capability

Attack Surface Reduction

Attack surface reduction helps reduce exposure by applying rules and controls that block common malware behaviors and risky activity on endpoints.

capabilitiesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproductMicrosoft Defender for Endpoint P1
Required licenselicenseMicrosoft Defender for Endpoint P2
Required licenselicenseDeviceEvents
Related tabletableMicrosoft Defender for Endpoint APIs
API accessapi

Configuration Methods

MethodSupportReference or Gap
PortalSupported Reference
PowerShellSupported Reference
REST APIGapASR policy is normally configured through Intune/security settings, Group Policy, PowerShell, or configuration profiles rather than the Defender for Endpoint REST API.
GraphSupported Reference
ARMGapNo ARM resource is recorded for this capability.
BicepGapNo Bicep resource is recorded for this capability.
TerraformGapNo azurerm resource exists for ASR policy. Use Intune/Graph automation or Microsoft365DSC rather than Terraform.
GitHub ActionsSupported Reference
Azure DevOpsSupported Reference