Announcing Tamper Protection for Configuration Manager Tenant Attach clients

[Matt Shadbolt]

Matt Shadbolt (@ConfigMgrDogs) - Principal Program Manager | Microsoft Endpoint Manager

Last year, the Defender for Endpoint team and Microsoft Endpoint Manager team collaborated on a new feature called Tamper Protection.

Tamper Protection protects against malicious actors modifying the configuration of Microsoft Defender on Windows 10 clients to disable AV protection, real-time protection, behavior monitoring, cloud-delivered protection, or to remove security intelligence updates. Endpoint Manager and Defender for Endpoint uniquely enable Enterprise administrators to enable and disable Tamper Protection in a secure manner.

Before today, Tamper Protection controls were only available for Windows 10 clients being managed via Intune cloud management or ConfigMgr co-management.

Today we’re excited to announce Tamper Protection has been extended to ConfigMgr 2006-only clients on both Windows 10 and Windows Server 2019, delivered via Tenant Attach. (Windows Server 2016 coming soon!)

Tenant Attach allows you to sync your on-prem only ConfigMgr clients into the Microsoft Endpoint Manager admin center, and deliver Endpoint security configuration policies to your on-prem collections/clients.

You can easily enable Tenant Attach by following these instructions.

Once enabled, browse Endpoint security > Antivirus in the Microsoft Endpoint Manager admin center to create and deploy the Tamper Protection setting.

Next, configure the Tamper Protection setting and deploy it to a Configuration Manager collection of devices.

The policy syncs down to the ConfigMgr site, and applies to all devices in the target collection. You can view the policy status in the Monitoring > Deployments section in ConfigMgr, and can also be found in the policy status in the Endpoint Manager Admin center

 

Clients now have the Tamper Protection feature On, and you can validate in on the client by viewing the Windows Security app > Virus & threat protection > Virus & threat protection settings

 

Tamper Protection is a unique Microsoft 365 feature, utilizing the deep integration we deliver to enable both Security and IT management teams to keep their organization secure.

To learn more, please visit our Endpoint security docs.

[Harjit Dhaliwal]

Great implementation. Thanks.

[niels haaijer]

Is Microsoft Defender Advanced Threat Protection E5 license a requirement to use this feature?

[Zach_Howes]

@niels haaijer  - yes, Tamper Protection via Endpoint Manager will only be applicable to E5, MDATP enrolled devices. 

[Navneet_Singh_Ghura]

Hello @Zach_Howes Are you sure for Tamper Protection device needs to be MDATP enrolled? 
I no where see this as a prerequisite.
https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-antivirus-policy#prerequisites...
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/pre...  

[MattoNZ]

It would be awesome if you could still control AV Settings fully via GPO when Tamper Protection is turned on in Defender ATP.  Servers can't be enrolled in Intune natively and we decided to stick with configuring Defender AV / ATO on Servers via GPO's & didn't SCCM the Servers. 

Tamper Protection means these settings can't be controlled anymore, so basically have to turn of the whole thing site wide in Defender ATP to just disable AV on one server, one time...