Configuring Defender Firewall and Antivirus via Intune Profiles
Answer
Correct answer: C, E — Create device configuration profiles using the Endpoint protection settings template to configure both Microsoft Defender Antivirus and Microsoft Defender Firewall.
You have an Azure AD tenant and 100 Windows 10 devices that are Azure AD joined and managed by using Microsoft Intune. You need to configure Microsoft Defender Firewall and Microsoft Defender Antivirus on the devices. The solution must minimize administrative effort. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Community Insight
The question tests knowledge of Intune endpoint security policy templates, specifically distinguishing between Endpoint protection settings (for Firewall) and Device restrictions or Endpoint protection (for Antivirus).
This guide explains how to configure Microsoft Defender Firewall and Antivirus on Azure AD joined devices using Microsoft Intune device configuration profiles. It clarifies the correct profile categories for each security component to minimize administrative effort.
Many learners incorrectly choose options involving Group Policy Objects (GPOs), which are not suitable for cloud-managed Azure AD joined devices managed solely by Intune.
Community Discussion (73 comments)
ThomasE
👍 1
Selected: DE
Firewall is DEFINITELY configured thru Endpoint Protection. However, I only see options to configure the firewall, think enabling on or off for the different profiles, in Device Restrictions. The Endpoint Protection template only seems to have settings to allow users to have access to the Virus and threat protection areas.
MaryndenOuden
👍 3
Selected: CE
The correct answers are C and E, because both Microsoft Defender Antivirus and Microsoft Defender Firewall are configured through Intune Endpoint Protection profiles, which provides the required settings while keeping administrative effort to a minimum.
bel88
👍 1
Selected: CE
Whenever you see Defender Antivirus, Firewall, or BitLocker, your first thought should be: Endpoint protection not Device restrictions
noa808a
👍 3
Selected: CE
Answer is outdated. As of June 2026 (and a little previously), both should be configured via Endpoint Protection.
HueCumber
👍 2
Selected: CE
On MD‑102, Defender Antivirus and Defender Firewall are configured using a device configuration profile with the Endpoint protection template.
a5f91f0
👍 3
Selected: CE
The answer is outdated, as the antivirus settings can now be configured in the endpoint secuity section
JoonL
👍 2
Selected: CE
Because the devices are managed by Intune, the most efficient and modern approach is to use Intune device configuration profiles, not Group Policy.Intune provides a built-in Endpoint protection profile specifically for Microsoft Defender Antivirus. The same Endpoint protection profile includes Defender Firewall settings
epyonkills
👍 3
Selected: CE
C and E
lmpcanada
👍 1
Selected: DE
D et E sont correcte
Le_Patriarche2025
👍 2
Selected: CE
C – Pour configurer Microsoft Defender Antivirus Créer un profil de configuration d’appareil et configurer les paramètres de protection du point de terminaison → C’est bien dans Endpoint Security → Antivirus dans Intune. C’est correct. ✔️ E – Pour configurer le pare‑feu Microsoft Defender Créer un profil de configuration d’appareil et configurer les paramètres de protection des terminaux → C’est bien dans Endpoint Security → Firewall dans Intune. C’est correct.
