Microsoft Defender for Endpoint – Defender for Endpoint configuration Part2
About this Part
In Part 2, we will cover the following topics related to Microsoft Defender for Endpoint:
- Microsoft Defender for Endpoint Advanced Features
- Email Notifications
- Remediation
- Indicators
- Custom Data Collection
- Web Content filtering
- Automation Upload
- Data Rentention
Prerequisites
The following prerequisites must be met:
- Onboarded Microsoft Defender tenant
- Appropriate permissions
Note: When creating a new Microsoft Defender tenant, each component (Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps) must be provisioned separately. The process typically takes 30–60 minutes, but in some cases it may take up to 1–2 hours. The data center region selected the first time is final and cannot be changed later.
Data storing and Retention
As mentioned in the “Note” section above, you must select the appropriate region the first time you set this up, and this selection cannot be changed later. Generally, data retention is possible for periods ranging from 30 to 180 days. The default data rentention period is 180 days. This cannot be changed directly in the Defender Portal interface; therefore, the change must be initiated through a Microsoft support ticket. Although Microsoft Defender for Endpoint Advanced Hunting data is limited to a short retention period, typically 30 days.
Data rentention for Vulnerability management data:
| Data Source | Retention Period |
| Android Apps | 7 days or 31 days |
| Browser extension | 7 days |
| Certificates | Up to two days before latest report |
| Deleted registry products | 30 days |
| Firmware and hardware | 31 days |
| IOS apps | 7 days or 31 days |
| Linux packages | 7 days or 31 days |
| Software components form users/file scan sources | 7 days |
| User-scoped file paths | 7 days |
| User-scoped registry keys | 7 days |
| Default | 31 days |
Microsoft Data storage and privacy: https://learn.microsoft.com/en-us/defender-endpoint/data-storage-privacy?view=o365-worldwide
Email Notification
Microsoft Defender XDR provides a centralized notification system that enables the sending of email notifications regarding security events from individual Microsoft Security products. It natively supports email sending for all Microsoft Security products. These products are as follows:
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Endpoint
- Microsoft Defender XDR
- Microsoft Defender for Office365
- App Governance
- AAD Identity Protection
- Microsoft Data Loss Prevention
- Microsoft Defender for Cloud
- Microsoft Sentinel
- Microsoft Threat Intelligence
The settings can be configured in the Microsoft Defender portal under Defender Portal:
Security.microsoft.com –> system –> settings –> Microsoft Defender XDR –> Email notification
The email notification settings support incidents, actions, and threat intelligence.
With Defender for Endpoint, email notifications allow you to stay informed about new vulnerabilities.
Advanced Features
By default, Microsoft provides a basic configuration for all of its security products. In the case of Defender for Endpoint, the Advanced Features option allows you to configure additional settings that provide extra protection or integration capabilities, such as integration with Microsoft Defender for Cloud Apps or Intune.
You can change these settings by following this path:
Security.microsoft.com –> system –> settings –> Endpoints –> Advanced Features
Restrict correlation to within scoped device groups
This configuration determines whether incident creation during alert correlation should take device group-based access boundaries into account. If this setting is enabled, the system does not create an organization-wide, aggregated incident spanning multiple device groups, but instead segments the correlation at the device group level. As a result, cross-device-group alerts are not consolidated into a single incident but are broken down into multiple separate incidents based on access scopes. This allows the local SOC to handle only incidents involving device groups within its own scope of authority, but the global SOC loses the unified incident view and sees multiple incidents for the same correlated event chain.
Enable EDR in block mode
EDR can provide protection even when Microsoft Defender Antivirus is running in passive mode. In this case, the system automatically blocks detected malicious files and behaviors and can also intervene on the compromised device after the fact. This capability significantly reduces mean time to respond (MTTR) by enforcing behavioral-based prevention directly at the endpoint, without requiring human analyst intervention.
Attack Scenario: An attacker executes a PowerShell payload via a phishing email. Traditional antivirus software fails to detect it, but the EDR behavioral engine identifies the suspicious process tree and blocks its execution.
Automatically resolve alerts
Automatically resolve alerts allows Defender to automatically close alerts where no threat was found or where the detected threat was successfully mitigated.
Hide potential duplicate device records
This feature hides potential duplicate device records to provide a more accurate device list in the Microsoft Defender for Endpoint interface.
When enabled, the system identifies likely duplicates based on the hostname and last activity time, and hides them from multiple views (e.g., Device Inventory, Vulnerability Management, and APIs that use device data). This way, only the relevant device records remain visible.
It is important to note that these duplicates do not disappear entirely: they remain visible, for example, in global search, Advanced Search, and in alert and incident views.
Custom network indicators
Custom Network Indicators allow you to create your own indicators (IP addresses, domains, URLs, certificates, or file hashes), which the system uses to determine whether to allow or block specific network destinations. With this setting, you can essentially create a custom allow/block list to protect your organization, allowing you to control traffic based on the defined indicators.
For example, if a user clicks on a malicious website, the security team can easily block that site using these indicators.
Tamper protection
The blocking feature is available only if your organization uses Microsoft Defender Antivirus as its active antimalware solution and cloud-based protection is enabled. If these conditions are met, the system allows for the centralized blocking of potentially malicious files, preventing them from being read, written, or executed on devices within the organization.
