Month 4: Raise the shields

The Endpoint security node

Endpoint security in the Intune admin center groups focused security policies: Antivirus, Disk encryption, Firewall, Endpoint detection and response, Attack surface reduction, Account protection, App Control for Business and Security baselines. Each policy holds only the settings for its job, which keeps security settings out of general configuration profiles.

Exam tip Same setting in a security policy and a configuration profile = conflict. Pick one home per setting.

Antivirus policies

Endpoint security > Antivirus for Windows has the Microsoft Defender Antivirus profile (real-time protection, cloud-delivered protection, sample submission, potentially unwanted apps, scan schedules, exclusions), Defender Update controls and Windows Security experience (what users see, plus tamper protection). macOS antivirus settings target Microsoft Defender for Endpoint on Mac. Reports show agent status and detected malware.

Exam tip Keep exclusions few and specific. Every excluded folder is a place malware can hide.

BitLocker and FileVault policies

Disk encryption profiles: BitLocker for Windows (require encryption, silent encryption for standard users, encryption methods, escrow the recovery key to Entra ID before encrypting, recovery password rotation) and FileVault for macOS (key escrowed to Intune). The Encryption report under Devices > Monitor shows encryption state and TPM readiness per device.

BitLocker - Windows
 Require device encryption     Enabled
 Allow standard user encryption Enabled
 Save recovery info to Entra ID Required
 Don't enable until key stored  Yes
 Recovery password rotation    Entra joined

Exam tip "Encrypt without bothering standard users" = silent encryption settings plus allow standard user encryption.

Recovery keys and self-service

Recovery keys escrowed to Entra ID appear on the device page (Recovery keys) in Intune and in Entra. Users can recover their own keys on another device through the Company Portal website or My Account (Devices > View BitLocker keys), unless the Entra setting restricting non-admin key recovery is turned on. Every key view is audited.

Exam tip Self-service recovery saves a help desk call at 7 a.m. Rotate the key after it's used.

Firewall policies

Endpoint security > Firewall: the Windows Firewall profile turns the firewall on per network profile (domain, private, public) and sets default inbound and outbound behavior. Windows Firewall rules profiles add allow or block rules by app, port, protocol and remote address. macOS firewall settings are separate. Reusable settings groups hold IP ranges you use in many rules.

Exam tip Typical baseline: firewall on for all profiles, default inbound Block, then allow only what the store apps need.

Attack surface reduction rules

ASR rules block common attack behaviors: Office apps creating child processes, executable content from email, credential stealing from LSASS, obfuscated scripts, untrusted USB processes and more. Each rule is Block, Audit, Warn or Off. Start in Audit, review what would have been blocked, add precise exclusions, then switch to Block. ASR rules need Microsoft Defender Antivirus as the active antivirus.

Exam tip "See what a rule would block without breaking anything" = Audit mode.

Zero Trust thinking for endpoints

Zero Trust means verify explicitly, use least privilege, and assume breach. For endpoints: check device health before access (compliance plus Conditional Access), run users as standard users (EPM, LAPS), and shrink what an attacker can do after getting in (ASR rules, App Control, firewall). Then watch with EDR.

Dev: Assume someone is already inside. Then make every door after the first one locked.

Security baselines

Security baselines are Microsoft's preconfigured groups of recommended settings: Windows security baseline, Microsoft Defender for Endpoint baseline, Microsoft Edge, Microsoft 365 Apps and Windows 365. Deploy to a pilot group first, compare with existing policies to avoid conflicts, then widen. Baselines have versions: when a new one ships, update your profiles to it.

Exam tip Changing a single baseline setting is fine. Document why, because the baseline is your audit's reference point.

Connecting Intune and Defender

Connect the services both ways: in the Microsoft Defender portal (Settings > Endpoints > Advanced features), turn on the Microsoft Intune connection. In Intune, Endpoint security > Microsoft Defender for Endpoint, turn on the connection for Windows devices. Then compliance policies can use Require the device to be at or under the machine risk score (Clear, Low, Medium, High).

Exam tip Risk score in a compliance policy + Conditional Access requiring compliance = a compromised device loses access to company data automatically.

Onboarding devices with an EDR policy

Create Endpoint security > Endpoint detection and response with the Defender for Endpoint client configuration package set to Auto from connector. Intune then pulls the onboarding package from Defender for you. Assign it to all Windows devices, and check the EDR onboarding status report until every device shows onboarded.

Exam tip Onboarding question on the exam: EDR policy with Auto from connector beats scripts and manual packages for Intune-managed devices.

Investigating and triaging

Alerts and incidents live in the Microsoft Defender portal. Triage: check severity, assign the incident, look at the device timeline and alert story, then respond: isolate device, run an antivirus scan, collect an investigation package, or restrict app execution. Classify the incident when done. Defender's vulnerability findings can become security tasks in Intune for admins to fix.

Exam tip Isolating keeps the device connected to Defender so you can still investigate, but cuts it off from everything else.

App Control for Business

App Control for Business (formerly Windows Defender Application Control) lets only trusted code run. In Endpoint security > App Control for Business, use built-in controls: trust Windows components and Store apps, optionally apps with good reputation, and apps from a managed installer (the Intune Management Extension can be set as one). Or upload your own XML policy. Start in audit mode.

Exam tip Managed installer = anything Intune installed is trusted automatically, so you don't list every app by hand.