Device Endpoint Protection settings configuration in Microsoft Intune

Introduction

In the dynamic landscape of modern enterprise and personal computing, the management and security of devices have become paramount. As organizations and individuals navigate an ever-expanding digital terrain, the need for robust, centralized control over device configurations, security settings, and compliance adherence has led to the emergence of sophisticated solutions. Microsoft Intune, a cloud-based device management service, stands at the forefront of this evolution, offering a comprehensive suite of features to streamline device management, enhance security, and ensure compliance within the Microsoft ecosystem.

In Microsoft Intune, configuration profiles are a key component of device management that allows administrators to define and deploy settings to devices. Configuration profiles help ensure that devices comply with organizational policies and security standards.

Within a configuration profile, we can specify endpoint security settings for devices. These settings may include antivirus configurations, firewall rules, BitLocker encryption settings, and more, depending on the platform (Windows, macOS, iOS, Android) and the available settings in Intune.

Prerequisites

• Microsoft 365 Business Premium
• Microsoft 365 Enterprise E3 and E5
• Enterprise Mobility + Security (EMS) E3 and E5
• Intune for Education
• Intune standalone license

Method

Step 1. Log into 365 Admin Center Endpoint Manager with an Administrator account.

Step 2. Direct to Devices & Configuration Profiles

Step 3. Click Create Profile

Step 4. First, Select a platform. Here I’m going to deploy device restrictions to all the devices with Windows 10 and later.

Step 5. Select profile type as Templates and Select Endpoint Protection

Step 6. Give a proper name to identify the policy later

Step 7. Create profile Settings according to company policy

Microsoft Defender Application Guard

Microsoft Defender Application Guard (WDAG) is a security feature in Windows 10 that uses virtualization technology to create isolated environments for web browsing and opening untrusted documents. It helps protect the system by containing potential threats within these isolated containers, preventing them from affecting the main operating system. WDAG is often used in enterprise settings and is integrated into Windows 10 Enterprise and Windows 10 Pro editions.

Can be enabled for Microsoft edge and adjust settings for copy and paste, print etc.

 

Windows Firewall

Windows firewall settings divided into two parts

1. Global Settings
2. Network Settings

Global Settings

Network Settings

Here we can add rules as for the organization preferences. We can Specify the local and remote addresses as well to apply rules

Further, we can add rule for ports.

Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a security feature designed to protect users from malicious websites and potentially harmful downloads. It is integrated into various Microsoft products, including the Windows operating system and the Microsoft Edge web browser.

Windows Encryption

Windows provides two primary encryption features:

BitLocker

Full disk encryption for Windows Pro and Enterprise editions.

Uses Trusted Platform Module (TPM) for added security.

BitLocker To Go extends protection to removable devices.

Encrypting File System (EFS)

File-level encryption on NTFS drives.

Tied to user login credentials for individual files and folders.

Integrated into the Windows user interface for easy management.

These encryption tools help safeguard data by encrypting either the entire disk (BitLocker) or specific files and folders (EFS) on Windows devices.

BitLocker OS drive Settings

Microsoft Defender Exploit Guard

Microsoft Defender Exploit Guard is a set of security features that helps protect Windows 10 systems against various types of exploits, attacks, and advanced threats. It includes multiple components designed to enhance the overall security posture of the operating system. Here's a brief overview of key features within Microsoft Defender Exploit Guard:

Attack Surface Reduction (ASR)

ASR helps minimize the attack surface by controlling how certain processes and behaviors interact with the system. It includes rules to block or control specific behaviors that are commonly exploited by malware, such as executable content in email and scripts from the web.

Controlled Folder Access

This feature protects sensitive data by allowing users to specify which folders should be protected against unauthorized access and modification. Controlled Folder Access prevents unauthorized applications from making changes to files within protected folders.

Network Filtering

Network Filtering helps prevent users and applications from connecting to malicious domains known for hosting exploits, malware, and phishing scams.

It uses Windows Defender SmartScreen to check the reputation of websites and block access to potentially harmful sites.

Exploit Protection

Exploit Protection is a set of system-level mitigations designed to protect against common exploit techniques.

It includes features such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) to help thwart exploit attempts.

Note : To enable exploit protection need to create an XML file representing the system and application mitigation settings of any choice. This can done using one of two methods PowerShell or Microsoft Defender Security Center UI.

Microsoft Defender Application Control

Microsoft Defender Application Control enhances Windows security by controlling which applications can run on a device. Key features include enforcing code integrity policies, enterprise-wide control, leveraging hardware-based security, protecting against code injection, and integration with other Microsoft Defender technologies. It provides a robust defense against malware and unauthorized code execution, making it suitable for environments with high-security requirements.

Microsoft Defender Credential Guard

Microsoft Defender Credential Guard enhances Windows security by isolating and safeguarding authentication credentials using hardware virtualization. It protects against pass-the-hash attacks, securely manages credentials in an isolated environment, and integrates with other Windows security features. Primarily deployed in enterprise settings, Credential Guard is available in Windows 10 Enterprise and Windows Server editions.

Microsoft Defender Security Center

Microsoft Defender Security Center, now part of Microsoft 365 Defender, is a unified security hub providing a centralized dashboard for managing and monitoring security across Microsoft 365 services. It includes threat intelligence, endpoint protection, cloud security, incident response tools, and advanced threat analytics for a comprehensive security posture. Keep in mind that Microsoft's products may undergo updates, and it's advisable to check the latest information from official sources.

Also we can add IT contact information.

Local device security options

Local device security involves implementing measures on an individual device to protect it from various threats. Most companies give priority for this option. In here there are many categories of device securities to be added.

For example, In Accounts, we can block adding new Microsoft accounts and as well as guest accounts.

Step 8. In assignments, select user or device groups to deploy the policy.

Under Included Groups or Excluded Groups, choose Add Groups to select one or more Azure AD groups. If you intend to deploy the policy broadly to all applicable devices, select Add all users or Add all devices.

Step 9. You can apply some specific rules to your given group or user (Optional)

Step 10. Click Review + Create to review your settings. When you select Create, your changes are saved, and the profile is assigned.

Note: Created profiles are shown under Profiles in Configuration profiles. You can edit settings in each profile by clicking each and deploying changed policies.