Managing Microsoft Defender - without SCCM

[Lolus]

We have switched over to Microsoft Defender few years back for our MAT secondary and primary schools. Managing via SCCM which is great.

 

We support a bunch of non MAT primary schools and their Sophos contracts are due renewal. First idea was to just enable and manage Defender via Group Policies (and bin Sophos) but this won't give us full management (threat alerts, status and management of Defender on devices etc). I can't see it as a requirement on RPA insurance documents - so unsure if that would be ok with them if anything happens?

 

I believe there are some 3rd party tools that read devices logs, feed in Defender related events and also manage Defender clients. Any recommendations?

... or perhaps it's cheaper just to pay for Sophos...

 

Thanks

[mavhc]

Use Windows Event Forwarding to forward the Windows Defender event logs to a central source

[TechMonkey]

Are they O365 registered? Could be managed from there

[CHiLL]

I believe if you Intune the devices, you can manage the security from there (though it may require additional licenses).

[Lolus]

Devices are not O365 registered.

 

Schools are on O365 (emails, teams etc) and have only A1 Plus licenses.

 

Might request prices for Intune/Config Manager (some schools might only have around 50 devices in total).