14.2 Configuring Endpoint Settings

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

14.2 Configuring Endpoint Settings

Key Takeaways Explain This Topic AI

Tamper protection prevents local admins and security tools from disabling Microsoft Defender settings and is managed centrally from the Defender portal or Intune, not from the local client

Attack Surface Reduction (ASR) rules run in audit mode for impact testing before being flipped to block mode, and audit-mode events are visible in advanced hunting

Controlled folder access is the Defender anti-ransomware feature that blocks untrusted processes from writing to protected folders

The two configuration surfaces for endpoints are the Defender portal's Settings → Endpoints advanced features and Intune endpoint security policies (antivirus, EDR, ASR, disk encryption, firewall)

Web content filtering in Defender for Endpoint blocks categories of websites at the endpoint level and is enforced by the Defender network protection component

Last updated: August 2026

Configuring Endpoint Settings in Defender for Endpoint

Quick Answer: After onboarding, you configure endpoint behavior through two surfaces: the Defender portal's Settings → Endpoints → Advanced features page for tenant-wide toggles, and Intune endpoint security policies for per-group device configuration. The MS-102 exam expects you to know what each surface controls and to recognize tamper protection, ASR rules, controlled folder access, and web content filtering as the headline settings.

The Two Configuration Surfaces

Surface Scope Examples

Defender portal → Settings → Endpoints Tenant-wide toggles, advanced features Tamper protection on/off, automated investigation, EDR in block mode, live response, custom network indicators, device discovery, web content filtering, email notifications

Intune → Endpoint security policies Per-group device configuration Antivirus exclusions, ASR rule state, EDR tag, disk encryption, firewall rules

Neither surface fully replaces the other. A typical enterprise uses the Defender portal for global on/off behavior and Intune for granular policy targeted at device groups.

Tamper Protection

Tamper protection is a critical security feature that prevents local admins, scripts, and other security products from disabling Microsoft Defender settings. When tamper protection is on, the following operations are blocked even for users with local administrator rights:

• Disabling real-time protection
• Turning off cloud-delivered protection
• Disabling Microsoft Defender Antivirus
• Removing antivirus signature updates
• Disabling behavioral monitoring

You manage tamper protection centrally. In the Defender portal go to Settings → Endpoints → Advanced features → Tamper protection and choose On (recommended) . In Intune, the toggle lives in the endpoint security → Antivirus policy under Microsoft Defender Antivirus configuration . On Windows 10 1903 and later, tamper protection is on by default for consumer machines; enterprises should verify it is on in their policy baseline.

Tamper protection is the single most commonly tested Defender feature on the MS-102 exam because it directly addresses the social-engineering pattern where an attacker convinces a user to run a PowerShell snippet that turns Defender off.

Attack Surface Reduction (ASR) Rules

ASR rules are a curated set of behavior-based policies that block the techniques attackers use early in the kill chain: credential theft, lateral movement, Office macro shell execution, and obfuscated script launching. Microsoft publishes a documented set of rules; each rule has a GUID and three states.

ASR Rule States

• State Behavior
• Not configured Rule is off
• Audit Rule matches are logged but not enforced — use this to measure impact
• Block Rule matches are blocked and an alert is generated
• Warn (Selected rules only) End users see a toast and can bypass
• Operational Workflow

Deploy in audit mode for at least 30 days across a representative device group.

Review audit events in Reports → Attack surface reduction and in advanced hunting (the DeviceEvents table, ActionType starting with Asr ).

Flip to block group-by-group, monitoring helpdesk tickets for false positives.

Exclude specific paths or signers where a line-of-business app triggers a legitimate match.

Common ASR rules that produce false positives in enterprises include Block Office applications from creating child processes (breaks document-generated PDFs) and Block execution of potentially obfuscated scripts (breaks some packaged scripts). Test before you flip to block.

Controlled Folder Access

Controlled folder access is Defender's anti-ransomware feature. It blocks untrusted processes from writing to protected folders (Documents, Pictures, Favorites, and any custom paths you add). Trusted apps are determined by reputation and signer; you can also pre-allow apps via path or certificate.

Configure controlled folder access in Intune under endpoint security → Attack surface reduction → Controlled folder access , or via the Defender portal advanced features toggle. Like ASR, it supports audit , block , and warn modes. Audit first — controlled folder access can stop backup agents and line-of-business apps from writing to the Documents folder.

Web Content Filtering

Web content filtering blocks categories of websites (for example Adult , High bandwidth , Legal liability , Leisure ) at the endpoint level. The protection is enforced by the network protection component of Defender, so it works even when the device is off the corporate network. You create a policy in the Defender portal under Settings → Endpoints → Web content filtering , choose categories, and assign it to device groups. Browser-agnostic — it inspects the network request, not the browser process.

Microsoft Defender Antivirus Exclusions and Updates

Defender Antivirus supports path, file extension, process, and file type exclusions. Configure exclusions via Intune endpoint security → Antivirus policy or via Group Policy. The MS-102-relevant best practice is to scope exclusions narrowly and review them quarterly — broad exclusions are a leading cause of missed detections.

Signature and platform updates come from Microsoft Update, the Microsoft Malware Protection Center (MMPC), or a UNC file share for air-gapped networks. Configure the update source and fallback order under endpoint security → Antivirus → Updates in Intune.

Cross-Platform Configuration

Defender for Endpoint is cross-platform, but the configuration surface differs by OS:

• OS Antivirus Policy ASR Rules Tamper Protection
• Windows 10/11 Intune / GPO / Defender portal All rules supported Centrally managed
• Windows Server Intune / GPO / Defender for Cloud All rules supported Centrally managed
• macOS Intune / Jamf / mdatp CLI Subset of rules Centrally managed
• Linux Intune / Ansible / Puppet / mdatp CLI Not applicable Centrally managed
• iOS / Android Mobile threat defense via Intune Not applicable N/A (no AV engine)

On macOS and Linux, antivirus exclusions use mdatp exclusion CLI or the configuration profile deployed through the MDM. ASR rules are Windows-only today.

Reporting: Device Inventory and Device Health

Two reports matter for ongoing operations:

Device inventory ( Assets → Devices ) lists every onboarded and discovered device with onboarding state, risk level, and exposure level.

Device health ( Reports → General → Device health ) shows sensor health, antivirus health, and OS update status. Filter by No sensor data , Impaired communication , or Impaired but no telemetry to find devices that are not reporting correctly.

Use these reports weekly. Devices that stop reporting are effectively blind spots in your detection coverage.