Microsoft Defender for Endpoint Deployment

Overview

EnforceDNS’s MDE integration enables agentless DNS protection by leveraging your existing Microsoft Defender for Endpoint deployment. This self-service method allows organizations to rapidly enable Protective DNS without additional endpoint installations. DNS traffic is automatically routed through EnforceDNS’s Anycast resolvers, providing visibility and enforcement both on- and off-network.

EnforceDNS ↔ Microsoft Defender for Endpoint: High-Level Integration Architecture

Prerequisites

• Licensing

  • Microsoft

    • https://learn.microsoft.com/en-us/defender-endpoint/minimum-requirements

  • threatER

    • Active EnforceDNS License.

• Active Microsoft Defender for Endpoint installed on all target Windows devices

• Admin access to your EnforceDNS account and MDE console

• No conflicting DNS routing—EnforceDNS Agent or manual DNS configurations should be disabled for MDE-targeted devices

  • MDE and Agents: The Conflict

Key Features, Benefits & Considerations

Integration Architecture

1. Data Collection by MDE

   1. Once the integration is installed, MDE begins collecting data from various sources on your machines. This includes critical information from Device Network Events and Device Events within the Microsoft Security Center.

2. Data Streaming to EnforceDNS

   1. The collected data is streamed via an API to an Event Hub. EnforceDNS then retrieves this data for analysis. Specifically, it examines DNS queries to provide security verdicts.

3. Verdict Enforcement

   1. The exciting aspect of this integration is that EnforceDNS’s verdicts—whether based on Categories, Rules, Lists, or the Decision Engine—are passed along to MDE for enforcement (assuming blocking is enabled). This ensures that all unsafe domains identified by EnforceDNS are blocked effectively.

4. Enabling Blocking (Optional)

   1. The final step involves enabling the Blocking feature. While optional, this feature empowers MDE to act as the enforcement mechanism, blocking traffic to all domains deemed unsafe by EnforceDNS.

MDE Deployment

Step 1 - Provision an Azure Event-Hub

1. Select the Region you’d like the Event-Hub to be hosted in.

   1. We provide options in both the US and Europe.

2. Select a Partition Count. The default setting is 4 as this will be sufficient for most organizations. If you anticipate a large volume of DNS requests, you may increase this number to provide better performance.

3. Enter the MDE Admin’s email and select Provision.

   

4. Once clicking on Provision, you receive one of two notifications letting you know if deployment was successful or not.

   1. 
      

   2. If you provisioning failed and errors persist, please contact EnforceDNS Customer Support.

Step 2 - Update Microsoft Security Center

Now that you’ve created an Event-Hub, you must update your Microsoft Security Center to push data to that hub. This will be accomplished through the following steps:

1. Log into Security Center and navigate to Settings, Microsoft Defender XDR and then Streaming API

2. Click Add

3. Name your Streaming API

4. Enable Forward events to Event Hub

5. Enter the Event-Hub Resource ID and Event-Hub name

   1. Event-Hub Resource ID and Event-Hub name can be found under STEP 2 of the MDE self-service page in EnforceDNS as Resource ID and Event-Hub Name respectively.

6. Under Event Types, expand the Devices section and select DeviceNetworkEvents and DeviceEvents

7. Click Submit. Defender for Endpoint will now save these incoming events in the Event-Hub.

Step 3 - Blocking Mode (OPTIONAL)

If you wish to continue enabling Blocking Mode, you must first configure such in your Azure Portal.

1. Navigate to the Azure Portal and search for Microsoft Entra ID in the search bar at the top of the page

2. Once in the Microsoft Entra ID section, expand the Manage menu and select App registrations

3. Click the New registration button at the top of the page

4. Name the application

5. Select Accounts in this organizational directory only (Your Tenant)

6. Click Register

7. Now that you’re in the Application you just created, expand the Manage menu and select Certificates & secrets.

8. Click the New client secret button.

9. Specify the Description and Expiration (Recommendation set to 1 year)

10. Click Add

11. Copy the Secret value to the side, this value will be entered into the EnforceDNS UI in a moment.

12. Select API permissions from the left navigation pane.

20. Click Add a permission

21. Select APIs my organization uses

22. Filter for WindowsDefenderAPT

23. Select Application Permissions

    1. Then select and expand Ti

24. Select Required Permissions:​

    1. Ti.Read.All

    2. Ti.ReadWrite.All

    3. Ti.ReadWrite

25. Click Add permissions to apply these permissions to your application

26. Head back to the Overview page to copy the Application (client) ID and Directory (tenant) ID

24. Navigate to the EnforceDNS Portal, toggle ON “Blocking Enabled” from the MDE self-service page.

    

25. Enter information for the Secret Value, Application (client) ID and Directory (tenant) ID, then click on Verify Access.

26. Once the verification is completed, you’ll receive a notification at the top of your screen indicating whether the verification was successful or if it encountered an error.

27. If successful, click on Save.

    1. Give the system 5-10 minutes and blocking based on EnforceDNS’s recommendation will be enabled.

Enable the Integration

1. Finally, to enable the integration once everything has been configured properly, toggle the MDE integration to Enabled.

   

2. Make sure that Allow threatER to host the Azure Event-Hub (RECOMMENDED Default) box is checked.

   1. This will initiate the provisioning of a threatER-managed Event-Hub, enabling troubleshooting and other support activities in case any issues arise.

   2. In the event you wish to host your own Event-Hub, uncheck this box and enter the information as listed above.

Agent Deployment Checklist & Verification

Configuring Policies

Now that you’ve successfully deployed EnforceDNS, your environment is already safeguarded against malicious domains—including phishing sites, malware delivery networks, and command-and-control (C2) infrastructure (among others). These threats are blocked by default using threatER’s infrastructure intelligence and real-time decision engine.

If you'd like to customize your protection further, you can configure additional policies—such as blocking unwanted content categories, managing allow/block lists, or tailoring behavior by source network or user group.

Learn How to Configure Policies ➡️