Introducing tamper protection
In the previous chapter, we discussed how to configure Microsoft Defender for Endpoint and how to enroll desktops to make sure that they are protected against threats. But how do IT admins know that the required components for MDE are running, and their desktops are safe? That is where tamper protection comes in. Once enabled, alerts are raised in the Microsoft Defender portal in case tampering has been detected.
Enabling tamper protection
IT admins can use one of four ways to enable tamper protection depending on the design of their IT infrastructure:
- Using the Microsoft Defender portal: Use this method to enable or disable tamper protection for the entire tenant
- Microsoft Intune admin center or Configuration Manager: Use this method to enable or disable tamper protection for the entire tenant, or for a group of desktops or users
- Configuration Manager with tenant attach: Use this method to enable or disable tamper protection for...