14.2 Configuring Endpoint Settings

Configuring Endpoint Settings in Defender for Endpoint

Quick Answer: After onboarding, you configure endpoint behavior through two surfaces: the Defender portal's Settings → Endpoints → Advanced features page for tenant-wide toggles, and Intune endpoint security policies for per-group device configuration. The MS-102 exam expects you to know what each surface controls and to recognize tamper protection, ASR rules, controlled folder access, and web content filtering as the headline settings.

The Two Configuration Surfaces

Neither surface fully replaces the other. A typical enterprise uses the Defender portal for global on/off behavior and Intune for granular policy targeted at device groups.

---

Tamper Protection

Tamper protection is a critical security feature that prevents local admins, scripts, and other security products from disabling Microsoft Defender settings. When tamper protection is on, the following operations are blocked even for users with local administrator rights:

• Disabling real-time protection
• Turning off cloud-delivered protection
• Disabling Microsoft Defender Antivirus
• Removing antivirus signature updates
• Disabling behavioral monitoring

You manage tamper protection centrally. In the Defender portal go to Settings → Endpoints → Advanced features → Tamper protection and choose On (recommended). In Intune, the toggle lives in the endpoint security → Antivirus policy under Microsoft Defender Antivirus configuration. On Windows 10 1903 and later, tamper protection is on by default for consumer machines; enterprises should verify it is on in their policy baseline.

Tamper protection is the single most commonly tested Defender feature on the MS-102 exam because it directly addresses the social-engineering pattern where an attacker convinces a user to run a PowerShell snippet that turns Defender off.

---

Attack Surface Reduction (ASR) Rules

ASR rules are a curated set of behavior-based policies that block the techniques attackers use early in the kill chain: credential theft, lateral movement, Office macro shell execution, and obfuscated script launching. Microsoft publishes a documented set of rules; each rule has a GUID and three states.

ASR Rule States

Operational Workflow

1. Deploy in audit mode for at least 30 days across a representative device group.
2. Review audit events in Reports → Attack surface reduction and in advanced hunting (the DeviceEvents table, ActionType starting with Asr).
3. Flip to block group-by-group, monitoring helpdesk tickets for false positives.
4. Exclude specific paths or signers where a line-of-business app triggers a legitimate match.

Common ASR rules that produce false positives in enterprises include Block Office applications from creating child processes (breaks document-generated PDFs) and Block execution of potentially obfuscated scripts (breaks some packaged scripts). Test before you flip to block.

---

Controlled Folder Access

Controlled folder access is Defender's anti-ransomware feature. It blocks untrusted processes from writing to protected folders (Documents, Pictures, Favorites, and any custom paths you add). Trusted apps are determined by reputation and signer; you can also pre-allow apps via path or certificate.

Configure controlled folder access in Intune under endpoint security → Attack surface reduction → Controlled folder access, or via the Defender portal advanced features toggle. Like ASR, it supports audit, block, and warn modes. Audit first — controlled folder access can stop backup agents and line-of-business apps from writing to the Documents folder.

---

Web Content Filtering

Web content filtering blocks categories of websites (for example Adult, High bandwidth, Legal liability, Leisure) at the endpoint level. The protection is enforced by the network protection component of Defender, so it works even when the device is off the corporate network. You create a policy in the Defender portal under Settings → Endpoints → Web content filtering, choose categories, and assign it to device groups. Browser-agnostic — it inspects the network request, not the browser process.

---

Microsoft Defender Antivirus Exclusions and Updates

Defender Antivirus supports path, file extension, process, and file type exclusions. Configure exclusions via Intune endpoint security → Antivirus policy or via Group Policy. The MS-102-relevant best practice is to scope exclusions narrowly and review them quarterly — broad exclusions are a leading cause of missed detections.

Signature and platform updates come from Microsoft Update, the Microsoft Malware Protection Center (MMPC), or a UNC file share for air-gapped networks. Configure the update source and fallback order under endpoint security → Antivirus → Updates in Intune.

---

Cross-Platform Configuration

Defender for Endpoint is cross-platform, but the configuration surface differs by OS:

On macOS and Linux, antivirus exclusions use mdatp exclusion CLI or the configuration profile deployed through the MDM. ASR rules are Windows-only today.

---

Reporting: Device Inventory and Device Health

Two reports matter for ongoing operations:

• Device inventory (Assets → Devices) lists every onboarded and discovered device with onboarding state, risk level, and exposure level.
• Device health (Reports → General → Device health) shows sensor health, antivirus health, and OS update status. Filter by No sensor data, Impaired communication, or Impaired but no telemetry to find devices that are not reporting correctly.

Use these reports weekly. Devices that stop reporting are effectively blind spots in your detection coverage.