Microsoft

Microsoft Endpoint Configuration Manager Feedback

Suggestion box powered by UserVoice - Update: Microsoft will be moving away from UserVoice sites on a product-by-product basis throughout the 2021 calendar year. We will leverage 1st party solutions for customer feedback. Learn more

Ideas

What features would you like to see?

All of the feedback that you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Microsoft Endpoint Configuration Manager, though we canā€™t promise to reply to all posts.

Please do not use UserVoice to report product bugs or for assisted support.
If you believe you have found a product bug, please send us a bug report through the Configuration Manager Console (1806 and newer). To do this, press the šŸ™‚ button in the top right corner and choose ā€œSend a Frownā€. For more details, see https://docs.microsoft.com/en-us/sccm/core/understand/find-help.

If you require assisted support, please see https://aka.ms/cmcbsupport for more details.

Standard Disclaimer ā€“ our lawyers made us put this here ;-)
We have partnered with UserVoice, a third-party service, so you can give us feedback. Please note that the Microsoft Endpoint Configuration Manager feedback site is moderated and is a voluntary participation-based project. Please send only feature suggestions and ideas to improve Configuration Manager. Do not send any novel or patentable ideas, copyrighted materials, samples or demos. Your use of the portal and your submission is subject to the UserVoice Terms of Service & Privacy Policy, including the license terms.


  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Wildcards support for WDAC and Exploit Guard in SCCM

    When adding whitelist/exclusions for WDAC or Exploit Guard via SCCM wildcards are not accepted.
    This breaks functionality for remote support programs or conferencing programs such as LogMeIn Rescue or Zoom conferencing.

    29 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  2. Option to disable EP icon activity when scanning

    It would be great if there was an option to disable the icon showing there is an active scan in progress in taskbar on client computers. The icon should remain, but it should remain static, not to show when the scan is on progress. We have many users, complaining their computer is considerebly slower when EP is scanning, which is ofcourse not true, because the EP is set to only use 10-20% of cpu. Many of those complaint would be non existent, if the the icon would not show when EP is doing a scan :)

    28 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  3. 28 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    2 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  4. Endpoint Protection client for Mac - 64-bit app

    See Apple's support article HT208436 "32-bit app compatibility with macOS 10.13.4 High Sierra" at https://support.apple.com/en-us/HT208436.

    SCEP version 4.5.32.0 runs as a 32-bit app, so it warns users about compatibility, displaying error "SCEP is not optimized for your Mac. This app needs to be updated by its developer to improve compatibility."

    This error does not instill our supported users with much confidence about their security.

    28 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  5. SCEP: Option to randomize scheduled scan over a sliding time period, seperate from the random update start time control

    I would like to change the randomization for scheduled scans more than SCEP seems to allow. There seems to be an option in the Advanced 'tab' that is a simple yes/no setting to change enable 30 minute randomization of scans and update start times.

    for one I feel this is to short of a randomization time, and would like it to be configurable.

    secondly I think these two events should not be governed by the same control.

    On a Server farm for example using shared storage I would want my Servers running their scheduled scan across a longer time period,ā€¦

    25 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  6. Provide Support for BitLocker Management with IBCM

    Currently, internet-based clients are able to receive BitLocker Management Policies via IBCM but are unable to contact the Recovery Service. I have found that this is due to the MBAM Agent looking for the CurrentManagementPoint in WMI at ROOT\ccm:SMS_Authority.Name="SMS:<SiteCode>".

    It is possible to trickā€ the MBAM Agent into using the internet-based MP by adding the IBCM FQDN into the MP property at ROOT\ccm\LocationServices:SMS_MPInformation.MP="<IBCM FQDN>". This allows the agent to successfully find the Recovery Service MP and communicate!

    I am aware that there may be more to it than just facilitating this communication but wanted to at least share that achievingā€¦

    25 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    7 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  7. SCEP can configure scan history retention period (ScanPurgeItemsAfterDelay)

    Antimalware policy cannot configure ScanPurgeItemsAfterDelay in it.
    It would help all admins if we can set the value in the policy.
    QuarantinePurgeItemsAfterDelay can be set in the policy. So let's have ScanPurgeItemsAfterDelay configurable in order to achieve full control on antimalware history management.

    25 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  8. Update ConfigMgr SCEP Templates

    Request for the SCEP templates to be updated which would reflect the latest support articles Microsoft releases for recommended antivirus exclusions. If possible, concurrent updates would be ideal for any future ConfigMgr releases.

    "C:\Program Files (x86)\ConfigMgr\XmlStorage\EPTemplates&quot;
    "C:\Program Files (x86)\ConfigMgr\XmlStorage\EPTemplates\Archive"

    23 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  9. Windows Defender was performing 2 WMI queries through SCCM every minute

    Microsoft Case ID: [Case #:24522893] - TrackingID#120121125002133.

    While troubleshooting on the case we noticed that Windows Defender was performing 2 WMI queries through SCCM every minute, even when Defender was disabled on the system. These queries generate about 70.000 events (detected via procmon) related to the registry every minute.

    The cause of the query is ccmexec.exe
    The queries are (detected via procdump):
    select * from _instancecreationevent within 60 where targetinstance isa "win32service" and ( targetinstance.name="msmpsvc" or targetinstance.name="windefend")

    select * from _instancemodificationevent within 60 where targetinstance isa "win32service" and targetinstance.state="running" and ( targetinstance.name="msmpsvc" or targetinstance.name="windefend")

    Antivirus scans those actionsā€¦

    21 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    Noted  ·  0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  10. 20 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  11. Exploit Guard Controlled foder access

    Through SCCM, we are unable to add UNC paths in Controlled Folder Access settings when we click on Allow Apps through Controlled folder access setting. It only accepts local paths. Please add possibility to add UNC paths, because we have same business aplications that are blocked by controlled folder access.

    18 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    2 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  12. Allow for editing of client and scep policy priority

    The change priority option of policies is a very slow process when there a many policies in place or even when adding a new policy to get it to priority 1. It would be ideal if the editing of the policy order was allowed or a drag and drop approach to ordering the policies

    17 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  13. Endpoint- Add ability to submit false positive or new virus submission from console

    We have encountered quite a few false positives since converting to Endpoint via SCCM. So far the biggest problem has been submitting a false positive report to MS (one that will actually get listened to at least). We should have the ability from within the console to submit a file or report detailing a false positive and receive data on whether or not that file is rated as a threat with current virus definitions. If the Endpoint team is going to speak proudly of its low false positive rate, they should make it much easier for an Enterprise client toā€¦

    17 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    2 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  14. Windows Defender Advanced Threat Protection - Collect/Surface Log Data

    https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection

    The ConfigMgr client should collect event log troubleshooting data for Win Defender ATP. The data should be surfaced in the dashboard and be available for creating dynamic collections queries (so you can act on it). A security tool that doesn't clearly show you where it is/isn't working is very problematic.

    16 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  15. SCEP/Endpoint Protection logging

    I would like Endpoint Protection to do one of the following things:
    a. Log to file/winevent when infected - on the actual client
    b. Log to file/winevent when infected - on server

    For all the Companies using log analytics tools there are no good way to get the information. We use a custom sql-trigger to kick off a PowerShell script which writes an logentry to EventLog on the server. That is suboptimal to say at least.

    The dashboards for EP in ConfigMgr is not good enough and really ineffective when you have a lot of detections.

    16 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  16. Include Data Recovery Agent (DRA) control in SCCM Bitlocker Management feature

    Integration of DRA feature directly in SCCM Bitlocker Management feature to have all of Bitlocker controls centralized in one central point (no need extra GPO)

    15 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  17. Streamline Defender/Endpoint Protection settings

    Minor thing, but in Defender under Win10, excluded Files and Folders are separate, and Items in Antimalware policies, regardless weather File or Folder are shown in Defender/Win10 settings under Excluded Files. (the exclusion however still works so that is why it's a minor thing)

    15 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  18. Add Tamper Protection

    We need to be able to prevent admin users from disabling or uninstalling SCEP without a secondary form of authentication/protection.

    14 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  19. Windows Defender Offline Scan - Endpoint Protection Client Action, Schedule

    Integrate some management of Windows Defender Offline Scan. For a first iteration, add the ability to schedule an offline scan during next reboot to Fast Channel Notifications.

    On a future iteration, allow anti-malware policy to schedule an offline scan every X days on reboot.

    13 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    1 comment  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  20. Include the MBAM Administration Service in CM's BitLocker Management

    The one component from MBAM which has not so far been included in CM BitLocker Management is the Administration Service. This web service is used as the api entry point for 3rd party systems and custom automation activities for things like retrieving recovery keys.

    13 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinkingā€¦)
    0 comments  ·  Endpoint Protection  ·  Flag idea as inappropriateā€¦  ·  Admin →
  • Don't see your idea?

Feedback and Knowledge Base