nkcodiac
👍 3
Selected: DE
Hello All According to this question Write answer is D and E but now Intune is updated so we can do both things from Endpoint Security
Naebun
👍 6
Selected: CE
The answer is outdated, as the antivirus settings can now be configured in the endpoint secuity section
jonker
👍 4
Selected: CE
both should be configure from Endpoint security node
Robert69
👍 5
Selected: CE
Since the devices are Azure AD joined and managed by Intune (not hybrid or on-premises AD joined), you should use Intune device configuration profiles to manage both Microsoft Defender Firewall and Antivirus settings. This minimizes administrative effort by managing everything centrally through Intune. Why these are correct: Option C - Defender Antivirus via Endpoint Protection Endpoint protection settings in Intune device configuration profiles include comprehensive Microsoft Defender Antivirus configuration options This is the native Intune method for configuring antivirus settings Minimizes administrative effort for cloud-managed devices Option E - Defender Firewall via Endpoint Protection Endpoint protection settings also include Microsoft Defender Firewall configuration options Allows you to configure firewall rules, notifications, and security settings Centrally managed through Intune for Azure AD joined devices
Mohamed555
👍 4
Selected: CE
Feature Intune profile category Correct answer? Microsoft Defender Antivirus Device configuration profile → Endpoint protection settings ✅ C Microsoft Defender Firewall Device configuration profile → Endpoint protection settings ✅ E
_Dinkan_
👍 1
Selected: DE
Tested in LAB
hvastija
👍 1
Selected: DE
Check on Intune device configuration profiles. The Answer is correct
henil_154762
👍 1
Selected: CE
Ans - C, E
theptr
👍 1
Selected: CE
C and E
PXAbstraction
👍 2
You are wrong. I'm looking at the portal right now and both are under Endpoint Protection.
PXAbstraction
👍 3
I am looking at the Intune portal right now and this is wrong. Firewall and Antivirus are absolutely under Endpoint Security.
CheMetto
👍 3
Selected: CE
From: https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-protection-configure With Intune, you can use device configuration profiles to manage common Endpoint protection security features on devices, including: Firewall BitLocker Allowing and blocking apps Microsoft Defender and encryption
Nko01
👍 3
Selected: CE
Firewall and antivirus are both under endpoint security menu in intune
cd2cfde
👍 1
This is absolutely wrong. Antivirus is not under endpoint security. It is under device restrictions.
Viddah
👍 4
Selected: CE
C and E are the correct answers MS recommandations are to managed into Endpoint protection section for advance security. it's the same situation like Bitlocker configuration.
cd2cfde
👍 1
What in the world are you talking about? Have you ever even used intune? Antivirus is not under endpoint security. It’s under device restrictions. Just log in and see if it is listed there. Smh
Knight_Of_Peace
👍 5
Selected: DE
Given answer is correct. Microsoft Defender Antivirus setup: Intune --> Devices --> Configuration --> Create new policy --> Windows 10 and later --> Template --> Device Restrictions --> Microsoft Defender Antivirus. Windows Firewall setup: Intune --> Devices --> Configuration --> Create new policy --> Windows 10 and later --> Template --> Endpoint protection --> Windows Firewall.
sorinaccio
👍 4
Selected: CE
C and E are the correct answers and this is why: Endpoint Protection Settings: These are specifically used for configuring security features like Microsoft Defender Antivirus, Microsoft Defender Firewall, and other advanced security settings. Why the other options are not correct? Device Restrictions Settings: While they do include some basic security options, they are more focused on restricting device features and user behavior. They do not provide the detailed configuration for antivirus or firewall settings that Endpoint protection does.
RJTW070
👍 3
Selected: CE
Since the Windows 10 devices are Azure AD joined and managed by Microsoft Intune, the best approach to configure Microsoft Defender Antivirus and Microsoft Defender Firewall while minimizing administrative effort is using Intune Device Configuration Profiles. Microsoft Defender Antivirus Configuration: In Intune, Endpoint protection settings under Device configuration profiles allow you to manage Defender Antivirus policies. This setting enables real-time protection, cloud-delivered protection, automatic sample submission, exclusions, and Defender updates. This matches option C. Microsoft Defender Firewall Configuration: The Microsoft Defender Firewall settings are also configured within Endpoint protection settings in an Intune Device configuration profile. This allows for enforcing firewall rules, inbound/outbound protection, and controlling network traffic centrally via Intune. This matches option E.
br99mlpt
👍 2
Selected: DE
checked on the portal. DE is true
Jz23
👍 1
Selected: CE
The correct answers are: ✅ C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. ✅ E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings. Explanation: Since the Windows 10 devices are Azure AD joined and managed by Microsoft Intune, the correct way to configure Microsoft Defender Antivirus and Microsoft Defender Firewall is through Intune policies, not Group Policy Objects (GPOs). C. Microsoft Defender Antivirus: In Microsoft Intune, you need to create a Device Configuration Profile using the Endpoint protection template to configure Microsoft Defender Antivirus settings. E. Microsoft Defender Firewall: Similarly, to configure Defender Firewall, you must use an Endpoint protection profile in Intune.
