Endpoint security policies are the automated rulebooks that tell every device in a company how to protect itself from viruses, unauthorised access, and sneaky software exploits. For the MD-102 exam, you must understand how to configure the three main pillars of these policies — antivirus, firewall, and attack surface reduction — because a single misconfigured device can be the entry point for a ransomware attack that cripples an entire organisation.
Jump to a section
A simple way to picture Securing Devices with Endpoint Security Policies
Seven years of living in a two-flat building taught me exactly how endpoint security policies work. My downstairs neighbour, a hospitable sort, left their front door unlocked and their windows wide open all summer. I lived upstairs and treated our shared building like a fortress — deadbolt, security chain, and a loud hall light on a timer.
Our building was one device, but my flat and my neighbour's flat were two different users. I wanted to block everything dangerous — that is my antivirus policy. I wanted to know who came and went through the shared door — that is my firewall policy. And I wanted to stop my neighbour from accidentally running a dodgy "free pizza" flyer straight into my kitchen — that is my attack surface reduction policy.
One night someone walked right into their flat and stole their laptop. My flat was untouched. The building manager then applied my security rules to the whole building. Now every flat must have a deadbolt, a security chain, and a timed light. The manager is Microsoft Intune. The building-wide rule set is the endpoint security policy. Each flat's compliance is checked every night. If a flat disables its deadbolt, the building manager locks the flat remotely until it complies.
An endpoint is any device that connects to your company network — a laptop, a desktop, a phone, a tablet, even a server. Think of each endpoint as a single soldier in an army. One soldier with a broken radio or a missing helmet weakens the whole platoon. Endpoint security policies are the headquarters orders that ensure every soldier has the same standard issue gear and follows the same procedures.
Before Microsoft Intune and modern management tools, IT administrators had to configure each device manually or use clunky scripts that often failed or conflicted. If a user disabled their antivirus because it slowed down their game, the IT team rarely knew about it until after a malware infection. Endpoint security policies solve this by centralising control and enforcing compliance automatically.
There are three main policy types covered by the MD-102 exam objectives for endpoint security policies:
Antivirus policies: These configure Microsoft Defender Antivirus. They define how often to scan files, what to do when malware is found (quarantine it, delete it, or allow it), and whether to use cloud-delivered protection which checks files against Microsoft's massive threat database in real time. You control settings like real-time protection (always on scanning), scheduled scans (daily at 3am), and exclusion lists (paths or file types you trust).
Firewall policies: These configure Microsoft Defender Firewall. A firewall is a digital bouncer that decides which network traffic is allowed in and out of a device. You create rules based on source IP address, destination port (like port 443 for HTTPS web traffic), and application path (allow only the company's custom app to talk to the internet). You can block all inbound traffic by default and only allow specific outbound connections.
Attack surface reduction (ASR) policies: These are the most granular and powerful. Attack surface refers to all the places where malware could sneak into a device — USB drives, email attachments, scripts run from word documents, browser downloads. ASR rules block specific behaviours that malware commonly uses. For example, one rule prevents Office applications from creating child processes (Excel can't launch a command prompt). Another rule blocks executable files from running unless they meet a specific reputation or prevalence criteria. These rules don't just detect malware — they prevent the conditions that allow malware to work.
How do you actually apply these policies? In the Microsoft Intune admin centre, you navigate to Endpoint Security and create a policy. You choose the platform (Windows 10/11, macOS, iOS, Android) and the profile type (Antivirus, Firewall, or Attack Surface Reduction). Then you configure the settings — turning real-time protection on, blocking inbound ports 445 and 139 (common for worms), blocking executable content from email and webmail clients. Finally, you assign the policy to groups of users or devices. Intune then communicates with the Microsoft Defender client on each device to apply and enforce the settings. If a user changes a setting locally, the policy re-applies on the next check-in, usually every 8 hours.
Why does the exam care about this? Because modern cyber attacks do not exclusively target servers. They target users. A salesperson clicking a phishing link on their laptop is an endpoint compromise. A contractor plugging an infected USB drive into a company kiosk is an endpoint compromise. Endpoint security policies are your automated defence against these vectors. The MD-102 exam tests your ability to select the correct policy type for a given scenario, configure the settings correctly, and understand what happens when multiple policies conflict — the most restrictive setting wins.
