%20already%20onboarded%20according%20to%20my%20%22Intune%22%2C%20so%20not%20sure%20why%20they%20are%20showing%20there.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2471385%22%20slang%3D%22en-US%22%3ERe%3A%20Unmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2471385%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Thomas%2C%20thank%20you%20for%20the%20comment!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERegarding%20%231%20that%20seems%20like%20a%20good%20request.%20I'll%20make%20sure%20the%20product%20team%20receives%20the%20feedback.%20For%20%233%20there%20can%20be%20cases%20where%20a%20device%20that%20is%20managed%20by%20Intune%20may%20not%20be%20onboarded%20with%20MDE.%20It's%20needs%20to%20be%20setup%20to%20make%20it%20automatic.%20This%20link%20may%20help%20get%20you%20headed%20in%20the%20right%20direction%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fintune%2Fprotect%2Fadvanced-threat-protection-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EConfigure%20Microsoft%20Defender%20for%20Endpoint%20in%20Microsoft%20Intune%20-%20Azure%20%7C%20Microsoft%20Docs%3C%2FA%3E.%20Regarding%20%232%20I'm%20going%20to%20tap%20in%20someone%20from%20the%20PG%20to%20weigh%20in%20on%20it.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EChris%20Hallum%3C%2FP%3E%0A%3CP%3ESenior%20Product%20Marketing%20Manager%3C%2FP%3E%0A%3CP%3EMicrosoft%20Security%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2472561%22%20slang%3D%22en-US%22%3ERe%3A%20Unmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2472561%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Chris%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELove%20this%20new%20feature.%26nbsp%3B%20Just%20a%20few%20questions%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1)%20A%20device%20discovery%20function%20is%20often%20found%20in%20devices%20like%20IPS'%2C%20Next%20Gen%20Firewalls%2C%20Vulnerability%20management%20tools%20(e.g.%20Nessus)%2C%20and%20even%20CMDB%20software.%26nbsp%3B%20What%20are%20the%20added%20benefits%20of%20doing%20device%20discovery%20using%20D4Ep%20instead%20of%20those%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E2)%20Can%20this%20function%20integrate%20with%20something%20like%20a%20CMDB%20to%20feed%20discovered%20device%20data%20to%20it%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3)%20H%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3Eow%20will%20the%20discovery%20service%20behave%20when%20it's%20not%20on%20the%20corporate%20network%3B%20e.g.%20Starbucks%20Wifi%2C%20Home%20Wifi%2C%20guest%20WiFi%20at%20a%20customer%20site%2C%20etc.%26nbsp%3B%20I%20would%20imagine%20none%20of%20those%20sites%20would%20want%20rogue%20device%20scanning%20going%20on%20in%20their%20networks.%26nbsp%3B%20How%20configurable%20is%20this%3F%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3E4)%20If%20deployed%20on%20an%20enterprise%20network%20it's%20likely%20other%20security%20services%2Fappliances%20might%20identify%20the%20scanning%20function%20as%20a%20malicious%20act%20and%20alert%2Fquarantine%2Fblock%20the%20device%20doing%20the%20scanning.%26nbsp%3B%20What%20needs%20to%20be%20configured%20on%20those%20appliances%20to%20white-list%20the%20D4Ep%20scanning%20activity%3F%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3EThanks%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2472563%22%20slang%3D%22en-US%22%3ERe%3A%20Unmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2472563%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Chris%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELove%20this%20new%20feature.%20Just%20a%20few%20questions%3A%3C%2FP%3E%3COL%3E%3CLI%3EA%20device%20discovery%20function%20is%20often%20found%20in%20devices%20like%20IPS'%2C%20Next%20Gen%20Firewalls%2C%20Vulnerability%20management%20tools%20(e.g.%20Nessus)%2C%20and%20even%20CMDB%20software.%20What%20are%20the%20added%20benefits%20of%20doing%20device%20discovery%20using%20D4Ep%20instead%20of%20those%3F%3C%2FLI%3E%3CLI%3ECan%20this%20function%20integrate%20with%20something%20like%20a%20CMDB%20to%20feed%20discovered%20device%20data%20to%20it%3F%3C%2FLI%3E%3CLI%3EHow%20will%20the%20discovery%20service%20behave%20when%20it's%20not%20on%20the%20corporate%20network%3B%20e.g.%20Starbucks%20Wifi%2C%20Home%20Wifi%2C%20guest%20WiFi%20at%20a%20customer%20site%2C%20etc.%20I%20would%20imagine%20none%20of%20those%20sites%20would%20want%20rogue%20device%20scanning%20going%20on%20in%20their%20networks.%20How%20configurable%20is%20this%3F%3C%2FLI%3E%3CLI%3EIf%20deployed%20on%20an%20enterprise%20network%20it's%20likely%20other%20security%20services%2Fappliances%20might%20identify%20the%20scanning%20function%20as%20a%20malicious%20act%20and%20alert%2Fquarantine%2Fblock%20the%20device%20doing%20the%20scanning.