MSRock123
👍 1
Selected: CE
Answer is CE. Go into Intune. Devices>Windows>Configuration>Create>Windows 10 and later>Templates>Endpoint Protection The information button for Endpoint protection says: "With Intune, you can use device configuration profiles to manage common endpoint protection security features on Windows devices, including Firewall, BitLocker, Microsoft Defender and encryption." Also doublechecked with Copilot, answer is CE.
hieunm2411
👍 1
Selected: DE
D and E are the correct answers.
OHMSS
👍 2
Selected: CD
Both in Endpoint security https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-policy
RJTW070
👍 2
Selected: CE
Explanation: Since the devices are Azure AD joined and managed by Microsoft Intune, the configurations for both Microsoft Defender Firewall and Microsoft Defender Antivirus should be done through Intune's Endpoint protection settings, as they provide the necessary controls for these security features. C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings: Intune's Endpoint protection settings include configurations for Microsoft Defender Antivirus, such as enabling real-time protection, configuring scan schedules, and setting exclusions. E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings: Microsoft Defender Firewall settings, such as enabling the firewall, configuring rules, and network security, are also part of the Endpoint protection settings in Intune.
Tr619899
👍 2
CE is the Answer
SSL2
👍 1
Selected: CE
The correct actions are: C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings. These two options minimize administrative effort by using Microsoft Intune to centrally manage both Microsoft Defender Antivirus and Microsoft Defender Firewall. The Endpoint protection settings in a device configuration profile allow you to configure both firewall and antivirus settings for Intune-managed devices, streamlining the process and avoiding the need for Group Policy Objects (GPOs).
subbuhotmail
👍 2
Selected: DE
Yes, FOR AV - Device Restriction and AV For FW - Endpoint Protection - FW
clucks
👍 3
Selected: DE
Just open up intune and you can see for yourself. Endpoint Protection contains the Firewall configuration. Device restrictions contains MS Antivirus configuration.
Pollosor
👍 2
That's correct, I had forgotten.
veliyath
👍 3
Selected: DE
D. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Device restrictions settings. Configure Microsoft Defender Antivirus using Device restrictions in Intune E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings. Configure Microsoft Defender Firewall rules using Endpoint protection in Intune These selections ensure that the configurations for both Microsoft Defender Antivirus and Microsoft Defender Firewall are managed through Intune, aligning with the goal of minimizing administrative effort.
oopspruu
👍 3
Selected: DE
D&E are correct options. Tested in lab 2024/07
kiik32
👍 1
Selected: CE
C and E you can configure both from the endpoint protection template
kiik32
👍 1
actually from enpoint protection you enable the antivirus rather than configuring, so for that you will need a device restrictions template.
nicholaswildern
👍 2
Perplexity AI To configure Microsoft Defender Firewall and Microsoft Defender Antivirus on your Azure AD-joined Windows 10 devices managed by Microsoft Intune, and to minimize administrative effort, you should perform the following actions: To configure Microsoft Defender Antivirus: Create a device configuration profile and configure the Endpoint protection settings. This allows you to manage antivirus policies directly through Intune, which is streamlined for managing multiple devices in an enterprise environment. To configure Microsoft Defender Firewall: Create a device configuration profile and configure the Endpoint protection settings. This approach also leverages Intune's capabilities to manage firewall settings across all devices efficiently. Therefore, the correct answers are: C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings.
keshav80
👍 1
DE is 100% right. I have verified. Be relaxed.
