After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender for Endpoint, your next step is to manage your features and capabilities. We recommend using Microsoft Endpoint Manager, which includes Microsoft Intune and Microsoft Endpoint Configuration Manager, to manage your organization’s devices and security settings. However, you can use other tools/methods, such as Group Policy Objects in Azure Active Directory Domain Services.
The following table lists various tools/methods you can use, with links to learn more.
| Tool/Method | Description |
|---|---|
| Threat and vulnerability management dashboard insights in the Microsoft 365 Defender portal | The threat & vulnerability management dashboard provides actionable information that your security operations team can use to reduce exposure and improve your organization’s security posture.
See Threat & vulnerability management and Overview of Microsoft 365 Defender. |
| Microsoft Intune (recommended) | Microsoft Intune (Intune), a component of Microsoft Endpoint Manager, focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications. |
| Microsoft Endpoint Configuration Manager | Microsoft Endpoint Manager (Configuration Manager), formerly known as System Center Configuration Manager, is a component of Microsoft Endpoint Manager. Configuration Manager is a powerful tool to manage your users, devices, and software.
See Manage Microsoft Defender for Endpoint with Configuration Manager. |
| Group Policy Objects in Azure Active Directory Domain Services | Azure Active Directory Domain Services includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).
See Manage Microsoft Defender for Endpoint with Group Policy Objects. |
| PowerShell, WMI, and MPCmdRun.exe | We recommend using Microsoft Endpoint Manager (which includes Intune and Configuration Manager) to manage threat protection features on your organization’s devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.
You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See Configure Microsoft Defender for Endpoint with PowerShell. You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See Configure Microsoft Defender for Endpoint with WMI. You can use the Microsoft Malware Protection Command-Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See Configure Microsoft Defender for Endpoint with MPCmdRun.exe. |