Defender for Endpoint policies and Intune
Use Defender for Endpoint for detection and response, and Intune for repeatable device policy delivery, compliance, and application of endpoint security settings.
Operating model
Keep ownership clear: Defender is the security operations plane; Intune is the device management plane. A device can be onboarded to Defender without being managed by Intune, but Intune is the preferred control plane for enrolled Windows devices when you need assignment, reporting, compliance, and policy lifecycle management.
Use one deliberate source of authority for each setting. Avoid configuring the same antivirus, firewall, or ASR setting in multiple profiles unless you have tested the resulting policy merge and conflict behavior.
Policy and setting map
| Area | What it controls | Intune location | Validation |
|---|---|---|---|
| Onboarding | Connect devices to the Defender sensor | Intune endpoint detection and response profile | Confirm device appears in Defender device inventory and reports sensor health. |
| Antivirus | Real-time protection, cloud protection, exclusions, scans | Endpoint security > Antivirus | Start with Microsoft security baseline values; document every exclusion. |
| Firewall | Profiles, rules, network location behavior | Endpoint security > Firewall | Pilot rules before enforcing block behavior; check local rule merge behavior. |
| Attack surface reduction | ASR rules, exploit protection, controlled folder access | Endpoint security > Attack surface reduction | Use audit first, review events, then move selected rules to block. |
| EDR | EDR block mode, tamper protection, sample sharing | Endpoint detection and response profile | Validate onboarding and exclusions before enabling stronger response controls. |
| Device risk | Feed Defender risk into compliance and conditional access | Compliance policy + connector | Test the risk threshold and grace behavior with a pilot group. |
Sentinel tables
When Intune diagnostic data is routed to a Log Analytics workspace used by Sentinel, track Intune audit and operational activity in these Azure Monitor tables.
| Table | Data | Use |
|---|---|---|
| IntuneAuditLogs | Administrative and service audit records for Intune operations. | Use for change tracking, admin activity review, and policy lifecycle investigations. |
| IntuneOperationalLogs | Operational Intune service and device-management records. | Use for service activity, operational failures, and connector or policy deployment troubleshooting. |
Recommended rollout
- Connect Defender for Endpoint to Intune and confirm the tenant connector prerequisites.
- Create a pilot device group and deploy onboarding plus the endpoint security baseline.
- Use audit or report-only behavior for ASR and firewall changes where available; review Defender events.
- Promote tested profiles through staged groups, recording exclusions and exceptions.
- Enable device-risk compliance actions only after confirming the desired user and device experience.
Configuration options
Use the Intune portal for authoring and assignment, Microsoft Graph for repeatable policy automation, and Microsoft365DSC when you need declarative export and drift-oriented workflows. Terraform is not the natural control plane for Intune device policies. Defender APIs are useful for security operations actions and telemetry workflows, not as a replacement for Intune policy assignment.