Show user details
Show user details allows the SOC team to view user data in the event of an incident. If this feature is not enabled, a hash will appear in place of the user name.
Microsoft Defender for Cloud Apps
This allows Microsoft Defender for Endpoint signals to be forwarded to Microsoft Defender for Cloud Apps, providing more detailed insights into the use of cloud applications. With the forwarded telemetry, Cloud Apps can analyze user activities and application usage in a richer context.
Web content filtering
Web content filtering feature is designed to filter web traffic, allowing you to block websites containing unwanted content and monitor users’ web activity across all domains.
You can configure this on the following page:
security.microsoft.com –> system –> settings –> endpoint — > Web Content Filtering
The following categories are available:
If you check the selected categories, the rule will take effect in blocking mode, and the specified content types will be effectively blocked. However, there is no separate report-only mode; therefore, if you only want to use the rule for monitoring purposes, you must not select any categories the rule must be created and published with empty categories.
Device discovery
Device discovery allows you to automatically detect unmanaged devices on your corporate network without the need for additional hardware or complicated processes.
Download quarantined files
Download quarantined files allows for automatic backups of quarantined files to be created in a secure storage location that is also compliant with regulatory requirements. As a result, files in quarantine remain directly downloadable from the interface, and the “Download file” button is always available on the file details page. This allows the SOC team to easily analyze quarantined files.
Default to streamlined connectivity when onboarding devices in Defender portal
It switches the default device onboarding package to “streamlined connectivity” mode for supported operating systems.
Live Response
The Live Response feature allows administrators with the appropriate permissions to launch a remote, interactive command-line session on endpoints or servers for incident investigation and troubleshooting.
- Enabling Live Response makes this capability available on devices, allowing the SOC team to run diagnostics, inspect files, or perform incident-related actions in real time.
- Live Response for Servers provides the same functionality for servers, with a separate permission level.
- The unsigned script execution option allows unsigned scripts to be run within a Live Response session, which provides greater flexibility for investigations but also significantly increases security risk; therefore, it is recommended only in strictly controlled environments.
Share endpoint alerts with Microsoft Compliance Center and Microsoft Intune connection
- Alert sharing with Microsoft Compliance Center: This setting sends endpoint security alerts and their investigation status to Microsoft Compliance Center.
- Microsoft Intune integration: This feature connects Microsoft Defender for Endpoint with Intune, enabling the sharing of device information and more advanced policy enforcement.
Preview features
Enables testing and use of Public Preview services in the environment.
Automation Upload
Automation upload enables automatic cloud-based content analysis as part of the Automated Investigation process. If you enable this, the system will automatically upload files and email attachments with the specified file extensions to the cloud for further security analysis. Microsoft uses various scanning mechanisms to examine these in detail.
To enable this feature, you must specify which file extensions the rule applies to (e.g., .exe, .bat, cmd, etc). For these file types, every affected file or attachment is automatically submitted for analysis during Automated Investigation.
Custom Data Collection
Custom Data Collection allows organizations to create their own customized data collection rules in addition to standard telemetry data collection. This enables security teams to fine-tune which events the system collects and under what conditions (e.g., folder paths, process names, network connections).
Remediation
Automated Investigation and Response technology uses various investigation algorithms based on the working methods of security analysts. Its purpose is to automatically analyze alerts and, if necessary, take immediate action to address security incidents. AIR significantly reduces the number of alerts by automatically performing initial investigation and necessary remediation, allowing SOC teams to focus on more complex threats.
| Automation level | Explanation |
| No automated response | Devices will not be investigated. |
| Semi – require approval for all folders | In this process, devices are automatically investigated as soon as a detection system generates an alert. However, any remediation actions recommended or identified during the investigation are not carried out automatically; approval is required in every case before they can be implemented. |
| Semi – require approval for non-temp folders | In this mode, devices are automatically scanned as soon as a detection system sends an alert. In certain cases, the system also performs automatic remediation, but this is limited: it automatically removes only malicious items found in the temporary and download folders. All other remediation actions still require approval. |
| Semi – require approval for core folders remediation | In this configuration, devices are automatically investigated whenever an alert is triggered, and in most cases, the system automatically performs remediation. The exception to this are threats identified in critical system directories: in these cases, remediation does not run automatically; instead, approval is required before remediation can be performed. |
| Full – remediate threats automatically | In this mode, Microsoft Defender for Endpoint (MDE) handles incidents fully automatically: devices are investigated when an alert is triggered, and the necessary remediation steps are also carried out automatically, without human intervention. |
According to the recommendation, the automation level should be set to Full – automatic remediation mode, so that the system automatically mitigates threats and exceptions need to be handled only when necessary. If full automation is not applicable it is advisable to set one of the semi-automation modes.
It is not recommended to make exceptions for the Ungrouped devices (default) group: “Full – automatic remediation” should always be the default setting there.
Conclusion
In this section, we have reviewed the basic and advanced configuration options of Microsoft Defender for Endpoint, Part 2. We have covered automated protection, how incident and alert management works, network and web inspections, indicators, as well as integration and data collection features.
In the next part, we will review the permission model, which determines who can perform which actions in the Microsoft Defender for Endpoint environment.