How to block Office applications from creating child processes in Microsoft 365?

Why the Answer Is Correct

Microsoft Secure Score surfaces 'Block all Office applications from creating child processes' as an improvement action, and that string is the verbatim name of an attack surface reduction (ASR) rule shipped with Microsoft Defender for Endpoint (rule GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a). Because the scenario includes Intune, Defender XDR and Windows 11 devices, the rule is deployed through an Intune endpoint security attack surface reduction policy (or the equivalent ASR configuration in the Defender portal), which is exactly what option D describes. Once the ASR policy targets the Windows 11 device groups, the recommendation moves to 'Completed' and the tenant's Secure Score increases, since ASR rules are scored as configuration-based improvement actions. No other option in the list configures an ASR rule, so only D can satisfy the recommendation as written.

Why the Other Options Are Wrong

Option A, Safe Documents, is a Microsoft Defender for Office 365 feature that opens untrusted files in Protected View before a user can edit them; it addresses malicious attachments and documents, not process-creation behaviour on the endpoint, so it never clears this recommendation. Option B, 'Create a policy for Office applications', is the classic distractor: Office cloud policy service and Intune app protection/app configuration policies manage settings such as macros, COM add-ins or telemetry, but they cannot block an Office process from spawning cmd.exe or powershell.exe. Option C, an EDR policy, only onboards devices to Microsoft Defender for Endpoint and configures EDR capabilities such as automatic investigation and remediation, tamper protection or sample collection — it does not enforce ASR block rules. All three leave the Windows 11 devices without the process-creation restriction that Secure Score is measuring.

Community Comment Notes

Every learner answer recorded on this item agrees with D, and the reasoning is short and specific rather than a blind majority vote. Krayzr reproduced the recommendation wording — "Block all Office applications from creating child processes >> Yes" — and linked the official attack surface reduction rules reference, which is the definitive source that names this rule. Preeb simply stated "ASR Policy is correct." and KoenJas likewise selected D, so there is no dissent or counter-argument to weigh against the technical mapping between the recommendation name and the ASR rule.