configure windows defender with microsoft intune

#Configure windows defender with microsoft intune windows 10

Disable Trust Bar Notification for unsigned application add-ins and block them.You can configure macro security centrally through or through Endpoint Manager > Apps > Policies for Office apps here:.It allows Defender for Endpoint to take actions based on post-breach behavioral EDR detections.” EDR in block mode provides another layer of defense with Microsoft Defender for Endpoint. “We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. While that is the primary use case for EDR Block mode, Microsoft’s documentation recommends enabling this feature even when Defender is in Active mode. Originally, it was assumed this feature was only applicable when Defender was in passive mode behind another AV client.Block users from ignoring SmartScreen Warnings: Yes.Leave App locker application control unconfigured (unless you know what you are doing).Endpoint Security > Attack Surface Reduction > Create Policy > Application Control.You can prevent users from disabling SmartScreen using Endpoint Managerīefore doing this, have a phased rollout starting with a test group and then a broader pilot group for at least 90 days before going into production.“Windows Defender Browser Protection” is available as an add-in to Chrome ( here).Already Built-in to Microsoft Edge (and Chromium-Edge).In Intune, navigate to Device configuration – Profiles > Profile name > Endpoint Protection > Microsoft Defender Exploit Guard > Network Filtering > Network Protection.Network Protection can be enabled without MDE, but the benefit of using MDE is the centralized reporting, otherwise the audits would be decentralized in the local event viewer.

#Configure windows defender with microsoft intune windows 10

Network Protection is branded as part of “Microsoft Defender Exploit Guard” which is a series of Windows 10 security features including Controlled Folder Access, Exploit Protection, and ASR rules.

Network protection expands the scope of Windows Defender SmartScreen to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname).

The Microsoft Blog series “ Demystifying ASR rules” is a great read.

ASR rules can be configured using: Microsoft Endpoint Manager (MEM), PowerShell, Group Policy, Microsoft System Center Configuration Manager (SCCM), and MEM OMA-URI.

In General, all rules should be enabled in Audit mode for 30 days so that you can assess the impact before turning them on in production, and then exclude files/paths that are not compatible.

scr to determine if they are in an allow-list that MSFT maintains.

The ASR Rule “Executables that don’t meet a prevalence, age, or trusted list criteria” examines.

Read the ASR documentation page to identify important caveats before enabling ASR.

Some of the ASR rules require cloud-delivered protection to be enabled.ASR Rules are branded as part of “Microsoft Defender Exploit Guard” which is a series of Windows 10 security features including Controlled Folder Access, Exploit Protection, and Network Protection.ASR rules can be enabled without MDE, but the benefit of using MDE is the centralized reporting, otherwise the audits would be decentralized in the local event viewer.The E5 version adds unique rules that are not available in the E3 version. ASR Rules are a feature of Windows 10 E3 and Windows 10 E5.Settings > Windows Defender Security Center > Tamper ProtectionĮnable Attack Surface Reduction Rules (ASR).Create a profile that includes the following settings:.a) Using Endpoint Security > Antivirus > Windows Security Experience > TamperProtection (Device).However, now that option #1 above includes troubleshooting mode, the only reason you would use option 2 is if you had devices you never wanted Tamper protection enabled on (why would you do that anyway?!).

This was previously the only way to control Tamper Protection on a per device/group basis. 2) Inside Endpoint Manager (aka Intune, at ).You can also enable Troubleshooting Mode (see docs here) if you need to temporarily disable AV on some devices. 1) Globally inside Defender for Endpoint’s advanced feature settings ( here).This advanced feature requires Windows 1903 or higher. Otherwise the attacker could use several methods of disabling AV. The benefit of requiring Intune is that it abstracts the ability to disable antivirus to a separate management stack. This is a Microsoft Defender feature that does not require Windows 10 E5, but if you have E5 then you can leverage Intune to prevent the user from disabling this feature.

Why? The first step in many APT attacks is to use a ‘Dropper’ to disable Antivirus or other security settings via the registry, PowerShell, GPO, etc.