Prevent Disabling Defender for Endpoint

MD-102 By islever Editorial Last updated Sep 27, 2026

Configure endpoint security

Short answer

C Enable tamper protection in the Microsoft Defender portal to prevent users from disabling Microsoft Defender for Endpoint.

Question

You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Microsoft Entra joined and are enrolled in Microsoft Intune. You plan to manage Microsoft Defender for Endpoint on the computers. You need to prevent users from disabling Microsoft Defender for Endpoint. What should you do?

From the Microsoft Intune admin center, create an attack surface reduction (ASR) policy.
From the Microsoft Intune admin center, create an account protection policy.
From the Microsoft Defender portal, enable tamper protection. Correct Answer
From the Microsoft Intune admin center, create a device compliance policy.

Key Takeaways

Tamper protection is the specific feature required to prevent users from altering or disabling Microsoft Defender for Endpoint settings, catching those who confuse policy enforcement with local setting locks.

Microsoft Defender for Endpoint tamper protection prevents unauthorized users from disabling security settings. This page confirms that enabling tamper protection in the Microsoft Defender portal is the correct method to restrict these changes.

Common mistake: Choosing an ASR policy (A) or device compliance policy (D) because they seem related to security enforcement, but neither actually blocks the user from disabling the service locally.

Expert Analysis

Why the Answer Is Correct

Enabling tamper protection in the Microsoft Defender portal is the designated method to prevent users, including local administrators, from disabling Microsoft Defender for Endpoint or altering its core security settings. This feature locks down critical Defender configurations to ensure continuous, uninterrupted protection against threats.

Why the Other Options Are Wrong

An attack surface reduction (ASR) policy reduces attack vectors but does not block users from disabling the Defender agent itself. An account protection policy manages identity and access security, not antivirus settings. A device compliance policy evaluates whether a device meets baseline requirements and marks it compliant/non-compliant, but it does not actively prevent a user from turning off Defender locally.

Community Comment Notes

Community members strongly agree with the given answer, noting that "tamper protection is a critical feature that helps protect against unauthorized changes" to security settings. Others simply validated that the given answer is correct.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked how to prevent users from altering or disabling Defender settings, look for 'tamper protection'. Do not confuse compliance or ASR policies with the hard enforcement that blocks local changes.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

powered 👍 5 Answered C

It looks similar/duplicate to other question post here, can someone pls chk?
meer.mariwan00 👍 2

what a glorious sight ( I reached the final question )
Meek_Learner 👍 1

To prevent users from disabling Microsoft Defender for Endpoint on the computers, you should enable tamper protection from the Microsoft Defender portal. Tamper protection is a critical feature that helps protect against unauthorized changes from users (and even malware) to security settings, including attempts to disable Microsoft Defender for Endpoint.
correction 👍 1 Answered C

Given Answer is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide