Endpoint Security: Antivirus, Firewall & Encryption
The three pillars of endpoint security through Intune: antivirus policies for threat protection, firewall policies for network defense, and disk encryption for data at rest.
The three pillars of endpoint security
Think of endpoint security like protecting a house.
- Antivirus = the alarm system — detects and removes intruders (malware) that get inside
- Firewall = the locked doors and windows — controls what comes in and goes out of the network
- Disk encryption = a safe for your valuables — if someone steals the laptop, they can’t read the hard drive
All three are configured and enforced through Intune’s Endpoint Security node — Chen Wei at Meridian Bank manages all 10,000 devices from one dashboard.
Antivirus policies
What you configure
| Setting | Options | Chen Wei’s Choice |
|---|---|---|
| Real-time protection | On/Off | On (always) |
| Cloud-delivered protection | On/Off | On — uses Microsoft’s cloud intelligence |
| Cloud protection level | Not configured / High / High+ / Zero tolerance | High+ (banking requires aggressive detection) |
| Scan type | Quick / Full | Quick scan daily, Full scan weekly |
| Scheduled scan | Time and frequency | Daily at 12:00 PM (lunch break) |
| Exclusions | File/folder/process/extension | Exclude banking app data folder (performance) |
| PUA detection | On/Off | On — block potentially unwanted applications |
| Tamper protection | On/Off | On — prevent users from disabling Defender |
Where to create antivirus policies
Intune admin center → Endpoint security → Antivirus → Create policy
| Platform | Profile Types |
|---|---|
| Windows | Microsoft Defender Antivirus, Microsoft Defender Antivirus Exclusions, Windows Security Experience |
| macOS | Microsoft Defender Antivirus (requires Defender for Endpoint on Mac) |
| Linux | Microsoft Defender Antivirus (requires Defender for Endpoint on Linux) |
Exam tip: tamper protection
Tamper protection prevents users and malware from disabling Microsoft Defender Antivirus settings. When enabled:
- Users can’t turn off real-time protection
- Malware can’t disable Defender via registry changes
- Third-party security tools can’t override Defender settings
The exam may describe a scenario where Defender keeps getting disabled — the answer is enable tamper protection. It’s managed through the Microsoft Defender portal (security.microsoft.com), not just Intune.
Firewall policies
Windows Defender Firewall via Intune
| Setting | Options | Purpose |
|---|---|---|
| Domain profile | On/Off + rules | Applies when connected to corporate network |
| Private profile | On/Off + rules | Applies on home/trusted networks |
| Public profile | On/Off + rules | Applies on public Wi-Fi (most restrictive) |
| Block inbound connections | Yes/No per profile | Block unsolicited incoming traffic |
| Firewall rules | Allow/Block specific ports, protocols, apps | Custom rules for LOB apps, remote management |
Firewall rule configuration
| Rule Setting | Example |
|---|---|
| Name | Allow banking app port 8443 |
| Direction | Inbound |
| Action | Allow |
| Protocol | TCP |
| Local port | 8443 |
| Remote address | 10.0.0.0/8 (corporate network only) |
| Application | C:\Program Files\BankApp\bank.exe |
App Control for Business: decide what may run
Antivirus checks for threats. App Control for Business controls which applications are trusted to run. In Intune, create the policy under Endpoint security > App Control for Business, configure its trust rules, and assign it to a Windows pilot-device group.
Start in audit mode when validating a new allow policy. Audit records what enforcement would block without stopping those applications. Review the results, test business-critical apps, adjust the trust rules, then move the validated policy to enforcement. Enforcement can prevent an otherwise legitimate application from starting if it is not allowed.
A managed installer is optional. When the Intune management extension is configured as a managed installer, it tags apps it subsequently installs as trusted, which an appropriately configured App Control policy can recognise. That does not automatically tag every app that was already installed, and installing software is not the same as creating an execution policy.
A bank wants to allow only trusted applications but cannot risk immediately blocking its existing payroll app. What is the safest first deployment?
Source: App Control for Business policies and managed installers.
Disk encryption policies
BitLocker (Windows)
| Setting | Options | Chen Wei’s Choice |
|---|---|---|
| Require encryption | Yes/No | Yes — all corporate devices |
| Encryption method | XTS-AES 128, XTS-AES 256 | XTS-AES 256 (banking standard) |
| OS drive encryption | Required | Required |
| Fixed drive encryption | Required / Not required | Required |
| Recovery key escrow | Save to Entra ID | Yes — recovery keys stored in Entra |
| Startup authentication | TPM only, TPM + PIN, TPM + key | TPM only (seamless for users) |
| Silent encryption | Yes/No | Yes — encrypt without user interaction |
FileVault (macOS)
For macOS devices, disk encryption uses FileVault (covered in Module 13). Intune manages FileVault through endpoint security or device configuration profiles.
Deep dive: BitLocker recovery key management
When BitLocker encrypts a drive, a recovery key is generated. This 48-digit key unlocks the drive if the normal unlock method fails (TPM issue, forgotten PIN, motherboard replacement).
Intune workflow:
- BitLocker encrypts the drive → recovery key generated
- Key is automatically escrowed to Entra ID (attached to the device object)
- Helpdesk views the key in Intune admin center → Devices → select device → Recovery keys
- After use, the key should be rotated (see Module 17)
Exam tip: If a user gets a BitLocker recovery prompt after a hardware change, the helpdesk retrieves the key from Entra ID/Intune — not from a file on the device or a USB drive.
🎬 Video walkthrough
Flashcards
Knowledge Check
Chen Wei discovers that a malware strain at another bank disabled Microsoft Defender before executing its payload. How can he prevent this at Meridian Bank?
A user's laptop at Meridian Bank has a motherboard replacement and now shows a BitLocker recovery screen on boot. How should the helpdesk retrieve the recovery key?
Next up: Attack Surface Reduction & Security Baselines — hardening devices with ASR rules and Microsoft-recommended security configurations.