Configuring Defender Firewall and Antivirus via Intune Profiles

MD-102 By islever Editorial Last updated

Configure endpoint security

Short answer

CE Create device configuration profiles using the Endpoint protection settings template to configure both Microsoft Defender Antivirus and Microsoft Defender Firewall.

Question

You have an Azure AD tenant and 100 Windows 10 devices that are Azure AD joined and managed by using Microsoft Intune.
You need to configure Microsoft Defender Firewall and Microsoft Defender Antivirus on the devices. The solution must minimize administrative effort.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
  1. To configure Microsoft Defender Antivirus, create a Group Policy Object (GPO) and configure the Windows Defender Antivirus settings.
  2. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Device restrictions settings.
  3. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. Correct Answer
  4. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Device restrictions settings.
  5. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings. Correct Answer
  6. To configure Microsoft Defender Firewall, create a Group Policy Object (GPO) and configure Windows Defender Firewall with Advanced Security.

Key Takeaways

The question tests knowledge of Intune endpoint security policy templates, specifically distinguishing between Endpoint protection settings (for Firewall) and Device restrictions or Endpoint protection (for Antivirus).

This guide explains how to configure Microsoft Defender Firewall and Antivirus on Azure AD joined devices using Microsoft Intune device configuration profiles. It clarifies the correct profile categories for each security component to minimize administrative effort.

Common mistake: Many learners incorrectly choose options involving Group Policy Objects (GPOs), which are not suitable for cloud-managed Azure AD joined devices managed solely by Intune.

Expert Analysis

Why the Answer Is Correct

To minimize administrative effort for Azure AD joined devices managed by Intune, you must use Intune-native device configuration profiles rather than on-premises GPOs. Option E is correct because Microsoft Defender Firewall settings are configured under the 'Endpoint protection' device configuration profile template. Option C is correct because Microsoft Defender Antivirus settings can be configured under the 'Endpoint protection' profile template in modern Intune configurations, allowing centralized management of both firewall and antivirus policies within a single logical section of the console. While older documentation might point to Device Restrictions for Antivirus, current best practices and exam objectives favor the dedicated Endpoint protection node for comprehensive security settings.

Why the Other Options Are Wrong

Options A and F suggest using Group Policy Objects (GPOs), which require hybrid Azure AD join or on-premises Active Directory integration, contradicting the scenario of purely Azure AD joined devices managed by Intune. Option B suggests configuring the Firewall via Device restrictions, which is incorrect as Firewall rules are part of the Endpoint protection template. Option D suggests configuring Antivirus via Device restrictions; while historically possible, the Endpoint protection template is the more robust and intended path for advanced security configuration in this context.

Community Comment Notes

The community discussion highlights significant confusion regarding the specific menu paths in the Intune portal. Some users argue for Option D based on older documentation where Antivirus was under Device Restrictions, but others correctly note that modern implementations allow Antivirus configuration under Endpoint protection. Several commenters emphasize that Endpoint protection is the unified place for both Firewall and Antivirus settings, aligning with the CE answer choice. One user noted that checking the lab environment confirmed the availability of these settings in the Endpoint protection section.

Exam Strategy

When managing cloud-only devices with Intune, always rule out GPO-based solutions immediately. Focus on the 'Endpoint protection' profile category for all Windows Defender components (Firewall, Antivirus, Credential Guard) as it provides the most granular control and is the standard for modern secure configuration.

Frequently Asked Questions

Why can't I use GPOs for Azure AD joined devices?

GPOs require connection to an on-premises Active Directory domain controller. Azure AD joined devices managed solely by Intune do not have this connectivity, making Intune-native profiles the only viable option.

Is Defender Antivirus still under Device Restrictions?

While older versions of Intune placed some AV settings there, the recommended approach for comprehensive security management is now the Endpoint protection profile, which houses both Firewall and Antivirus settings centrally.