Navigate to Endpoint Security in the Intune admin centre
Go to https://intune.microsoft.com and select Endpoint Security from the left menu. This is the central hub for all security policies including antivirus, firewall, and attack surface reduction. Do not confuse it with Device Configuration policies which manage settings like Wi-Fi or BitLocker.
Select the policy type (Antivirus, Firewall, or Attack Surface Reduction)
Click on the corresponding tab at the top — Antivirus, Firewall, or Attack Surface Reduction. Each tab shows existing policies and lets you create a new one. The exam will test your ability to choose the correct tab for the task. For example, blocking a script from running belongs in Attack Surface Reduction, not Antivirus.
Create a new policy and choose a platform and profile
Click 'Create Policy'. Choose the platform (e.g. Windows 10 and later) and the profile (e.g. Microsoft Defender Antivirus). Each profile contains a specific set of settings. The profile name determines which settings you can configure. Selecting the wrong profile is a common exam trap.
Configure the specific settings and set each to the required state
Toggle settings like Real-time protection = On, Cloud-delivered protection = On, Scheduled scan day = Every day, Time = 12:00. For ASR rules, set each rule to Block, Audit, or Not configured. Do not leave critical rules unconfigured. The exam will give you a scenario and you must know exactly which toggle to flip.
Assign the policy to groups and finalise
On the Assignments tab, select the Azure AD group (or groups) that should receive this policy. You can assign to user groups or device groups. Click Next and Create. The policy will be applied to targeted devices during their next check-in cycle. To force immediate application, select a device in Intune and click Sync.
Monitor policy deployment and review reports
After assignment, go to the policy's overview page and check the Device status and User status. This shows how many devices have successfully applied the policy and which ones have errors. Use the Antivirus reports under Endpoint Security > Antivirus to see detected malware and scan results.
Let us walk through a realistic Friday afternoon at a mid-sized logistics company called "ShipFast Logistics" with 500 Windows laptops and 200 iPads used by warehouse staff.
At 2pm, the IT manager receives an alert from Microsoft 365 Defender. Three distinct malware detections have occurred on three different laptops in the sales department within the last hour. All three were PDF files opened from email attachments. The PDFs launched a PowerShell script that tried to connect to a suspicious IP address in Eastern Europe.
The IT manager does the following step-by-step:
She opens the Microsoft Intune admin centre and navigates to Endpoint Security > Attack Surface Reduction.
She views the existing ASR rules. She sees that the rule "Block executable content from email and webmail clients" is set to "Not configured" — a common default.
She creates a new ASR policy for Windows 10 and later devices. She enables the following rules:
- Block executable content from email client and webmail (GUID: be9ba2d9-53ea-4cdc-84e5-465a8d94c2e7) - Block Office applications from creating child processes (GUID: d4e940f7-e5e4-4f6e-8e3f-9f7e8c9a1b2c) - Block PowerShell scripts from running from Office apps (GUID: 3b576869-a4ec-4529-8536-b80a7769e899) 4. She sets each rule to "Block" mode — meaning the action is not just audited, it is actively prevented. 5. She assigns the policy to the "Sales - Windows Devices" Azure AD group. 6. Next, she creates a firewall policy to block outbound connections on port 445 (SMB) from all endpoints, since the malware tried to spread laterally via network shares. She creates a rule: "Block outbound SMB" with action = Block, protocol = TCP, remote port = 445. 7. She assigns this firewall policy to the "All Windows Devices" group. 8. Finally, she reviews the antivirus policy. She notices cloud-delivered protection is enabled, but the scheduled scan runs only at 2am when many laptops are in sleep mode. She changes the scheduled scan to occur at 12pm daily and enables "Scan network files" since the malware tried to access network shares. 9. She then forces a sync by selecting the three affected laptops in Intune and clicking "Sync" to apply policies immediately.
Within 15 minutes, the policies are applied. The next attempted PDF attack is blocked by the ASR rule — the user sees a notification "This action is blocked by your IT administrator." The firewall rule prevents any compromised machine from communicating with the command-and-control server. The antivirus policy catches any lingering malware during the afternoon scan.
In the real world, an IT professional would also create reporting alerts. They would configure Endpoint Detection and Response (EDR) to automatically isolate a device if a high-severity alert triggers. They would use compliance policies to require that all these security settings are enabled before a device can access corporate email. The MD-102 exam expects you to know how to configure each of these policy types and how they interact. You do not need to memorise GUIDs for the exam, but you must know the purpose of each rule family.
The MD-102 exam tests section 4.3 with a heavy emphasis on scenario-based questions. You will be given a business requirement — "Sales users need to run a legacy accounting app that writes to the registry" — and asked which ASR rule to exclude or which antivirus exclusion path to configure. The traps are subtle, and Microsoft expects you to know the exact behaviour of each policy component.
Here is what you absolutely must know for the exam:
Policy types and profile names: The exam loves to test your ability to match a requirement to the correct profile within Endpoint Security. For antivirus, the profiles are "Microsoft Defender Antivirus" (Windows) and "Microsoft Defender for Endpoint" settings. For firewall, the profiles are "Microsoft Defender Firewall" with domain, private, and public profiles. For ASR, the profile is "Attack Surface Reduction Rules" with a list of specific rules. You must know that ASR rules are configured in Endpoint Security, not in Device Configuration profiles.
The hierarchy of conflict: If a device receives two policies that configure the same setting (e.g., one says block PowerShell, the other says allow), the most restrictive setting wins. This is a critical exam principle. Microsoft Intune resolves policy conflicts for security settings by using the strictest value.
ASR rule GUIDs and their exact function: The exam may not ask for the GUID itself, but it will describe a scenario and ask which ASR rule is relevant. For example: "Block Office applications from creating child processes" prevents Excel from launching cmd.exe. "Block executable content from email and webmail clients" prevents .exe files attached to emails from running. "Block Office applications from injecting code into other processes" prevents malware that tries to hide inside a trusted application. You must be able to distinguish these rules.
Exclusions and when to use them: The exam will present a legitimate business application that triggers a false positive in Defender Antivirus. You must know to add a file or folder exclusion, not to disable real-time protection entirely. Exclusions can be file extensions, folder paths, or process names. They must be as narrow as possible for security reasons.
Firewall rule profiles: The MD-102 exam tests the difference between Domain, Private, and Public firewall profiles. Domain profile applies when the device is connected to the corporate domain network. Private profile applies when the device is on a trusted home or work network marked as private. Public profile applies to untrusted networks like coffee shop Wi-Fi. Rules can be set per profile.
Common wrong answers: A classic trap is choosing to configure antivirus settings in a Device Configuration profile instead of Endpoint Security. Another trap is selecting "Audit mode" for an ASR rule when the scenario requires "Block mode". Audit mode only logs events without blocking — it is for testing before enforcement. The exam will describe a breach that occurred because a rule was in audit mode, and ask you to identify the fix.
Memorise this list of exam-critical concepts:
Real-time protection vs cloud-delivered protection vs scheduled scan
ASR rule modes: Not configured, Block, Audit, Warn
Firewall default behaviours: Block inbound, allow outbound
Policy assignment to groups vs all devices
The difference between Endpoint Security policies and Compliance policies
How to force a policy sync from Intune
Endpoint security policies in Microsoft Intune centralise configuration of antivirus, firewall, and attack surface reduction settings across all managed devices.
Attack surface reduction rules block specific malware techniques like Office apps launching scripts or executable content from email, even before antivirus scans the file.
When multiple policies conflict for the same setting, the most restrictive value always wins — this is a critical rule for Intune policy resolution.
A firewall policy has three profiles (Domain, Private, Public) and blocks unsolicited inbound traffic by default while allowing outbound traffic.
Cloud-delivered protection in Defender Antivirus provides near-instant detection of new malware by checking files against Microsoft's dynamic threat intelligence database.
You should never disable real-time protection to improve performance; instead, configure narrow file or folder exclusions for specific trusted applications.
Policy changes are not instant — devices check in every 8 hours by default, and you can trigger a manual sync from Intune to apply urgent changes faster.
Audit mode for ASR rules is for testing only; production environments should use Block mode to actively prevent malicious behaviour.
Endpoint security policies are separate from compliance policies — security policies configure settings, while compliance policies check if those settings are in place and block devices that fail.
The exam uses scenario-based questions where you must select the correct ASR rule or firewall rule based on a real-world threat description.
These come up on the exam all the time. Here's how to tell them apart.
Attack Surface Reduction (ASR) Rule
Blocks malicious behaviour before it executes (e.g., prevents Excel from launching a script)
Does not rely on malware definitions; it blocks techniques
Configured in Endpoint Security > Attack Surface Reduction
Antivirus Scan
Detects and removes malware after it runs or when a file is written to disk
Relies on updated malware definitions and cloud intelligence
Configured in Endpoint Security > Antivirus
Block Mode (ASR)
Actively prevents the blocked action and shows a notification to the user
Suitable for production environments after testing
May break legitimate applications if rules are too broad
Audit Mode (ASR)
Only logs the event without blocking anything
Used for testing and evaluating impact before enforcement
Does not disrupt users but does not protect either
Inbound Firewall Rule
Controls traffic initiated by external sources connecting to the device
Default behaviour is to block all unsolicited inbound traffic
Commonly used to block remote desktop or SMB from the internet
Outbound Firewall Rule
Controls traffic initiated by the device to external destinations
Default behaviour is to allow all outbound traffic
Used to block malware from calling home or connecting to malicious servers
Device Configuration Policy (Intune)
Manages settings like Wi-Fi, VPN, certificates, and BitLocker
Found under Devices > Configuration profiles
Used for general device management, not security-specific settings
Endpoint Security Policy (Intune)
Manages antivirus, firewall, and attack surface reduction settings
Found under Endpoint Security in the admin centre
Used specifically for security configuration and threat prevention
Mistake
If I just turn on Microsoft Defender Antivirus, that is enough endpoint security.
Correct
Antivirus is only one layer. Attack surface reduction and firewall policies are equally important because they prevent the conditions that allow malware to run in the first place.
Many beginners think antivirus catches everything, but modern malware often uses fileless techniques (like running from memory or scripts) that a traditional AV scan may miss. ASR rules block those execution methods.
Mistake
Attack Surface Reduction rules only apply to Windows 10 or 11 Pro editions.
Correct
ASR rules are available on Windows 10 and 11 Enterprise, Education, and Pro editions, but some advanced rules like controlled folder access require Enterprise or Education licenses.
This mistake comes from confusing ASR with other security features that are exclusive to Enterprise editions. The exam may test whether you know which editions support ASR.
Mistake
Once I assign an endpoint security policy, it applies instantly to every device.
Correct
Policies apply during the device check-in cycle, which occurs every 8 hours by default (or more frequently if the device is online and the user signs in). You can force a sync manually via Intune but it is not automatic.
Users expect changes to take effect immediately, so beginners assume the same. The exam tests your understanding of the timing and the sync mechanism.
Mistake
A firewall policy that blocks all inbound traffic is too restrictive and will break most applications.
Correct
Windows Firewall blocks all unsolicited inbound traffic by default. Most common applications (web browsing, email, file sharing) initiate outbound connections, which are allowed by default. Only applications that need to receive unsolicited inbound traffic (like a print server or remote desktop) require an explicit inbound allow rule.
This misconception arises from confusing inbound and outbound rules. Beginners often think blocking all inbound traffic will break everything, but in reality it is a security best practice that rarely affects normal user workflows.
Mistake
Endpoint security policies apply only to Windows devices.
Correct
Microsoft Intune supports endpoint security policies for Windows, macOS, iOS/iPadOS, and Android devices, though the specific settings differ per platform.
The MD-102 exam focuses heavily on Windows, so candidates forget that mobile devices also need protection. The exam may test your ability to configure a policy for a macOS device.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Endpoint security policies are specifically for antivirus, firewall, and attack surface reduction settings. Device configuration policies manage everything else like Wi-Fi profiles, BitLocker encryption, and browser settings. For the exam, always use Endpoint Security for security settings and Device Configuration for general device settings.
No, policies in Intune are always assigned to groups. You cannot assign a policy directly to an individual user. To target one user, you must create a group containing only that user and assign the policy to that group.
The rule immediately switches from logging-only to actively blocking the behaviour. Before changing to Block mode, review the audit logs to ensure no legitimate business applications will be broken. The exam may test that Audit mode is for testing and Block mode is for enforcement.
By default, Windows Firewall blocks all unsolicited inbound traffic and allows all outbound traffic. Most environments only configure inbound blocking rules. You would only create outbound blocking rules for specific threats, such as preventing malware from connecting to a known malicious IP address.
In the antivirus policy, add a file path or file extension exclusion under the Exclusions section. For example, if your accounting software is in C:\Program Files\FinanceApp, add that path as an exclusion. Never use exclusions for entire drives unless absolutely necessary.
Policies are applied during the check-in cycle, which requires internet connectivity. If a device is offline for a long period, previously applied policies remain in effect. However, policy changes and cloud-delivered protection updates require internet access. Offline devices will still have local antivirus scanning with its last set of definitions.
You've finished Securing Devices with Endpoint Security Policies. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?