Skip to content

Endpoint security

The Endpoint security node in the Intune admin center gathers the policies security teams care about: antivirus, firewall, disk encryption, attack surface reduction, endpoint detection and response, account protection and privilege management. It's also where you connect Intune to Microsoft Defender for Endpoint.

Connect Intune and Defender for Endpoint

Intune and Microsoft Defender for Endpoint work best together: Intune onboards and configures Defender, and Defender feeds device risk back into compliance.

  1. Turn on the connection on both sides. In the Defender portal, go to Settings > Endpoints > Advanced features and turn on Microsoft Intune connection. In Intune, go to Endpoint security > Microsoft Defender for Endpoint and turn on the connection for each platform you use (Windows, macOS, iOS, Android).
  2. Onboard devices with an Endpoint detection and response policy. For Windows, set the client configuration package type to Auto from connector so Intune fetches the onboarding package for you.
  3. Use device risk in compliance. Add Require the device to be at or under the machine risk score to your compliance policies (for example Medium). A compromised device then becomes noncompliant and Conditional Access cuts its access.
  4. Cover mobile devices. Defender for Endpoint on iOS and Android acts as a mobile threat defense app, adding phishing protection and jailbreak or root detection, and can feed risk into compliance and app protection.

Security settings management

Defender for Endpoint can also apply Intune endpoint security policies to devices that aren't enrolled in Intune, such as servers. These devices appear in Intune as managed by Defender for Endpoint, and you target them with the same antivirus, firewall, EDR and ASR policies.

Policy types under Endpoint security

Policy What to configure Recommendations
Antivirus Defender Antivirus settings, exclusions and the Windows Security experience Real-time protection, cloud-delivered protection, block at first sight, potentially unwanted app (PUA) blocking, and tamper protection on. Keep exclusions few and managed centrally.
Disk encryption BitLocker and FileVault See Disk encryption
Firewall Windows Firewall profiles and rules, macOS firewall Firewall on for all network profiles, inbound connections blocked by default. Decide whether local rules may merge with policy rules.
Endpoint detection and response Defender for Endpoint onboarding and sample sharing One EDR policy per platform, assigned broadly
App Control for Business Which apps may run on Windows (formerly WDAC) Start in audit mode and make Intune a managed installer so apps you deploy are trusted automatically
Attack surface reduction ASR rules, device control, exploit protection, web protection Start ASR rules in audit, review the ASR report in the Defender portal, then switch to block rule by rule
Account protection Windows Hello for Business, Credential Guard, LAPS, local group membership See Windows LAPS and Passwordless sign-in
Endpoint Privilege Management Elevation settings and rules See EPM

Attack surface reduction rules

ASR rules block behaviors that malware relies on, such as Office apps spawning child processes or processes reading credentials from LSASS. They're one of the most effective Windows hardening controls, and the most likely to break line-of-business apps.

A safe rollout:

  1. Deploy all rules in Audit mode to everyone.
  2. After two to four weeks, review audit events in the Defender portal's attack surface reduction report.
  3. Add narrow per-rule exclusions for legitimate apps that trigger a rule.
  4. Move rules to Block one at a time, starting with those that had no legitimate hits. Use Warn where users need the option to continue.
  5. Keep a small group in audit for each rule so you can spot new false positives.

Rules that most organizations can block early include blocking executable content from email and webmail, blocking credential stealing from LSASS, blocking abuse of exploited vulnerable signed drivers, and blocking persistence through WMI event subscription. Office macro and child process rules usually need more testing.

Device control

Use the Device control profile under attack surface reduction to control removable storage, printers and other peripherals. Common patterns are read-only USB storage for most users, and full access for a group with an approved encrypted USB model.

Avoid overlapping policies

Antivirus, firewall and ASR settings can be configured from endpoint security policies, security baselines and the settings catalog. If two sources set the same setting to different values, the setting doesn't apply. Decide which policy type owns each area. See Security baselines.

Learn more