Bhuru
👍 1
Selected: BC
BC is the answer Microsoft defender firewall is managed in device restrictions and AV in endpoint protection...the way you guys get lost is disturbing
Sssssg
👍 1
Answer is DE
MR_Eliot
👍 2
Selected: CE
Answers are C & E. You can manage both with endpoint security configuration profile. I have confirmed this in my own tenant. Device Restriction is more about what length of password users should have etc.
Anonymouse1312
👍 1
Selected: CE
Dumb question. C is also correct it seems: "Antivirus policies include the same settings as found endpoint protection or device restriction templates for device configuration policy. However, those policy types include additional categories of settings that are unrelated to Antivirus. ----->>>>> The additional settings can complicate the task of configuring Antivirus workload" https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-antivirus-policy correct me if im wrong, but fail to see how
Krayzr
👍 1
Selected: DE
AGREE WITH DE
proservices
👍 1
Selected: DE
D & E - Just checked in the Lab
ThePrutser
👍 1
Selected: DE
Went through the intune admin center: - Firewall config is done via Endpoint Protection - Antivirus config is done via Device restrictions
Tati_Oliveira
👍 1
O Antivirus é configurado dentro de Device Restrictions e não dentro de Endpoint Protection. Dentro de Endpoint Protection é possível configurar: Application Guard Firewall Defender Smart Screen Windows Encryption Defender Exploit Guard Defender Application Control Defender Credential Guard Defender Security Center Local device security Options XBox Services
NoursBear
👍 1
that's what I thought about this, you can only know which topics you did well on but no way can you tell based on a question
b0gdan433
👍 1
Correct answer is DE, took the exam today and the 2 points for this.
iTomi
👍 1
Good for you, but MS/Pearson does'n reveal right answers after test. Or did you get 900 points? Doubting that...
Tr1v
👍 1
Selected: DE
Deinth is right: D: MS Defender AV = Device Restriction E: Firewall = Endoint Protection
chandravamsi
👍 1
Selected: BE
Option B, E
Rocky83
👍 3
Selected: CE
If you think about admin effort ... CE makes sense
pinda
👍 2
Selected: BC
B. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Device restrictions settings. This will allow you to configure firewall settings via Intune, ensuring consistency across your devices. C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. This will allow you to configure antivirus settings and policies via Intune, making it easy to manage across your devices.
BJS78
👍 1
Weird question. Antivirus can be configured inside: Device configuration / Admin templates/Endpoint protection, Device configuration /Admin templates/ Custom (OMA-URI) / Endpoint Security / Antivirus as well. Firewall can be configured via Device configuration /Admin templates/ Custom (OMA-URI) and Endpoint Security / Firewall. So for "minimize administrative effort" could be the key. For me, it would be configure both on Endpoint Security. (Worth to mention is that the best way for Antivirus would be Settings Catalog as there you can have LOT others, like Security Center settings under one config)
BJS78
👍 1
Admin templates --> Templates
NoursBear
👍 1
For me it's B and E. When I go to my Intune and create a Policy, go to Device Restrictions I have all the settings for Defender AV. To configure the Firewall (Firewall and rules) I go to Intune select Endpoint Security, Firewall and there create a profile. The problem things keep moving so god knows how old this question is
NoursBear
👍 3
arghhh sorry D and E
Futfuyfyjfj
👍 3
Checked this in Intune and DE is the only correct aswer!
deinth
👍 38
Selected: DE
for firewall E: https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune for antiviurs D: https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus
SalonaSahni
👍 11
DE is the Answer D:Microsoft Defender Antivirus: Device config-Device Restrictions- It has 28-34 settings for Antivrus. E: Microsoft Defender Firewall- Device config- Endpoint Protection (Global settings, netwok settings, Firewall rules) I have cross checked the lab. THe Endpoint Protection does not have the option for MS Defender Antivirus.
