List of the settings in the Microsoft Defender for Endpoint security baseline in Intune
This article is a reference for the settings that are available in the different versions of the Microsoft Defender for Endpoint security baseline that you can deploy with Microsoft Intune. You can use the tabs below to select and view the settings in the current baseline version and a few older versions that might still be in use.
For each setting you’ll find the baselines default configuration, which is also the recommended configuration for that setting provided by the relevant security team. Because products and the security landscape evolve, the recommended defaults in one baseline version might not match the defaults you find in later versions of the same baseline. Different baseline types, like the MDM security and the Defender for Endpoint baselines, could also set different defaults.
When the Intune UI includes a Learn more link for a setting, you’ll find that here as well. Use that link to view the settings policy configuration service provider (CSP) or relevant content that explains the settings operation.
When a new version of a baseline becomes available, it replaces the previous version. Profiles instances that you’ve created prior to the availability of a new version:
- Become read-only. You can continue to use those profiles but can't edit them to change their configuration.
- Can be updated to the latest version. After you update a profile to the current baseline version, you can edit the profile to modify settings.
To learn more about using security baselines, see Use security baselines. In that article you'll also find information about how to:
- Change the baseline version for a profile to update a profile to use the latest version of that baseline.
Microsoft Defender for Endpoint baseline for December 2020 - version 6
Microsoft Defender for Endpoint baseline for September 2020 - version 5
Microsoft Defender for Endpoint baseline for April 2020 - version 4
Microsoft Defender for Endpoint baseline for March 2020 - version 3
The Microsoft Defender for Endpoint baseline is available when your environment meets the prerequisites for using Microsoft Defender for Endpoint.
This baseline is optimized for physical devices and isn't recommended for use on virtual machines (VMs) or VDI endpoints. Certain baseline settings can affect remote interactive sessions on virtualized environments. For more information, see Increase compliance to the Microsoft Defender for Endpoint security baseline in the Windows documentation.
Attack Surface Reduction Rules
Attack surface reduction rules support a merger of settings from different policies, to create a superset of policy for each device. Only the settings that aren't in conflict are merged. Settings that are in conflict are not added to the superset of rules. Previously, if two policies included conflicts for a single setting, both policies were flagged as being in conflict, and no settings from either profile would be deployed.
Attack surface reduction rule merge behavior is as follows:
- Attack surface reduction rules from the following profiles are evaluated for each device the rules apply to:
- Devices > Configuration policy > Endpoint protection profile > Microsoft Defender Exploit Guard > Attack Surface Reduction
- Endpoint security > Attack surface reduction policy > Attack surface reduction rules
- Endpoint security > Security baselines > Microsoft Defender for Endpoint Baseline > Attack Surface Reduction Rules.
- Settings that don't have conflicts are added to a superset of policy for the device.
- When two or more policies have conflicting settings, the conflicting settings aren't added to the combined policy, while settings that don’t conflict are added to the superset policy that applies to a device.
- Only the configurations for conflicting settings are held back.
To learn more, see Attack surface reduction rules in the Microsoft Defender for Endpoint documentation.
Block Office communication apps from creating child processes
Baseline default: Enable
Learn moreBlock Adobe Reader from creating child processes
Baseline default: Enable
Learn moreBlock Office applications from injecting code into other processes
Baseline default: Block
Learn moreBlock Office applications from creating executable content
Baseline default: Block
Learn moreBlock JavaScript or VBScript from launching downloaded executable content
Baseline default: Block
Learn moreEnable network protection
Baseline default: Enable
Learn moreBlock untrusted and unsigned processes that run from USB
Baseline default: Block
Learn moreBlock credential stealing from the Windows local security authority subsystem (lsass.exe)
Baseline default: Enable
Learn moreBlock executable content download from email and webmail clients
Baseline default: Block
Learn moreBlock all Office applications from creating child processes
Baseline default: Block
Learn moreBlock execution of potentially obfuscated scripts (js/vbs/ps)
Baseline default: Block
Learn moreBlock Win32 API calls from Office macro
Baseline default: Block
Learn more
Application Guard
For more information, see WindowsDefenderApplicationGuard CSP in the Windows documentation.