%20What%20needs%20to%20be%20configured%20on%20those%20appliances%20to%20white-list%20the%20D4Ep%20scanning%20activity%3F%3C%2FLI%3E%3C%2FOL%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2489200%22%20slang%3D%22en-US%22%3ERe%3A%20Unmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2489200%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F196193%22%20target%3D%22_blank%22%3E%40Thomas%20F%C3%B8rde%3C%2FA%3E%26nbsp%3B!%3C%2FP%3E%0A%3CP%3ERegarding%20%232%20-%20That's%20a%20great%20feedback.%20As%20we%20differentiate%20between%20corporate%20networks%20and%20private%20networks%20(like%20home%20networks)%2C%20we%20expect%20no%20%22scans%22%20will%20happen%20in%20the%20private%20network.%20We'll%20be%20happy%20to%20know%20about%20cases%20in%20which%20it%20does%20happen.%20Generally%20speaking%2C%20we%20hope%20to%20have%20an%20option%20that%20will%20help%20you%20identify%20the%20%22source%22%20device%20soon.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe'll%20be%20happy%20to%20get%20more%20details%20about%20item%20number%20%233%20-%20you%20can%20post%20a%20feedback%20through%20the%20%22Give%20feedback%22%20button%20in%20the%20security%20portal%2C%20while%20mentioning%20examples%20for%20device%20ids%20that%20are%20related%20to%20your%20feedback.%20Please%20select%20also%20%22You%20can%20contact%20me%20about%20this%20feedback%22%20and%20we%20will%20reach%20out%20for%20more%20info.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks!%3C%2FP%3E%0A%3CP%3ERon%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2489215%22%20slang%3D%22en-US%22%3ERe%3A%20Unmanaged%20device%20protection%20capabilities%20are%20now%20generally%20available%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2489215%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F564673%22%20target%3D%22_blank%22%3E%40Quaywe%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHere%20are%20some%20answers%20to%20your%20great%20questions%3A%3C%2FP%3E%0A%3CP%3E1.%20The%20main%20benefit%20is%20the%20fact%20that%20the%20sensors%20are%20already%20in%20place.%20Device%20discovery%20requires%20zero%20configuration%20and%20control%2C%20and%20it%20happens%20all%20the%20time%20based%20on%20the%20network%20telemetry%20observes%20by%20the%20Defender%20for%20Endpoint%20sensors.%20Also%20-%20having%20those%20unmanaged%20devices%20listed%20in%20your%20device%20inventory%20can%20give%20you%20much%20more%20context%20for%20any%20security%20incident%20that%20involves%20both%20managed%20and%20unmanaged%20devices.%3C%2FP%3E%0A%3CP%3E2.%20Unfortunately%20that's%20not%20supported%20today%2C%20but%20we%20are%20definitely%20looking%20into%20that.%20Would%20you%20expect%20having%20MDE%20data%20flowing%20into%20CMDB%2C%20or%20in%20the%20opposite%20direction%3F%3C%2FP%3E%0A%3CP%3E3.%20Visit%20our%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-defender-for-endpoint%2Fendpoint-discovery-navigating-your-way-through-unmanaged-devices%2Fba-p%2F2248909%22%20target%3D%22_self%22%3Epublic%20preview%20announcement%20blog%3C%2FA%3E%2C%20it%20has%20the%20information%20you%20are%20looking%20for%20under%20%22Discovering%20the%20right%20devices%22%20section.%20See%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fdevice-discovery-faq%3Fview%3Do365-worldwide%23what-happens-if-my-onboarded-devices-is-connected-to-my-home-network-or-to-public-access-point%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EFAQ%3C%2FA%3E%26nbsp%3Band%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fconfigure-device-discovery%3Fview%3Do365-worldwide%23select-networks-to-monitor%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EMonitored%20Networks%20Configuration%3C%2FA%3E%26nbsp%3Bfor%20more%20info.%3C%2FP%3E%0A%3CP%3E4.%20Important%20to%20say%20that%20the%20Standard%20Discovery%20method%20has%20a%20very%20low%20footprint%20on%20the%20network%2C%20and%20our%20probing%20is%20usually%20targeted%20(not%20network-wide)%20and%20lightweight.%20We've%20tested%20this%20functionality%20with%20multiple%20security%20and%20network%20analysis%20tools.%20Usually%2C%20this%20activity%20is%20not%20considered%20to%20be%20anomalous.%20If%20it%20was%20detected%20as%20unusual%2C%20you%20can%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fdevice-discovery-faq%3Fview%3Do365-worldwide%23my-security-tool-raised-alert-on-unicastscannerps1-or-port-scanning-activity-initiated-by-it-what-should-i-do%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eexclude%20the%20script%20path%20from%20being%20monitored%20by%20the%20security%20tools%3C%2FA%3E%2C%20or%20use%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fconfigure-device-discovery%3Fview%3Do365-worldwide%23exclude-devices-from-being-actively-probed-in-standard-discovery%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EExclusions%3C%2FA%3E%20or%20the%20Select%20devices%20for%20Standard%20discovery%20controls%20in%20the%20Device%20Discovery%20settings%20based%20on%20the%20types%20of%20monitoring%20tools%20available%20in%20your%20network.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks!%3CBR%20%2F%3ERon%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Jun 21 2021 04:05 PM
Updated by: