Let me switch over to a Windows 10 domain joined workstation so we can get
yet an even more accurate picture of SmartScreen behavior.
If I go into File Explorer, I have some files that I have staged.
Software that hasn't been digitally signed is a good
candidate for triggering SmartScreen.
So I launched this bit of shareware, and it says Windows protected
your PC. This is an unrecognized app. And if we go to More info, we
can see that it's an Unknown publisher.
Now, again,
you want to think about as an administrator how you can
mitigate against Run anyway from the user.
If your users are running as standard users, it's a lot easier to control that.
And remember, we've got App Control,
we've got AppLocker, so you've got ways to prevent these executable files from
running. SmartScreen, it should be looked at, is just one layer in your
multi‑layer approach to server and client security.
Let me open up Edge here.
I've got a really nice page you should know about. It's
demo.smartscreen.msft.net. This is a Defender SmartScreen
demo page. And as you can see, it says here that they're just for demo,
there's nothing actually malicious here. But it can demonstrate some of the
triggers that SmartScreen can give you here where you can,
when you're using ads, you can report a site, and that's part of
the reputation‑based basis of this technology. Exploit Page,
Malvertizing, Known Good, Known Malware.
So it's really nice to test these links on your own to see how
SmartScreen manifests itself. As a hybrid cloud administrator,
you really should know that for sure.
And then just again to hammer it home, the client application here is
going to be the Windows Security. I want to call it a Control Panel
because that's how I grew up in Windows, you know, all the way back to
MS‑DOS and the early versions of Windows,
but it's the Settings app, technically.
And if we go into App and browser control,
we've got Reputation‑based protection. And again,
here's some client‑side controls on how you can control. Do
you want SmartScreen running in Edge,
for example? What degree of protection do you want?
Do you want SmartScreen to apply to Microsoft Store apps as well?
And I would say yes, we do, for sure.
So to finish out this demo,
let's go out to a couple of Defender Cloud‑based tools.
One would be,
let's see here, how about Defender for Endpoint? This is security.microsoft.com.
And this provides a cloud‑based way to do vulnerability scanning,
anti‑malware scanning, or potentially all of your server and endpoint devices.
And it has all the benefits that I told you before in terms of artificial
intelligence on the back end, integration with tools like Microsoft Sentinel.
You can see some of that right on this home page.
And one thing you should know about from a hybrid cloud standpoint is
that you may already qualify for endpoint licensing here, and you may
be able to as an Azure AD administrator,
a global administrator,
be able to sign into security.microsoft.com to do your
Microsoft Defender for endpoint management.
So as you can see,
we've got a device inventory where you can come in and
take a close look at onboarded machines.
Now,
these could be Microsoft Azure, Server, or Client devices. They could be
mobile devices, depending upon how your hybrid cloud is set up.
And what I want you to see here is how deep the
scanning and reporting and alerting goes.
It goes far beyond the old days of anti‑malware/anti‑spyware kind
of stuff, where the agent will do a detailed software inventory.
And notice that it's bringing in Node and 7‑zip. It's bringing in
non‑Microsoft technologies and scanning those and assessing their
threat level as well, discovered vulnerabilities.
So you might be wondering, well, okay, how do you get started?
A convenient way to get started with Microsoft Defender for Endpoint
is if you already have an Azure subscription. If we go to
portal.azure.com and we sign into the portal,
which I've just done, and then we go to Defender for Cloud,
the way this works is if you're willing to onboard servers
into Microsoft Defender for Cloud,
let me go to Getting Started, and let me grab one of my subscriptions. Actually,
I don't have to. You can see, well, yeah, I might as well, I'll just
grab one of my subscriptions so you can see. The enhanced security off
is the free tier, and then the way the pricing works is that it's per
resource, and as you can see, there's a number of supported resource types.
The one that we're concerned with in AZ‑801 is the Defender for Server.
So this would cover your Azure, Linux, and Windows Server machines.
It would cover your Azure Arc‑enabled machines.
So this allows you to bring your on‑premises servers into scope.
You may also have servers in other clouds.
Again, you can bring those into scope here as well.
And part of the benefit of paying for the Defender for Servers plan is that
you get licensing for endpoints. So you'll be able to deploy the endpoint
software on those managed servers and then sign into the endpoint central
console here where you can do far more than I can show you just in the space
of a brief demo. I just want to make sure you see that link up between
Microsoft Defender for Cloud,
which is intended more globally across your hybrid cloud for
basic security, and then the Defender for Endpoint management console specifically for that use case.