Defender for Business: Missing ASR Rules Report

%3CLINGO-SUB%20id%3D%22lingo-sub-3271817%22%20slang%3D%22en-US%22%3EDefender%20for%20Business%3A%20Missing%20ASR%20Rules%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3271817%22%20slang%3D%22en-US%22%3E%3CP%3EAccording%20to%20the%20documentation%2C%20Defender%20for%20Business%20contains%20Attack%20Surface%20Reduction%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-business%2Fcompare-mdb-m365-plans%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-business%2Fcompare-mdb-m365-plans%3Fview%3Do365-worldwide.%26nbsp%3B%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20added%20the%20rules%20for%20a%20tenant%2C%20and%20I%20get%20messages%20from%20users%20that%20a%20installer%20that%20they%20needed%20to%20download%20is%20blocked.%20I%20know%20from%20other%20tenants%20(with%20Defender%20for%20Endpoint)%20that%20the%20message%20that%20they're%20getting%20is%20from%20ASR%20Rules.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnly%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere's%20no%20way%20to%20check%20that%20in%20the%20Attack%20Surface%20Reduction%20Rules%20Report%2C%20because%20it%20doesn't%20exist%20in%20a%20tenant%20with%20Defender%20for%20Business%20(preview%20program)%2C%20All%20users%20have%20Microsoft%20365%20Business%20Premium%20licenses.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20this%20report%20expected%20to%20appear%20any%20time%20soon%3F%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3433371%22%20slang%3D%22en-US%22%3ERe%3A%20Defender%20for%20Business%3A%20Missing%20ASR%20Rules%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3433371%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F572941%22%20target%3D%22_blank%22%3E%40molislaegers%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMe%20too%2C%20today%20i%20open%20a%20case%20with%20MS%20%2C%20i'm%20back%20when%20respond%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

According to the documentation, Defender for Business contains Attack Surface Reduction https://docs.microsoft.com/en-us/microsoft-365/security/defender-business/compare-mdb-m365-plans?vie...

 

I've added the rules for a tenant, and I get messages from users that a installer that they needed to download is blocked. I know from other tenants (with Defender for Endpoint) that the message that they're getting is from ASR Rules. 

 

Only:

 

There's no way to check that in the Attack Surface Reduction Rules Report, because it doesn't exist in a tenant with Defender for Business (preview program), All users have Microsoft 365 Business Premium licenses. 

 

Is this report expected to appear any time soon?  

1 Reply

Hello @molislaegers 

 

Me too, today i open a case with MS , i'm back when respond

 

We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE