Attack Surface Reduction, Security Baselines and App Control

What it is

Three Intune features harden Windows devices. Attack surface reduction (ASR) rules block behaviours that malware often uses. Security baselines are Microsoft's recommended groups of settings that you deploy as a template. App Control for Business (formerly Windows Defender Application Control) decides which apps may run. All three apply the Zero Trust idea of assuming breach and limiting what can happen if something gets in.

How it works

Attack surface reduction

ASR rules are in Microsoft Defender for Endpoint features and are deployed with an Attack surface reduction endpoint security policy (Endpoint security, Attack surface reduction, then the Attack surface reduction rules profile). Each rule has a mode.

Recommended rollout:

1. Enable the standard protection rules in Block mode, because Microsoft recommends them without extensive testing.
2. Put other rules in Audit, review the ASR report, advanced hunting or event IDs (1122, 1125, 1132, 1134), then switch to Block or Warn.
3. Add per rule exclusions for known good software, rather than turning rules off.

Other settings in the ASR family cover application control and app and browser isolation, device control (USB), exploit protection and web protection (network protection). If the same rule is set to different modes in different policies, it conflicts. ASR rules merge across the baseline, the ASR policy and a settings catalog profile, so check all three when behaviour is inconsistent. Applying Zero Trust principles means using least privilege and assuming breach, so block by default and allow by exception.

Security baselines

A security baseline is a preconfigured group of settings, with the recommended values from the product teams. Intune offers baselines for:

• Windows (the MDM security baseline, with versions such as the 25H2 and 26H2 releases).
• Microsoft Defender for Endpoint (best for physical devices, not VMs or VDI).
• Microsoft Edge.
• Microsoft 365 Apps for Enterprise.
• Windows 365 and HoloLens, plus STIG audit baselines.

Create a profile under Endpoint security, Security baselines, choose the baseline and its version, adjust settings and assign. Important behaviour:

• Existing profiles do not update themselves when a new baseline version arrives. Settings in older profiles become read only, though you can edit the name, description and assignments.
• Use Change version to move to the latest version only (you cannot choose an older one). Intune makes a copy of the profile without assignments, and offers to keep your customizations or reset to defaults, and Review update gives a CSV of differences. Test on a pilot group first.
• Use either a baseline or endpoint security policies for the same setting, not both. When a setting is in a baseline and a compliance policy, the compliance policy value wins.
• To find conflicts, open the baseline, Profiles, the profile, Device status, and the per setting status, which lists conflicting source profiles.

App Control for Business

App Control allows only trusted apps to run. Create it under Endpoint security, Application control (App Control for Business policies). Anything not explicitly allowed is blocked unless the policy is in audit mode.

Managed installer: enabling it makes the Intune management extension a trusted installer. Apps you deploy through Intune are tagged, and a policy that trusts managed installers lets them run. It needs the Intune Administrator role to enable. Tagging is not retroactive, so apps installed before enabling the managed installer are not tagged, and you must allow them explicitly.

Rollout: start in Audit only, which allows everything and logs what would be blocked in the local client logs, review the events, then enforce. A restart can be required, which can interrupt Autopilot.

Choosing the control

A worked scenario

A company wants only Intune deployed apps and Windows to run on its kiosks. The admin creates an App Control for Business policy with built in controls, trusts Windows components and Store apps and managed installers, and sets Audit only first. After two weeks of logs show nothing legitimate blocked, she removes audit. For the same fleet she assigns the standard protection ASR rules in Block mode, tests the others in Audit, and updates the Windows security baseline to the latest version on a pilot group.