Gradual rollout process for Microsoft Defender

One of the features of Microsoft Defender Antivirus that, in my opinion, is overlooked by most, is the ability to control the rollout of all components of Microsoft Defender Antivirus by selecting different release channels. This allows for a more gradual rollout of security intelligence updates, the engine as well as the AV platform.

Different update types

But let’s take a step back and get a common understanding whats the difference between those different updates is and how they are deployed.

You can check which are the current versions on this website or, if you need the information inside of a script, use this snippet.

Invoke-RestMethod -Uri "https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info" | Select -ExpandProperty versions

Be aware that the Microsoft Update Catalog contains more than one version of the platform update. Version 4.18.2001.10 is a important update for Windows Server 2016 because it is needed before you can install any newer platform version.

Attribution

A big thanks goes out to Paul @Threatzman Huijbregts (Senior PM at Microsoft) who double checked my info graphic below. If you want a look behind the curtain of Microsoft Defender for Endpoint and it’s history inside of Microsoft, you should follow him on Twitter and wait for the release of #thebookofmde he and Joe @trk_rdy are currently writing.

Gradual rollout process

Many companies don’t want to update all their devices at the same time to the most current version of a product. Especially when talking about signature updates a staged rollout can minimize the impact of the detection of false positives.

But also a new engine update or platform update could introduce unwanted side effects on your devices and testing is therefore important.

If you want a bit more control over at which stage of the global rollout the updates hit your devices you are in luck. Microsoft has made the process of gradually rolling out those updates super easy in June of 2021, when they introduced the ability to choose update channels in the Microsoft Defender Antivirus settings.

Using either Intune, Group Policies or PowerShell you can set an update channel for each of your devices or better device groups and even differentiate between channels for the different update types.

Security intelligence updates

Setting name: SecurityIntelligenceUpdatesChannel

Platform and engine updates

Setting name: PlatformUpdatesChannel + EngineUpdatesChannel

Since I like to visualize stuff for a better understanding, I created this overview of how the different channels and settings align with the Microsoft gradual rollout

Assign devices to channels

The following diagram display a sample option on how you could assign your devices to specific channels. This is just a rough guidance and you will have to check your requirements to see if this fits your needs, you do you.

Group Policy

Download the most current ADMX/ADML files and put them into your PolicyStore folder. To my knowledge this would be the files in the Device Control GitHub repository.

Create a new group policy and select the appropriate settings and assign the GPO to the device group of you choise.

Intune configuration

At the time of writing this blog post the settings are only available using a custom template. They are not part of the settings catalog nor Endpoint security. To check available values head over to the Defender CSP definition.

First create a new Entra ID (Azure AD) security group for the respective channel and assign the computers to it.

Head over to Intune and create a new custom template.

Assign a name to the configuration profile

Create the respective entries for each OMI-URI.

Assign the earlier created device group and finish the creation of the configuration profile.

Check your settings

Client side

Use Get-MpPreference to verify that your new settings are correctly applied. Currently the cmdlet will return the integer values that you used in the custom Intune OMI configuration.

Get-MpPreference | Select *Channel*, *Gradual* | Format-List

Advanced hunting

let AvModeDescription = dynamic({"0":"Normal", "1":"Passive", "4":"EDR Block"});
let RingDescription = dynamic({ "2":"Beta", "3":"Preview", "4":"Staged", "5":"Default-Manual", "6":"Critical: Time Delay"});
DeviceTvmInfoGathering
| extend AdditionalFields = parse_json(AdditionalFields)
| extend AvEngineVersion = tostring(AdditionalFields.["AvEngineVersion"])
| extend AvPlatformVersion = tostring(AdditionalFields.["AvPlatformVersion"])
| extend AvMode =  tostring(AvModeDescription[tostring(AdditionalFields.["AvMode"])])
| where isnotempty( AvMode )
| extend AvEngineRing = tostring(RingDescription[tostring(AdditionalFields.["AvEngineRing"])])
| extend AvEngineRing = iff(isempty(AvEngineRing),"Default",AvEngineRing)
| extend AvSignatureRing = tostring(RingDescription[tostring(AdditionalFields.["AvSignatureRing"])])
| extend AvSignatureRing = iff(isempty(AvSignatureRing),"Default",AvSignatureRing)
| extend AvPlatformRing = tostring(RingDescription[tostring(AdditionalFields.["AvPlatformRing"])])
| extend AvPlatformRing = iff(isempty(AvPlatformRing),"Default",AvPlatformRing)
| project-away AdditionalFields, Timestamp, LastSeenTime, DeviceId