Endpoint Security: Antivirus, Firewall & Encryption

The three pillars of endpoint security

Simple explanation

Think of endpoint security like protecting a house.

Antivirus = the alarm system — detects and removes intruders (malware) that get inside
Firewall = the locked doors and windows — controls what comes in and goes out of the network
Disk encryption = a safe for your valuables — if someone steals the laptop, they can’t read the hard drive

All three are configured and enforced through Intune’s Endpoint Security node — Chen Wei at Meridian Bank manages all 10,000 devices from one dashboard.

Antivirus policies

What you configure

Setting	Options	Chen Wei’s Choice
Real-time protection	On/Off	On (always)
Cloud-delivered protection	On/Off	On — uses Microsoft’s cloud intelligence
Cloud protection level	Not configured / High / High+ / Zero tolerance	High+ (banking requires aggressive detection)
Scan type	Quick / Full	Quick scan daily, Full scan weekly
Scheduled scan	Time and frequency	Daily at 12:00 PM (lunch break)
Exclusions	File/folder/process/extension	Exclude banking app data folder (performance)
PUA detection	On/Off	On — block potentially unwanted applications
Tamper protection	On/Off	On — prevent users from disabling Defender

Where to create antivirus policies

Intune admin center → Endpoint security → Antivirus → Create policy

Platform	Profile Types
Windows	Microsoft Defender Antivirus, Microsoft Defender Antivirus Exclusions, Windows Security Experience
macOS	Microsoft Defender Antivirus (requires Defender for Endpoint on Mac)
Linux	Microsoft Defender Antivirus (requires Defender for Endpoint on Linux)

Exam tip: tamper protection

Tamper protection prevents users and malware from disabling Microsoft Defender Antivirus settings. When enabled:

Users can’t turn off real-time protection
Malware can’t disable Defender via registry changes
Third-party security tools can’t override Defender settings

The exam may describe a scenario where Defender keeps getting disabled — the answer is enable tamper protection. It’s managed through the Microsoft Defender portal (security.microsoft.com), not just Intune.

Firewall policies

Windows Defender Firewall via Intune

Setting	Options	Purpose
Domain profile	On/Off + rules	Applies when connected to corporate network
Private profile	On/Off + rules	Applies on home/trusted networks
Public profile	On/Off + rules	Applies on public Wi-Fi (most restrictive)
Block inbound connections	Yes/No per profile	Block unsolicited incoming traffic
Firewall rules	Allow/Block specific ports, protocols, apps	Custom rules for LOB apps, remote management

Firewall rule configuration

Rule Setting	Example
Name	Allow banking app port 8443
Direction	Inbound
Action	Allow
Protocol	TCP
Local port	8443
Remote address	10.0.0.0/8 (corporate network only)
Application	`C:\Program Files\BankApp\bank.exe`

Disk encryption policies

BitLocker (Windows)

Setting	Options	Chen Wei’s Choice
Require encryption	Yes/No	Yes — all corporate devices
Encryption method	XTS-AES 128, XTS-AES 256	XTS-AES 256 (banking standard)
OS drive encryption	Required	Required
Fixed drive encryption	Required / Not required	Required
Recovery key escrow	Save to Entra ID	Yes — recovery keys stored in Entra
Startup authentication	TPM only, TPM + PIN, TPM + key	TPM only (seamless for users)
Silent encryption	Yes/No	Yes — encrypt without user interaction

FileVault (macOS)

For macOS devices, disk encryption uses FileVault (covered in Module 13). Intune manages FileVault through endpoint security or device configuration profiles.

Deep dive: BitLocker recovery key management

When BitLocker encrypts a drive, a recovery key is generated. This 48-digit key unlocks the drive if the normal unlock method fails (TPM issue, forgotten PIN, motherboard replacement).

Intune workflow:

BitLocker encrypts the drive → recovery key generated
Key is automatically escrowed to Entra ID (attached to the device object)
Helpdesk views the key in Intune admin center → Devices → select device → Recovery keys
After use, the key should be rotated (see Module 17)

Exam tip: If a user gets a BitLocker recovery prompt after a hardware change, the helpdesk retrieves the key from Entra ID/Intune — not from a file on the device or a USB drive.

🎬 Video walkthrough

🎬 Video coming soon

Endpoint Security: Antivirus, Firewall & Encryption — MD-102 Module 23

~12 min

Flashcards

Question

What are the three main endpoint security policy types in Intune?

Click or press Enter to reveal answer

Answer

1. Antivirus — real-time protection, scans, cloud intelligence, tamper protection. 2. Firewall — domain/private/public network profiles, custom rules. 3. Disk encryption — BitLocker for Windows, FileVault for macOS.

Click to flip back

Question

What is tamper protection and why is it important?

Click or press Enter to reveal answer

Answer

Tamper protection prevents users and malware from disabling Microsoft Defender Antivirus settings. It stops real-time protection from being turned off, registry changes that disable Defender, and third-party tools from overriding settings. Managed through the Defender portal.

Click to flip back

Question

Where are BitLocker recovery keys stored when managed by Intune?

Click or press Enter to reveal answer

Answer

In Microsoft Entra ID, attached to the device object. Helpdesk can view them in the Intune admin center (Devices → select device → Recovery keys). Keys should be rotated after use.

Click to flip back

Knowledge Check

Chen Wei discovers that a malware strain at another bank disabled Microsoft Defender before executing its payload. How can he prevent this at Meridian Bank?

Knowledge Check

A user's laptop at Meridian Bank has a motherboard replacement and now shows a BitLocker recovery screen on boot. How should the helpdesk retrieve the recovery key?

Next up: Attack Surface Reduction & Security Baselines — hardening devices with ASR rules and Microsoft-recommended security configurations.