To onboard devices without Internet access, you’ll need to take the following general steps:
Important
The steps below are applicable only to devices running previous versions of Windows such as: Windows Server 2016 and earlier or Windows 8.1 and earlier.
Note
- An OMS gateway server cannot be used as proxy for disconnected Windows or Windows Server devices when configured via ‘TelemetryProxyServer’ registry or GPO.
- For Windows or Windows Server – while you may use TelemetryProxyServer, it must point to a standard proxy device or appliance.
- In addition, Windows or Windows Server in disconnected environments must be able to update Certificate Trust Lists offline via an internal file or web server.
- For more information about updating CTLs offline, see Configure a file or web server to download the CTL files.
For more information about onboarding methods, see the following articles:
- Onboard previous versions of Windows
- Onboard servers to the Microsoft Defender for Endpoint service
- Configure device proxy and Internet connectivity settings
On-premises devices
- Setup Azure Log Analytics (formerly known as OMS Gateway) to act as proxy or hub:
- Azure Log Analytics Agent
- Install and configure Microsoft Monitoring Agent (MMA) point to Defender for Endpoint Workspace key & ID
Onboard previous versions of Windows
- Offline devices in the same network of Azure Log Analytics
- Configure MMA to point to:
- Azure Log Analytics IP as a proxy
- Defender for Endpoint workspace key & ID
- Configure MMA to point to:
Azure virtual machines
- Setup Azure Log Analytics Gateway (formerly known as OMS Gateway) to act as proxy or hub:
- Azure Log Analytics Gateway
- Install and configure Microsoft Monitoring Agent (MMA) point to Defender for Endpoint Workspace key & ID
- Offline Azure VMs in the same network of OMS Gateway
- Configure Azure Log Analytics IP as a proxy
- Azure Log Analytics Workspace Key & ID
- Microsoft Defender for Cloud
- Security Policy > Log Analytics Workspace
- Threat Detection > Allow Defender for Endpoint to access my data
For more information, see Working with security policies.
Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team
(Visited 237 times, 1 visits today)