Zum Hauptinhalt springen

DEV-152 - Controlled Configuration for Defender Antivirus

Implementation Effort: Low – Single policy setting in Intune Endpoint Security Antivirus policies for Windows.

User Impact: Low – Transparent to end users; prevents local scripts, Group Policy, or third-party tools from weakening Defender Antivirus settings.

Overview​

Controlled Configuration for Microsoft Defender Antivirus (introduced in July 2026 / Service Release 2607) extends Microsoft Defender Tamper Protection by making the Defender Antivirus settings delivered by Microsoft Intune (or Microsoft Defender for Endpoint security settings management) authoritative on Windows endpoints.

When Controlled Configuration is enabled, Intune/MDE antivirus policies override and lock out conflicting configurations coming from other channels—such as local Group Policy Objects (GPOs), Configuration Manager, registry edits, or local scripts. This guarantees a consistent, predictable, and tamper-resistant antivirus posture across all managed Windows devices.

This supports Assume breach by preventing an attacker with local administrative privileges or legacy GPO access from weakening Defender Antivirus exclusions, real-time protection, or cloud-delivered protection settings.

Key Configuration Steps​

  1. Ensure Tamper Protection is enabled on Windows endpoints via Microsoft Defender XDR / Intune Endpoint Security.
  2. In the Microsoft Intune admin center, go to Endpoint security > Antivirus and create or edit a Microsoft Defender Antivirus policy for Windows.
  3. Enable Controlled Configuration in Audit or Enforcement mode after validating that no required legacy GPO or ConfigMgr AV overrides are needed.
  4. Monitor policy compliance and Defender status across your Windows device fleet.

Reference​