Defender

Start here

• Keep Defender AV notifications visible: Let users see when Defender finds something malicious.
• Check which Defender email policy wins: Check policy scope and precedence before changing more settings.
• FQDN filtering and NRPT: Understand the shared-IP problem before blocking whole domains.

In this section

• Check which Defender email policy wins
  Check preset policy scope before expecting a custom email protection policy to apply.
• Defender Firewall FQDN filtering - prefer NRPT for broad blocks
  Prefer NRPT for DNS namespace blocks to avoid shared-IP fallout from broad Firewall FQDN rules.
• Defender for Identity Labs
  Practice Defender for Identity alert investigation in an isolated, planned lab.
• Keep Defender AV notifications visible
  Keep useful Defender Antivirus notifications without all the noncritical noise.
• Query commonly abused binaries
  Hunt for copied or renamed ie4uinit processes with version metadata and context.
• Simplify MDE for macOS deployment
  Bundle several Defender macOS permissions in one profile, then check the remaining deployment requirements.