When you use Microsoft Edge, Microsoft Defender Application Guard protects your environment from sites that aren't trusted by your organization. When users visit sites that aren't listed in your isolated network boundary, the sites open in a Hyper-V virtual browsing session. Trusted sites are defined by a network boundary.
Turn on Application Guard for Edge (Options)
Baseline default: Enabled for Edge
Learn moreBlock external content from non-enterprise approved sites
Baseline default: Yes
Learn moreClipboard behavior
Baseline default: Block copy and paste between PC and browser
Learn more
Windows network isolation policy
Baseline default: Configure
Learn more- Network domains
Baseline default: securitycenter.windows.com
- Network domains
BitLocker
Require storage cards to be encrypted (mobile only)
Baseline default: Yes
Learn moreNote
Support for Windows 10 Mobile and Windows Phone 8.1 ended in August of 2020.
Enable full disk encryption for OS and fixed data drives
Baseline default: Yes
Learn moreBitLocker system drive policy
Baseline default: Configure
Learn more- Configure encryption method for Operating System drives
Baseline default: Not configured
Learn more
- Configure encryption method for Operating System drives
BitLocker fixed drive policy
Baseline default: Configure
Learn moreBlock write access to fixed data-drives not protected by BitLocker
Baseline default: Yes
Learn more
This setting is available when BitLocker fixed drive policy is set to Configure.Configure encryption method for fixed data-drives
Baseline default: AES 128bit XTS
Learn more
BitLocker removable drive policy
Baseline default: Configure
Learn moreConfigure encryption method for removable data-drives
Baseline default: AES 128bit CBC
Learn moreBlock write access to removable data-drives not protected by BitLocker
Baseline default: Not configured
Learn more
Standby states when sleeping while on battery Baseline default: Disabled
Learn moreStandby states when sleeping while plugged in
Baseline default: Disabled
Learn moreEnable full disk encryption for OS and fixed data drives
Baseline default: Yes
Learn moreBitLocker system drive policy
Baseline default: Configure
Learn moreStartup authentication required
Baseline default: Yes
Learn moreCompatible TPM startup PIN
Baseline default: Allowed
Learn moreCompatible TPM startup key
Baseline default: Required
Learn moreDisable BitLocker on devices where TPM is incompatible
Baseline default: Yes
Learn moreConfigure encryption method for Operating System drives
Baseline default: Not configured
Learn more
BitLocker fixed drive policy
Baseline default: Configure
Learn moreBlock write access to fixed data-drives not protected by BitLocker
Baseline default: Yes
Learn more
This setting is available when BitLocker fixed drive policy is set to Configure.Configure encryption method for fixed data-drives
Baseline default: AES 128bit XTS
Learn more
BitLocker removable drive policy
Baseline default: Configure
Learn moreConfigure encryption method for removable data-drives
Baseline default: AES 128bit CBC
Learn moreBlock write access to removable data-drives not protected by BitLocker
Baseline default: Not configured
Learn more
BitLocker system drive policy
Baseline default: Configure
Learn moreStartup authentication required
Baseline default: Yes
Learn moreCompatible TPM startup PIN
Baseline default: Allowed
Learn moreCompatible TPM startup key
Baseline default: Required
Learn moreDisable BitLocker on devices where TPM is incompatible
Baseline default: Yes
Learn moreConfigure encryption method for Operating System drives
Baseline default: Not configured
Learn more
Standby states when sleeping while on battery Baseline default: Disabled
Learn moreStandby states when sleeping while plugged in
Baseline default: Disabled
Learn moreEnable full disk encryption for OS and fixed data drives
Baseline default: Yes
Learn moreBitLocker fixed drive policy
Baseline default: Configure
Learn moreBlock write access to fixed data-drives not protected by BitLocker
Baseline default: Yes
Learn more
This setting is available when BitLocker fixed drive policy is set to Configure.Configure encryption method for fixed data-drives
Baseline default: AES 128bit XTS
Learn more
BitLocker removable drive policy
Baseline default: Configure
Learn moreConfigure encryption method for removable data-drives
Baseline default: AES 128bit CBC
Learn moreBlock write access to removable data-drives not protected by BitLocker
Baseline default: Not configured
Learn more
Browser
Require SmartScreen for Microsoft Edge
Baseline default: Yes
Learn moreBlock malicious site access
Baseline default: Yes
Learn moreBlock unverified file download
Baseline default: Yes
Learn more
Data Protection
- Block direct memory access
Baseline default: Yes
Learn more
Device Guard
- Turn on credential guard
Baseline default: Enable with UEFI lock
Learn more
Device Installation
Hardware device installation by device identifiers
Baseline default: Block hardware device installation
Learn moreRemove matching hardware devices Baseline default: Yes
Hardware device identifiers that are blocked
Baseline default: Not configured by default. Manually add one or more device identifiers.
Hardware device installation by setup classes
Baseline default: Block hardware device installation
Learn moreRemove matching hardware devices Baseline default: Not configured
Hardware device identifiers that are blocked Baseline default: Not configured by default. Manually add one or more device identifiers.
Block hardware device installation by setup classes:
Baseline default: Yes
Learn moreRemove matching hardware devices:
Baseline default: YesBlock list
Baseline default: Not configured by default. Manually add one or more setup class globally unique identifiers.
DMA Guard
- Enumeration of external devices incompatible with Kernel DMA Protection
Baseline default: Block all
Learn more
- Enumeration of external devices incompatible with Kernel DMA Protection
Baseline default: Not configured
Learn more
Endpoint Detection and Response
Sample sharing for all files
Baseline default: Yes
Learn moreExpedite telemetry reporting frequency
Baseline default: Yes
Learn more
Firewall
Stateful File Transfer Protocol (FTP)
Baseline default: Disabled
Learn moreNumber of seconds a security association can be idle before it's deleted
Baseline default: 300
Learn morePreshared key encoding
Baseline default: UTF8
Learn moreCertificate revocation list (CRL) verification
Baseline default: Not configured
Learn morePacket queuing
Baseline default: Not configured
Learn moreFirewall profile private
Baseline default: Configure
Learn moreInbound connections blocked
Baseline default: Yes
Learn moreUnicast responses to multicast broadcasts required
Baseline default: Yes
Learn moreOutbound connections required
Baseline default: Yes
Learn moreInbound notifications blocked
Baseline default: Yes
Learn moreGlobal port rules from group policy merged
Baseline default: Yes
Learn moreFirewall enabled
Baseline default: Allowed
Learn moreAuthorized application rules from group policy not merged
Baseline default: Yes
Learn moreConnection security rules from group policy not merged
Baseline default: Yes
Learn moreIncoming traffic required
Baseline default: Yes
Learn morePolicy rules from group policy not merged
Baseline default: Yes
Learn more
- Stealth mode blocked
Baseline default: Yes
Learn more
Firewall profile public
Baseline default: Configure
Learn moreInbound connections blocked
Baseline default: Yes
Learn moreUnicast responses to multicast broadcasts required
Baseline default: Yes
Learn moreOutbound connections required
Baseline default: Yes
Learn moreAuthorized application rules from group policy not merged
Baseline default: Yes**
Learn moreInbound notifications blocked
Baseline default: Yes
Learn moreGlobal port rules from group policy merged
Baseline default: Yes
Learn moreFirewall enabled
Baseline default: Allowed
Learn moreConnection security rules from group policy not merged
Baseline default: Yes
Learn moreIncoming traffic required
Baseline default: Yes
Learn morePolicy rules from group policy not merged
Baseline default: Yes
Learn more
- Stealth mode blocked
Baseline default: Yes
Learn more
Firewall profile domain
Baseline default: Configure
Learn moreUnicast responses to multicast broadcasts required
Baseline default: Yes
Learn moreAuthorized application rules from group policy not merged
Baseline default: Yes
Learn moreInbound notifications blocked
Baseline default: Yes
Learn moreGlobal port rules from group policy merged
Baseline default: Yes
Learn moreFirewall enabled
Baseline default: Allowed
Learn moreConnection security rules from group policy not merged
Baseline default: Yes
Learn morePolicy rules from group policy not merged
Baseline default: Yes
Learn more
- Stealth mode blocked
Baseline default: Yes
Learn more
Microsoft Defender
Turn on real-time protection
Baseline default: Yes
Learn moreAdditional amount of time (0-50 seconds) to extend cloud protection timeout
Baseline default: 50
Learn moreScan all downloaded files and attachments
Baseline default: Yes
Learn moreScan type
Baseline default: Quick scan
Learn moreDefender schedule scan day:
Baseline default: EverydayDefender scan start time:
Baseline default: Not configuredDefender sample submission consent
Baseline default: Send safe samples automatically
Learn moreCloud-delivered protection level
Baseline default: High
Learn moreScan removable drives during full scan
Baseline default: Yes
Learn moreDefender potentially unwanted app action
Baseline default: Block
Learn moreTurn on cloud-delivered protection
Baseline default: Yes
Learn more
Turn on real-time protection
Baseline default: Yes
Learn moreAdditional amount of time (0-50 seconds) to extend cloud protection timeout
Baseline default: 50
Learn moreScan all downloaded files and attachments
Baseline default: Yes
Learn moreScan type
Baseline default: Quick scan
Learn moreDefender sample submission consent
Baseline default: Send safe samples automatically
Learn moreCloud-delivered protection level
Baseline default: High
Learn moreScan removable drives during full scan
Baseline default: Yes
Learn moreDefender potentially unwanted app action
Baseline default: Block
Learn moreTurn on cloud-delivered protection
Baseline default: Yes
Learn more
Run daily quick scan at
Baseline default: 2 AM
Learn moreScheduled scan start time
Baseline default: 2 AMConfigure low CPU priority for scheduled scans
Baseline default: Yes
Learn moreBlock Office communication apps from creating child processes
Baseline default: Enable
Learn moreBlock Adobe Reader from creating child processes
Baseline default: Enable
Learn moreScan incoming email messages
Baseline default: Yes
Learn moreTurn on real-time protection
Baseline default: Yes
Learn moreNumber of days (0-90) to keep quarantined malware
Baseline default: 0
Learn moreDefender system scan schedule
Baseline default: User defined
Learn moreAdditional amount of time (0-50 seconds) to extend cloud protection timeout
Baseline default: 50
Learn moreScan mapped network drives during a full scan
Baseline default: Yes
Learn moreTurn on network protection
Baseline default: Yes
Learn moreScan all downloaded files and attachments
Baseline default: Yes
Learn moreBlock on access protection
Baseline default: Not configured
Learn moreScan browser scripts
Baseline default: Yes
Learn moreBlock user access to Microsoft Defender app
Baseline default: Yes
Learn moreMaximum allowed CPU usage (0-100 percent) per scan
Baseline default: 50
Learn moreScan type
Baseline default: Quick scan
Learn moreEnter how often (0-24 hours) to check for security intelligence updates
Baseline default: 8
Learn moreDefender sample submission consent
Baseline default: Send safe samples automatically
Learn moreCloud-delivered protection level
Baseline default: *Not configured
Learn moreScan archive files
Baseline default: Yes
Learn moreTurn on behavior monitoring
Baseline default: Yes
Learn moreScan removable drives during full scan
Baseline default: Yes
Learn moreScan network files
Baseline default: Yes
Learn moreDefender potentially unwanted app action
Baseline default: Block
Learn moreTurn on cloud-delivered protection
Baseline default: Yes
Learn moreBlock Office applications from injecting code into other processes
Baseline default: Block
Learn moreBlock Office applications from creating executable content
Baseline default: Block
Learn moreBlock JavaScript or VBScript from launching downloaded executable content
Baseline default: Block
Learn moreEnable network protection
Baseline default: Audit mode
Learn moreBlock untrusted and unsigned processes that run from USB
Baseline default: Block
Learn moreBlock credential stealing from the Windows local security authority subsystem (lsass.exe)
Baseline default: Enable
Learn moreBlock executable content download from email and webmail clients
Baseline default: Block
Learn moreBlock all Office applications from creating child processes
Baseline default: Block
Learn moreBlock execution of potentially obfuscated scripts (js/vbs/ps)
Baseline default: Block
Learn moreBlock Win32 API calls from Office macro
Baseline default: Block
Learn more
Run daily quick scan at
Baseline default: 2 AM
Learn moreScheduled scan start time
Baseline default: 2 AMConfigure low CPU priority for scheduled scans