More MD-102 FAQ →

Discussion 71 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 71

  1. deinth 👍 38
    for firewall E: https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune for antiviurs D: https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus
  2. SalonaSahni 👍 11
    DE is the Answer D:Microsoft Defender Antivirus: Device config-Device Restrictions- It has 28-34 settings for Antivrus. E: Microsoft Defender Firewall- Device config- Endpoint Protection (Global settings, netwok settings, Firewall rules) I have cross checked the lab. THe Endpoint Protection does not have the option for MS Defender Antivirus.
  3. minasamy 👍 7
    B and C are the correct answers : B. Creating a device configuration profile and configuring the Device restrictions settings allows you to manage the Microsoft Defender Firewall settings on your Azure AD joined Windows 10 devices through Microsoft Intune. This profile can help you configure and manage firewall rules and settings without the need for traditional Group Policy. C. Creating a device configuration profile and configuring the Endpoint protection settings allows you to manage Microsoft Defender Antivirus settings on your Azure AD joined Windows 10 devices through Microsoft Intune. This profile enables you to configure antivirus settings, exclusions, scanning options, and more, all while minimizing administrative effort.
  4. Robert69 👍 5
    Since the devices are Azure AD joined and managed by Intune (not hybrid or on-premises AD joined), you should use Intune device configuration profiles to manage both Microsoft Defender Firewall and Antivirus settings. This minimizes administrative effort by managing everything centrally through Intune. Why these are correct: Option C - Defender Antivirus via Endpoint Protection Endpoint protection settings in Intune device configuration profiles include comprehensive Microsoft Defender Antivirus configuration options This is the native Intune method for configuring antivirus settings Minimizes administrative effort for cloud-managed devices Option E - Defender Firewall via Endpoint Protection Endpoint protection settings also include Microsoft Defender Firewall configuration options Allows you to configure firewall rules, notifications, and security settings Centrally managed through Intune for Azure AD joined devices
  5. Knight_Of_Peace 👍 5
    Given answer is correct. Microsoft Defender Antivirus setup: Intune --> Devices --> Configuration --> Create new policy --> Windows 10 and later --> Template --> Device Restrictions --> Microsoft Defender Antivirus. Windows Firewall setup: Intune --> Devices --> Configuration --> Create new policy --> Windows 10 and later --> Template --> Endpoint protection --> Windows Firewall.
Show 25 more comments
  1. Futfuyfyjfj 👍 5
    I just checked in the Intune portal, but there is no Defender firewall component in Device restrictions. However in device restrictions IS a Defender AV option. I consider your answer as wrong. I am still going for DE
  2. sorinaccio 👍 4
    C and E are the correct answers and this is why: Endpoint Protection Settings: These are specifically used for configuring security features like Microsoft Defender Antivirus, Microsoft Defender Firewall, and other advanced security settings. Why the other options are not correct? Device Restrictions Settings: While they do include some basic security options, they are more focused on restricting device features and user behavior. They do not provide the detailed configuration for antivirus or firewall settings that Endpoint protection does.
  3. letters1234 👍 4
    Antivirus and Firewall can be configured on Endpoint Protection, Firewall can't be configured on Device Restrictions. Configuring the two requirements on the one Endpoint Protection profile reduces administrative overhead. Having the extended options of Antivirus on a Device Restriction profile also increases overhead, more to configure/understand before implementation.
  4. Mohamed555 👍 4
    Feature Intune profile category Correct answer? Microsoft Defender Antivirus Device configuration profile → Endpoint protection settings ✅ C Microsoft Defender Firewall Device configuration profile → Endpoint protection settings ✅ E
  5. Viddah 👍 4
    C and E are the correct answers MS recommandations are to managed into Endpoint protection section for advance security. it's the same situation like Bitlocker configuration.
  6. jonker 👍 4
    both should be configure from Endpoint security node
  7. RJTW070 👍 3
    Since the Windows 10 devices are Azure AD joined and managed by Microsoft Intune, the best approach to configure Microsoft Defender Antivirus and Microsoft Defender Firewall while minimizing administrative effort is using Intune Device Configuration Profiles. Microsoft Defender Antivirus Configuration: In Intune, Endpoint protection settings under Device configuration profiles allow you to manage Defender Antivirus policies. This setting enables real-time protection, cloud-delivered protection, automatic sample submission, exclusions, and Defender updates. This matches option C. Microsoft Defender Firewall Configuration: The Microsoft Defender Firewall settings are also configured within Endpoint protection settings in an Intune Device configuration profile. This allows for enforcing firewall rules, inbound/outbound protection, and controlling network traffic centrally via Intune. This matches option E.
