Skip to main content

160: MDM based policies for firewall

Implementation Effort: Medium
User Impact: Low to Medium

Overview​

Windows Firewall settings in Microsoft Intune help control inbound and outbound network traffic on managed devices. In a Zero Trust model, host firewall policy is a core control because devices should defend themselves even when they are off the corporate network or on untrusted Wi-Fi.

Firewall guidance should distinguish between baseline hardening, exception handling, logging, and application-specific rules so that admins do not create broad allow rules that undermine segmentation and endpoint protection.

Implementation Guidance​

Design the firewall standard​

  • Keep the Windows Firewall enabled for all network profiles unless a documented technical exception exists.
  • Define whether outbound traffic should remain broadly allowed or whether high-risk device groups require more restrictive outbound controls.
  • Identify applications or management services that require inbound exceptions and confirm the narrowest possible ports, protocols, and scopes.

Configure policy in Intune​

  • Use Endpoint security > Firewall for Windows devices in the Microsoft Intune admin center, or use the settings catalog only when a specific setting is not exposed in the main profile.
  • Separate broad platform settings from exception rules so that emergency changes do not require editing the full baseline policy.
  • Enable firewall logging where appropriate so incident responders can review dropped connections and rule behavior.

Validate and maintain​

  • Pilot on representative devices first, especially for devices that use VPN, custom line-of-business apps, or remote management tools.
  • Review conflicts with Defender security baselines, legacy Group Policy, or other management channels before expanding scope.
  • Establish a periodic review process for stale allow rules and temporary troubleshooting exceptions.

Reference​