Baseline default: Yes
Learn moreBlock Office communication apps from creating child processes
Baseline default: Enable
Learn moreBlock Adobe Reader from creating child processes
Baseline default: Enable
Learn moreScan incoming email messages
Baseline default: Yes
Learn moreTurn on real-time protection
Baseline default: Yes
Learn moreNumber of days (0-90) to keep quarantined malware
Baseline default: 0
Learn moreDefender system scan schedule
Baseline default: User defined
Learn moreAdditional amount of time (0-50 seconds) to extend cloud protection timeout
Baseline default: 50
Learn moreScan mapped network drives during a full scan
Baseline default: Yes
Learn moreTurn on network protection
Baseline default: Yes
Learn moreScan all downloaded files and attachments
Baseline default: Yes
Learn moreBlock on access protection
Baseline default: Not configured
Learn moreScan browser scripts
Baseline default: Yes
Learn moreBlock user access to Microsoft Defender app
Baseline default: Yes
Learn moreMaximum allowed CPU usage (0-100 percent) per scan
Baseline default: 50
Learn moreScan type
Baseline default: Quick scan
Learn moreEnter how often (0-24 hours) to check for security intelligence updates
Baseline default: 8
Learn moreDefender sample submission consent
Baseline default: Send safe samples automatically
Learn moreCloud-delivered protection level
Baseline default: *Not configured
Learn moreScan archive files
Baseline default: Yes
Learn moreTurn on behavior monitoring
Baseline default: Yes
Learn moreScan removable drives during full scan
Baseline default: Yes
Learn moreScan network files
Baseline default: Yes
Learn moreDefender potentially unwanted app action
Baseline default: Block
Learn moreTurn on cloud-delivered protection
Baseline default: Yes
Learn moreBlock Office applications from injecting code into other processes
Baseline default: Block
Learn moreBlock Office applications from creating executable content
Baseline default: Block
Learn moreBlock JavaScript or VBScript from launching downloaded executable content
Baseline default: Block
Learn moreEnable network protection
Baseline default: Audit mode
Learn moreBlock untrusted and unsigned processes that run from USB
Baseline default: Block
Learn moreBlock credential stealing from the Windows local security authority subsystem (lsass.exe)
Baseline default: Enable
Learn moreBlock executable content download from email and webmail clients
Baseline default: Block
Learn moreBlock all Office applications from creating child processes
Baseline default: Block
Learn moreBlock execution of potentially obfuscated scripts (js/vbs/ps)
Baseline default: Block
Learn moreBlock Win32 API calls from Office macro
Baseline default: Block
Learn more
Microsoft Defender Security Center
- Block users from editing the Exploit Guard protection interface
Baseline default: Yes
Learn more
Smart Screen
Block users from ignoring SmartScreen warnings
Baseline default: Yes
Learn moreTurn on Windows SmartScreen
Baseline default: Yes
Learn moreRequire SmartScreen for Microsoft Edge
Baseline default: Yes
Learn moreBlock malicious site access
Baseline default: Yes
Learn moreBlock unverified file download
Baseline default: Yes
Learn moreConfigure Microsoft Defender SmartScreen
Baseline default: EnabledPrevent bypassing Microsoft Defender SmartScreen prompts for sites
Baseline default: EnabledPrevent bypassing of Microsoft Defender SmartScreen warnings about downloads
Baseline default: EnabledConfigure Microsoft Defender SmartScreen to block potentially unwanted apps
Baseline default: Enabled
Require apps from store only
Baseline default: YesTurn on Windows SmartScreen
Baseline default: Yes
Learn more
Windows Hello for Business
For more information, see PassportForWork CSP in the Windows documentation.
Block Windows Hello for Business
Baseline default: DisabledLowercase letters in PIN Baseline default: Allowed
Special characters in PIN Baseline default: Allowed
Uppercase letters in PIN Baseline default: Allowed
Next steps
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for