  8. veliyath 👍 3
    D. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Device restrictions settings. Configure Microsoft Defender Antivirus using Device restrictions in Intune E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings. Configure Microsoft Defender Firewall rules using Endpoint protection in Intune These selections ensure that the configurations for both Microsoft Defender Antivirus and Microsoft Defender Firewall are managed through Intune, aligning with the goal of minimizing administrative effort.
  9. CheMetto 👍 3
    From: https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-protection-configure With Intune, you can use device configuration profiles to manage common Endpoint protection security features on devices, including: Firewall BitLocker Allowing and blocking apps Microsoft Defender and encryption
  10. MaryndenOuden 👍 3
    The correct answers are C and E, because both Microsoft Defender Antivirus and Microsoft Defender Firewall are configured through Intune Endpoint Protection profiles, which provides the required settings while keeping administrative effort to a minimum.
  11. JP1900 👍 3
    D - MS Defender Antivirus is under Device Restriction settings E - Defender Firewall is under Endpoint Protection settings Both are under Devices, then Configuration profiles, then select Templates from the dropdown.
  12. clucks 👍 3
    Just open up intune and you can see for yourself. Endpoint Protection contains the Firewall configuration. Device restrictions contains MS Antivirus configuration.
  13. nkcodiac 👍 3
    Hello All According to this question Write answer is D and E but now Intune is updated so we can do both things from Endpoint Security
  14. PXAbstraction 👍 3
    I am looking at the Intune portal right now and this is wrong. Firewall and Antivirus are absolutely under Endpoint Security.
  15. noa808a 👍 3
    Answer is outdated. As of June 2026 (and a little previously), both should be configured via Endpoint Protection.
  16. a5f91f0 👍 3
    The answer is outdated, as the antivirus settings can now be configured in the endpoint secuity section
  17. Nko01 👍 3
    Firewall and antivirus are both under endpoint security menu in intune
  18. Futfuyfyjfj 👍 3
    Checked this in Intune and DE is the only correct aswer!
  19. Rocky83 👍 3
    If you think about admin effort ... CE makes sense
  20. oopspruu 👍 3
    D&E are correct options. Tested in lab 2024/07
  21. NoursBear 👍 3
    arghhh sorry D and E
  22. epyonkills 👍 3
    C and E
  23. nicholaswildern 👍 2
    Perplexity AI To configure Microsoft Defender Firewall and Microsoft Defender Antivirus on your Azure AD-joined Windows 10 devices managed by Microsoft Intune, and to minimize administrative effort, you should perform the following actions: To configure Microsoft Defender Antivirus: Create a device configuration profile and configure the Endpoint protection settings. This allows you to manage antivirus policies directly through Intune, which is streamlined for managing multiple devices in an enterprise environment. To configure Microsoft Defender Firewall: Create a device configuration profile and configure the Endpoint protection settings. This approach also leverages Intune's capabilities to manage firewall settings across all devices efficiently. Therefore, the correct answers are: C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings.
  24. RJTW070 👍 2
    Explanation: Since the devices are Azure AD joined and managed by Microsoft Intune, the configurations for both Microsoft Defender Firewall and Microsoft Defender Antivirus should be done through Intune's Endpoint protection settings, as they provide the necessary controls for these security features. C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings: Intune's Endpoint protection settings include configurations for Microsoft Defender Antivirus, such as enabling real-time protection, configuring scan schedules, and setting exclusions. E. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Endpoint protection settings: Microsoft Defender Firewall settings, such as enabling the firewall, configuring rules, and network security, are also part of the Endpoint protection settings in Intune.
  25. pinda 👍 2
    B. To configure Microsoft Defender Firewall, create a device configuration profile and configure the Device restrictions settings. This will allow you to configure firewall settings via Intune, ensuring consistency across your devices. C. To configure Microsoft Defender Antivirus, create a device configuration profile and configure the Endpoint protection settings. This will allow you to configure antivirus settings and policies via Intune, making it easy to manage across your devices.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide