# Enable cloud-delivered protection (real-time threat intelligence)
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
# Enable Block at First Sight (BAFS)
# Requires: Cloud protection enabled + sample submission enabled
Set-MpPreference -DisableBlockAtFirstSeen $false
# Set cloud block timeout to maximum (60 seconds)
Set-MpPreference -CloudBlockLevel High
Set-MpPreference -CloudExtendedTimeout 50
# Enable potentially unwanted application (PUA) protection
Set-MpPreference -PUAProtection Enabled
Step 6: Configure Scan and Update Settings
# Configure real-time protection
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
Set-MpPreference -DisableScriptScanning $false
# Configure scheduled scan
Set-MpPreference -ScanScheduleQuickScanTime 12:00:00
Set-MpPreference -ScanParameters QuickScan
Set-MpPreference -ScanScheduleDay 0 # Every day
Set-MpPreference -RemediationScheduleDay 0
# Configure signature updates
Set-MpPreference -SignatureUpdateInterval 1 # Check every hour
Set-MpPreference -SignatureFallbackOrder "MicrosoftUpdateServer|MMPC"
# Enable tamper protection (prevents unauthorized changes to Defender settings)
# Managed via Microsoft 365 Defender portal:
# Settings → Endpoints → Advanced features → Tamper Protection: On
Step 7: Deploy via Intune (Enterprise)
Intune Deployment Path:
1. Endpoint Security → Attack Surface Reduction → Create Profile
- Platform: Windows 10 and later
- Profile: Attack surface reduction rules
- Configure each ASR rule to Block or Audit
2. Endpoint Security → Antivirus → Create Profile
- Microsoft Defender Antivirus
- Configure: Cloud protection, PUA, real-time protection
3. Endpoint Security → Antivirus → Create Profile
- Microsoft Defender Antivirus Exclusions
- Add path/process/extension exclusions for LOB apps
4. Devices → Configuration profiles → Create profile
- Endpoint protection → Microsoft Defender Exploit Guard
- Configure: Controlled Folder Access, Network Protection
Step 8: Monitor in Microsoft 365 Defender Portal
Dashboard monitoring:
1. security.microsoft.com → Reports → Endpoints
- Device health: Protection status across fleet
- ASR rule detections: Which rules are triggering
- Vulnerable devices: Missing security updates
2. Threat analytics:
- Active threat campaigns and Defender coverage
- Recommended security actions
3. Advanced hunting (KQL):
DeviceEvents
| where ActionType startswith "Asr"
| summarize Count=count() by ActionType, FileName
| sort by Count desc
DeviceEvents
| where ActionType == "ControlledFolderAccessViolationBlocked"
| project Timestamp, DeviceName, FileName, FolderPath
Key Concepts
Term
Definition
ASR Rules
Attack Surface Reduction rules that block specific high-risk behaviors at the endpoint level
Controlled Folder Access
Ransomware protection feature that prevents unauthorized applications from modifying files in protected folders
Network Protection
Blocks outbound connections to low-reputation or known-malicious domains using SmartScreen intelligence
Exploit Protection
System and per-application memory mitigations (DEP, ASLR, CFG) to prevent exploitation
BAFS (Block at First Sight)
Cloud-based zero-day protection that holds suspicious files for cloud analysis before allowing execution
Tamper Protection
Prevents unauthorized changes to Defender security settings, even by local administrators
Tools & Systems
Microsoft 365 Defender Portal: security.microsoft.com for centralized management and reporting
Microsoft Intune: Cloud-based endpoint management for Defender policy deployment
PowerShell (Set-MpPreference): Local configuration of Defender settings
WDAC (Windows Defender Application Control): Complementary application control technology
Microsoft Defender for Endpoint API: REST API for automation and custom integrations
Common Pitfalls
Enabling all ASR rules in Block mode immediately: Some ASR rules cause false positives with legitimate software (Office macros, admin scripts). Always deploy in Audit mode first and monitor for 2-4 weeks.
Not configuring Controlled Folder Access exclusions: Backup software, database applications, and development tools may be blocked from writing to protected folders. Add exclusions proactively.
Ignoring tamper protection: Without tamper protection, malware or insiders can disable Defender via PowerShell or registry edits. Enable tamper protection through the M365 Defender portal.
Running Defender alongside third-party AV: Defender enters passive mode when third-party AV is present. Ensure you are using the intended AV solution and configure Defender appropriately (EDR-only mode if keeping third-party AV).
Forgetting cloud connectivity requirements: Cloud-delivered protection and BAFS require endpoints to reach Microsoft cloud services. Verify proxy/firewall rules allow Defender cloud traffic.
