Get Started with Microsoft Defender for 365

In this session, I’ll walk you through the basics of getting started with Microsoft Defender for 365. This session will compliment my other sessions on Defender that focus on specific topics. We live in dangerous time and ensuring that we have adequate cyber-defences is critical to having an overall information / cybersecurity defence strategy. Being able to not only detect an incident, but also prevent an incident is a critical skill that must be addressed in the modern organisation.

This video forms part of a series on Microsoft Defender. Here are the other videos you may wish to take a look at.

[Lionking]

Very well presented ! Andy keep posting you are doing a great job

[OldFellaDave]

Top Video Andy. I'm thinking that a video primer showing ALL of the Microsoft Defender Options, what each is used for might be handy ... because every time I look at it inside my O365/M365 backend - I get a headache! Defender for 365, Defender for Endpoint, Defender for Business, Defender for Cloud, Defender for Server, Plan 1 or Paln 2, Hybrid joined devices, Hybrid Registered devices, Azure Ad Joined devices, On-Prem devices and then good old standard Windows Defender ...

It's almost like Microsoft wants you to buy licenses for as many different things as possible ;)

[MarkRouleau]

I would love to see videos based on Business licenses. It seems things are quite different when you want to do administration, especially when your users are Business Standard and Basic. Its almost like us small business owners are an afterthought.

[jesseveentjer]

Excellent timing, set up a server with endpoint plan 2 today (swapping environment over from eset) using the script deployment.

The only thing unclear to me now is (since the servers wont be in intune) if the management status of ‘unknown’ is problematic/insufficient..

[vegasjosejavier]

Hey Adny! Great overview, I recently passed the SC-200 exam, and this is good refreshing of the material.

One question: where can I access M365 trials with demo data like the ones you use? I understand the trials but obviously these come empty, I just wonder how you do it.

Thanks, in advance.

[Kim-trfy]

Hello. Thanks for your videos! Do you have any best practices for investigating/ remediating the incidents/alert reported in defender? Like a decision tree of some sort that takes me step by step through the analysis, action and closure of incidents/alerts? For example. Phishing email shows in incident log - didn't hit anyones inbox, is currently in quarantine - what do I do? Just close the alerts because MS already did it or do I need to block each of the senders? Was hoping to find some sort of decision tree or at least a glossary of the incident names do I can better understand what needs to happen. Any help greatly appreciated!

[wigglywrigglydoo]

Hi Andy, if our company is using SCCM to manage Defender scan and update policies. Where will we need to migrate these settings to? Intune Admin Center's Endpoint security? Device Configuration? Microsoft 365 Defender?

[qwoz]

Do you know conferences/trainings that give a person good hands on training with defender? Im looking to see if I can attend one this year to get hands on training, preferably with real situation scenarios

[MarkRouleau]

Is there a way to clean the file that come up as malware or viruses? I am Office business premium. I don't see any actions. I only see submissions and I don't see the file on my test machine that is malware that shows up under incidents and alerts.

[bangjago]

Thank you for video. How to assign role security reader for IT team but block access to read/open/access email & collaboration category?

[dame_]

Sir we have a user whose getting random spam emails, there is no specific pattern/ sender/location/ IP. They are very random. He is getting 2000+ emails daily. We cannot create rule/ policy as such bcz he needs to receive mails from external partners regularly

[alaintchouankeu]

Very great video sir, I have learned a lot.However, I don't see all that option in my Windows defender. Maybe because I am not an administrator

[colin_a]

Daft question, but where do you download Microsoft Defender for Office 365 (Plan 1) from..?

[xfcueei]

Hy Andy can I know relation between O365 E5 licenses and M365 E5 licenses

[talhayalcinkaya]

Hey Andy, would you consider making KQL training please?

[mattiasolsson]

Do you have any plans on showing Defender for identity? Also Defender for servers but identity first 😅😊 and as always, great video 👍

[thirusudhakar]

Brother I have got new Job M365 security engineer, I have only one month time to go there, Could please tell me how to get knowledge about Microsoft Defender in simple way.

[alvaroascanio]

Great content thanks, how can I get a training from you?

[nbcfmej]

Window Defender is garbage. it uses so much memory, I can't stream movies with a gig of RAM. Then you can't disable it without it automatically re-enabling itself. It's really difficult to remove completely, once you get fed up with it... and you will.