Introduction
Just as Memphis Raines had to steal 50 cars in one night in “Gone in 60 Seconds” we’re going to set up a complete Defender for Servers POC in 60 minutes. Our “Eleanor” isn’t a ’67 Shelby GT500, but a fully secured and monitored Hybrid-Cloud environment. This guide combines insights from my previous posts on Azure Arc, tagging, and Defender for Cloud to create a practical setup process.
Our Heist Checklist
- Connect machines to Azure Arc for Servers
- Tag the machines
- Enable Defender for Cloud P1 on resource level based on tags
- Add the Defender for Servers (MDE) extension
Step 1: Connecting to Azure Arc (0-15 minutes)
First, we need to bring our servers into the Azure fold. While the detailed process of connecting machines to Azure Arc is beyond the scope of this post, you can follow Microsoft’s official documentation for this step. Once connected, we’ll be working with these Arc-enabled machines in the subsequent steps.
Step 2: Tagging Our Fleet (15-30 minutes)
Tagging helps organize and manage our resources. We’ll use a PowerShell script to tag our Azure Arc machines with a simple “DEFENDER” tag set to “YES“:
This section is reserved for our Premium Members only. Upgrade your membership to access this solution and unlock more benefits.
This script tags all Azure Arc-connected machines in a specified resource group with “DEFENDER = YES”, setting up our environment for the next steps.
Step 3: Enabling Defender for Cloud P1 (30-45 minutes)
Now that our machines are tagged, we’ll use the DefenderforCloud PowerShell module to enable Defender for Cloud P1 on the resource level. First, install the necessary modules:
This section is reserved for our Premium Members only. Upgrade your membership to access this solution and unlock more benefits.
Then, we’ll use the following script to enable Defender for Cloud P1:
This section is reserved for our Premium Members only. Upgrade your membership to access this solution and unlock more benefits.
This script retrieves all Arc servers tagged with “DEFENDER: YES” and enables the Defender plan on each of them.
Step 4: Adding the MDE Extension (45-60 minutes)
Finally, we’ll add the Microsoft Defender for Endpoint extension to our Arc-enabled machines. We’ll use the Microsoft.Security/mdeOnboardings API for this:
This section is reserved for our Premium Members only. Upgrade your membership to access this solution and unlock more benefits.
This script retrieves the MDE onboarding package for each Arc-enabled machine and installs the MDE extension.
Conclusion: Driving Off into the Sunset
Just like Memphis and his crew celebrated after their successful heist, we can now admire our fully set up Defender for Servers POC. We’ve gone from zero to hero in just 60 minutes, creating a secure, monitored environment that would make even the most skilled car thief jealous.
We’ve connected our machines to Azure Arc, tagged them, enabled Defender for Cloud P1, and added the MDE extension. This setup provides a solid foundation for managing and securing your hybrid environment.
Remember, in both car heists and cybersecurity, it’s all about precision, speed, and having the right tools for the job. Happy defending!
