How to Enable Live Response in Microsoft 365 Defender
Question details
The user needs to configure the required settings, device onboarding, and role permissions to use the Live Response feature on Intune-managed devices.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Setting up remote endpoint investigation using the Live Response feature for Intune-managed devices.
- Observed behavior
- The administrator must verify and configure advanced features, service integration, and role-based access control (RBAC) to activate Live Response capabilities.
Ensure you have global administrator or security administrator privileges in your Microsoft 365 tenant to access and modify endpoint advanced features.
Configure Settings and Permissions for Live Response
Follow these steps to activate the Live Response feature in your Defender portal, verify Intune integration, and assign proper roles.
Live Response requires explicit activation within the Defender advanced features menu. Additionally, it relies on successful device onboarding and proper RBAC configurations to ensure secure remote access to endpoints.
Log in to the Microsoft 365 Defender portal. In the left navigation pane, select 'Settings', click on 'Endpoints', and then choose 'Advanced features'.
Scroll through the list to find the 'Live Response' toggle. Switch it to the 'On' position and save your changes at the bottom of the page.
Ensure that the Intune-managed devices are properly onboarded to Microsoft Defender for Endpoint by checking the device inventory list.
Verify that the connection between Microsoft Defender for Endpoint and Microsoft Intune is active so policies and device statuses sync correctly.
Navigate to the 'Roles' section under 'Endpoints' settings. Edit or create a role to include the specific 'Live Response' permissions (Basic or Advanced) and assign it to the respective security administrators.
Manage Your Security Documentation with WPS Office
While configuring complex endpoint settings in Microsoft 365 Defender, you can rely on WPS Office to draft, manage, and share your organization's IT security policies. It offers a powerful, seamless experience for handling reports and compliance documentation.
- 1. Download and Install: Visit the official WPS website to download the free WPS Office suite and complete the quick installation process.
- 2. Open Existing IT Documents: Open your existing Microsoft Office security policies and audit reports directly in WPS Office without losing any formatting.
- 3. Edit and Collaborate: Use built-in editing, commenting, and sharing tools to collaborate with your security team on incident response protocols.
Frequently Asked Questions
What roles are required to initiate a Live Response session?
To initiate a Live Response session, you must be assigned a role in Microsoft Defender for Endpoint that explicitly grants 'Advanced Live Response' or 'Basic Live Response' permissions.
Why is the Live Response button greyed out on my device page?
This usually occurs if the device is not fully onboarded to Microsoft Defender for Endpoint, if the Live Response feature is disabled in the tenant's Advanced features settings, or if your user account lacks the required RBAC permissions.
Are there additional settings for Live Response on Windows Servers?
Yes. In the Microsoft 365 Defender Advanced features settings, there is a separate toggle named 'Live Response for Servers' that must be enabled to run sessions on server operating systems.
