Protect devices · Topic 1 of 6
Antivirus, Disk Encryption and Firewall Policies
MD-102 endpoint security: Intune antivirus policies and exclusions, BitLocker and FileVault disk encryption with recovery keys, and Windows firewall policies.
- 5 min
- Defender checks for updates every 8 hours by default. Exclusions from the two antivirus policy types are merged.
- BitLocker policies can save keys to Entra ID and rotate them after use. The Rotate BitLocker recovery key action needs a policy with rotation enabled.
- A tenant setting in Entra ID can restrict standard users from reading their BitLocker keys.
What it is
Intune's Endpoint security area holds focused policies for security teams: antivirus, disk encryption and firewall, among others. They differ from general configuration profiles, because they are organised by security task and use the same settings the platform security tools expect. This page covers the three core policy types and how to manage encryption keys.
How it works
Antivirus policies
Create them under Endpoint security, Antivirus, Create policy, choosing Windows or macOS, then a profile.
| Profile | Use |
|---|---|
| Microsoft Defender Antivirus | Scan schedules, real time protection, cloud protection, remediation and update frequency |
| Microsoft Defender Antivirus exclusions | Paths, extensions and processes that Defender skips |
| Defender Update controls | Channels for the engine, platform and security intelligence updates |
| Windows Security experience | What users see in the Windows Security app |
Facts to remember:
- Defender checks for security intelligence updates every 8 hours by default, and 4 hours is the recommended value.
- Exclusions from the antivirus policy and the exclusions policy are merged into a superset. Use the exclusions profile, assigned to only the groups that need them, because every exclusion weakens protection.
- The Update Microsoft Defender Antivirus security intelligence remote action fetches definitions on demand, without a scan.
Disk encryption policies
Endpoint security, Disk encryption has policies for BitLocker (Windows) and FileVault (macOS).
BitLocker policy
- Choose the encryption method and strength for operating system and data drives, and whether to encrypt silently. For silent encryption, devices need a TPM, and Entra joined or hybrid joined devices can store the recovery key.
- Settings include require device encryption, allow standard users to enable encryption during Autopilot (so a standard user can still be encrypted silently), the recovery password format and save recovery information to Microsoft Entra ID.
- Client driven recovery password rotation can be enabled for Entra joined, or Entra and hybrid joined devices, so a key rotates after use. It works only when the recovery information is saved to Entra ID or Active Directory.
- Entra ID stores up to 200 recovery keys per device, and silent encryption fails past that.
Managing recovery keys
| Task | How |
|---|---|
| View a key | Device, Recovery keys in the admin center, or Entra ID. Reading it is audited |
| Rotate a key | The Rotate BitLocker recovery key remote action. It needs the Rotate BitLockerKeys right and a policy with rotation turned on |
| Self service | Users can read their own keys in the Company Portal or My Account. Set the Entra device setting Restrict non-admin users from recovering the BitLocker keys to Yes to stop this, and combine with Conditional Access that needs a compliant device |
| Monitor | Devices, Monitor, Encryption report (device encryption status). It can take up to 24 hours to update. Failure reasons include recovery key backup failure |
FileVault policy: enable FileVault, choose whether to defer enablement, and set personal recovery key rotation from 1 to 12 months. Intune escrows the key, and admins can view it for corporate devices only, and rotate it with a remote action. Users on personal Macs cannot have their keys viewed by an admin.
Firewall policies
Endpoint security, Firewall has two policy types for Windows (and a macOS firewall policy).
| Profile | Purpose |
|---|---|
| Microsoft Defender Firewall | The firewall itself: turn it on per network profile (domain, private, public), default inbound and outbound actions, stealth mode |
| Microsoft Defender Firewall rules | Granular rules for ports, protocols, programs, networks and direction |
Rules can allow or block traffic and are set per profile. Multiple policies can target one device, and conflicting values cause conflicts, so keep one source of truth for each setting. These policies also work for devices managed by Defender for Endpoint security settings management, with no Intune enrollment.
Policy merging and conflicts
Endpoint security policies support multiple instances on one device. Settings that do not conflict merge. Settings that conflict are reported as a conflict. Check the policy's Per setting status, and avoid defining the same setting in a configuration profile and an endpoint security policy.
A worked scenario
A hospital requires encryption on every laptop and tight control of exclusions. The security team creates a BitLocker policy with silent encryption, recovery keys saved to Entra ID and client driven rotation. A Defender Antivirus exclusions policy for the imaging software goes only to the radiology group. When an engineer reads a key to unlock a laptop, the admin uses Rotate BitLocker recovery key so the exposed key is no longer valid. The Encryption report shows three laptops where the key backup failed.
What to remember for the exam
- Defender checks for updates every 8 hours by default. Exclusions from the two antivirus policy types are merged.
- BitLocker policies can save keys to Entra ID and rotate them after use. The Rotate BitLocker recovery key action needs a policy with rotation enabled.
- A tenant setting in Entra ID can restrict standard users from reading their BitLocker keys.
- FileVault keys rotate on a 1 to 12 month schedule, and admins see keys only for corporate devices.
- Firewall has two profiles: the Defender Firewall settings and the Firewall rules.
To stop an exposed recovery key from being useful, rotate it. Do not decrypt the device.
How the exam asks about this
- "Exclude one folder from scanning for one group only." An antivirus exclusions policy assigned to that group.
- "Check how many laptops are encrypted and why some failed." The Encryption report.
- "A BitLocker key was shared with a user." Rotate the BitLocker recovery key.
- "Block inbound traffic on one port for all Windows devices." A firewall rules policy.
Common mistakes
Putting broad exclusions in the main policy. Use the exclusions profile.
Expecting rotation without enabling it in the policy. The action will fail.
Mixing configuration profiles and endpoint security policies for the same setting.
Assuming admins can read keys on personal Macs. They cannot.
Check yourself
How often does Defender check for security intelligence updates by default?
Every 8 hours.
What remote action makes an exposed BitLocker key useless?
Rotate BitLocker recovery key.
Which Firewall profile defines granular allow and block rules?
Microsoft Defender Firewall rules.
Topic 1 of 6 in Protect devices
Test yourself on Protect devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.