This guide will show an administrator how to create an allowance of a specific application based on certificate association.
Role Requirements
Procedure Scope: Administrators
Required Group Membership: Admin.Security
Handbook Reference
Package: Device Security
Domain: Endpoint Indicator Management
Modifies: Allowed Certificates
Defender for Endpoint Certificate IOC Allowance
- Navigate to the Certificates – Microsoft Defender portal, locate and select the Add Item action.
- A pop-up will be generated select the Chose File action to upload the certificate. You will also need to provide basic information associated with the entry such as Title and Description, with the intent of giving future context if the rule is to be reviewed later. From this page you will either keep the default allow time frame of Never or specify a Custom time frame. Select Next to continue.
- For the response action, select Allow this will allow the certificate to run on devices. Select Next to continue.
- The default for the organizational scope is set to all MDE joined devices, select Next to continue.
- The summary page will allow you to see all configured settings for the indicator, if you detect a discrepancy at this stage make note of the section and select Back to go to the previous sections to make the necessary alterations before finalization. If everything checks out, select Submit to publish the indicator.
Need Assistance?
Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? Inquire about arranging a consultation to explore optimizing your Azure environment for painless management.