JP1900
👍 3
Selected: DE
D - MS Defender Antivirus is under Device Restriction settings E - Defender Firewall is under Endpoint Protection settings Both are under Devices, then Configuration profiles, then select Templates from the dropdown.
letters1234
👍 4
Selected: CE
Antivirus and Firewall can be configured on Endpoint Protection, Firewall can't be configured on Device Restrictions. Configuring the two requirements on the one Endpoint Protection profile reduces administrative overhead. Having the extended options of Antivirus on a Device Restriction profile also increases overhead, more to configure/understand before implementation.
letters1234
👍 1
Didn't look at the lab close enough, the AV configuration in Endpoint Protection is just blocking end user access to AV section in Defender Security Centre on the device. Minasamy is right.
minasamy
👍 7
Selected: BC
B and C are the correct answers : B. Creating a device configuration profile and configuring the Device restrictions settings allows you to manage the Microsoft Defender Firewall settings on your Azure AD joined Windows 10 devices through Microsoft Intune. This profile can help you configure and manage firewall rules and settings without the need for traditional Group Policy. C. Creating a device configuration profile and configuring the Endpoint protection settings allows you to manage Microsoft Defender Antivirus settings on your Azure AD joined Windows 10 devices through Microsoft Intune. This profile enables you to configure antivirus settings, exclusions, scanning options, and more, all while minimizing administrative effort.
Futfuyfyjfj
👍 5
I just checked in the Intune portal, but there is no Defender firewall component in Device restrictions. However in device restrictions IS a Defender AV option. I consider your answer as wrong. I am still going for DE
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To minimize administrative effort for Azure AD joined devices managed by Intune, you must use Intune-native device configuration profiles rather than on-premises GPOs. Option E is correct because Microsoft Defender Firewall settings are configured under the 'Endpoint protection' device configuration profile template. Option C is correct because Microsoft Defender Antivirus settings can be configured under the 'Endpoint protection' profile template in modern Intune configurations, allowing centralized management of both firewall and antivirus policies within a single logical section of the console. While older documentation might point to Device Restrictions for Antivirus, current best practices and exam objectives favor the dedicated Endpoint protection node for comprehensive security settings.Why the Other Options Are Wrong
Options A and F suggest using Group Policy Objects (GPOs), which require hybrid Azure AD join or on-premises Active Directory integration, contradicting the scenario of purely Azure AD joined devices managed by Intune. Option B suggests configuring the Firewall via Device restrictions, which is incorrect as Firewall rules are part of the Endpoint protection template. Option D suggests configuring Antivirus via Device restrictions; while historically possible, the Endpoint protection template is the more robust and intended path for advanced security configuration in this context.Community Comment Notes
The community discussion highlights significant confusion regarding the specific menu paths in the Intune portal. Some users argue for Option D based on older documentation where Antivirus was under Device Restrictions, but others correctly note that modern implementations allow Antivirus configuration under Endpoint protection. Several commenters emphasize that Endpoint protection is the unified place for both Firewall and Antivirus settings, aligning with the CE answer choice. One user noted that checking the lab environment confirmed the availability of these settings in the Endpoint protection section.Official Reference
Exam Strategy
When managing cloud-only devices with Intune, always rule out GPO-based solutions immediately. Focus on the 'Endpoint protection' profile category for all Windows Defender components (Firewall, Antivirus, Credential Guard) as it provides the most granular control and is the standard for modern secure configuration.
Frequently Asked Questions
Why can't I use GPOs for Azure AD joined devices?
GPOs require connection to an on-premises Active Directory domain controller. Azure AD joined devices managed solely by Intune do not have this connectivity, making Intune-native profiles the only viable option.
Is Defender Antivirus still under Device Restrictions?
While older versions of Intune placed some AV settings there, the recommended approach for comprehensive security management is now the Endpoint protection profile, which houses both Firewall and Antivirus settings centrally.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →