Intune security best practices

Intune security has two halves. The first is the policy Intune pushes to devices: compliance, encryption, antivirus, firewall, updates. The second is Intune itself: who can change that policy, and who can wipe, retire, or delete devices at scale. The sections below cover both, ordered roughly by impact.

1. Write compliance policies that actually describe a healthy device

A compliance policy is only as useful as what it requires. A policy that marks a device compliant because it checked in recently tells Conditional Access nothing. Require the properties that separate a protected Windows device from an exposed one:

• Boot and platform integrity: Secure Boot, a TPM, BitLocker, Code Integrity, Early Launch Anti-Malware, and, on capable hardware, Virtualization-Based Security and Memory Integrity (HVCI).
• Antivirus state: Microsoft Defender Antivirus required, real-time protection on, signatures current, and a minimum engine version.
• Operating system floor: a minimum OS version, so an unpatched build cannot claim compliance. Avoid a maximum OS version unless you mean to block upgrades.
• Local password rules on devices that still use them: required, not simple, a sensible minimum length, and a short idle lock.
• Microsoft Defender for Endpoint risk: require the device to be at or under a machine risk score you choose, so a device Defender considers compromised loses compliance automatically.

2. Make compliance count in Conditional Access

Compliance only protects data when Conditional Access acts on it. Require a compliant device for Microsoft 365 and other sensitive applications, and treat administrators as the first group that must meet it: an admin session from a non-compliant device is the highest-risk combination in the tenant. Also cover device code flow, a sign-in method attackers use for phishing that is easy to leave outside every policy, and use a time-based sign-in frequency for non-compliant devices rather than letting a session live indefinitely.

3. Keep enrollment and device inventory clean

Every device that can sign in should be managed, owned, and current. Unmanaged devices bypass every policy in this guide. Devices registered to disabled users, devices with no owner, and devices that stopped checking in months ago are how stale access survives. Rooted and jailbroken phones defeat the operating system's own protections. Out-of-support operating systems no longer receive security fixes at all.

• Require enrollment for corporate data and decide deliberately whether personal devices may enroll.
• Retire devices that have not signed in within your stale threshold, and reassign devices owned by departed users.
• Set minimum OS versions per platform (Windows, macOS, iOS, Android) and act on devices below them.

4. Encrypt every drive with BitLocker, and keep recovery under control

A lost laptop without full-disk encryption exposes everything on its drive. Use an Intune disk encryption policy to require BitLocker on the operating system drive and fixed data drives, choose the encryption method per drive type (XTS-AES for internal drives), and decide how removable drives are handled. Escrow recovery keys to Entra ID and turn on recovery password rotation, so a key read during a support call stops working afterwards. Where the threat model includes physical access, require a pre-boot PIN with a sensible minimum length.

5. Configure Microsoft Defender Antivirus fully

Defender Antivirus is on by default, but several of its strongest protections depend on policy. Use an Intune antivirus policy to turn on real-time protection, cloud-delivered protection, behavior monitoring, script scanning, and scanning of email, archives, network files, and removable drives. Enable potentially unwanted application blocking and automatic sample submission so cloud protection can make decisions quickly. Then confirm devices report what the policy says: a policy is not proof that protection is running. Our Microsoft Defender security best practices guide goes further on Defender itself.

6. Turn on attack surface reduction rules

Attack surface reduction (ASR) rules stop the behaviors ransomware and commodity malware depend on: Office apps spawning child processes, macros calling Win32 APIs, scripts launching downloaded executables, credential theft from LSASS, and persistence through WMI. Microsoft identifies three rules as standard protection that rarely affect legitimate work: block abuse of exploited vulnerable signed drivers, block credential stealing from LSASS, and block persistence through WMI event subscription. Turn those on in block mode first. Deploy the rest in audit mode, review what they would have blocked, add narrow exclusions, then switch to block. Add Controlled Folder Access to protect documents from ransomware encryption.

7. Enforce Windows Firewall on all three profiles

Windows Firewall has separate Domain, Private, and Public profiles, and a device moves between them as it changes networks. Enable all three, set the default inbound action to Block, and on the Public profile do not merge local firewall rules or IPsec exemptions, which lets a local administrator or a piece of software open ports that your policy closed. Log dropped packets so an investigation has something to read.

8. Control which applications can run

App Control for Business (formerly Windows Defender Application Control) lets only trusted software run. Two settings make it practical for most organizations: trust apps installed by a managed installer, so software Intune deploys is allowed automatically, and trust apps with good reputation through the Intelligent Security Graph. Start in audit mode, then enforce; a policy left in audit mode allows everything.

9. Manage updates with rings, profiles, and Autopatch

Patching through Intune is a set of policies, and each can be missing, unassigned, or paused. Use Windows Update for Business update rings with a short quality-update deferral as a test window, never zero and never paused for long. Add feature update profiles pinned to a supported Windows version with a gradual rollout, quality update profiles that can expedite an emergency patch, and driver update profiles with review rather than automatic approval. Assign every profile to a group that actually has members: a ring assigned to an empty group updates nothing and reports no error.

Then measure the outcome rather than the policy. Senserva checks each managed device against the KB articles that fix known exploited, Critical, and High CVEs, so you see which devices are still missing the fix for a vulnerability under active attack. The Microsoft patch tracker shows the same data for every release.

10. Turn on tamper protection

Tamper protection stops local administrators, scripts, and malware from turning off Defender Antivirus protections. Attackers routinely try to disable antivirus before deploying ransomware, so this one setting removes a whole stage of a typical intrusion. Manage it from Intune or the Defender portal, and keep the Windows Security app's ransomware data recovery visible to users.

11. Least privilege inside Intune, and approval for destructive actions

An Intune administrator can wipe, retire, or delete every managed device, run scripts on all of them, and rewrite the security baseline. That makes Intune administration as sensitive as Global Administrator. Treat it that way:

• Use scoped roles. Prefer built-in roles, restrict each role with scope tags rather than global scope, and remove roles with no active assignments.
• Review custom roles for destructive permissions (wipe, retire, delete) and for permissions that let a role holder grant themselves more access.
• Require a second administrator for device wipe, retire, and delete, and for tenant configuration changes, with Intune Multi Admin Approval access policies that name real approver groups. An approval policy with no approvers cannot gate anything.
• Protect the admin accounts themselves with phishing-resistant MFA and PIM, as covered in the Entra ID guide.

12. Audit Intune changes and catch drift

Security-relevant Intune objects (compliance policies, configuration profiles, update rings) change over time, sometimes for a good reason and sometimes not. Review Intune audit events for deletions and modifications of security policy, and compare current settings with the baseline you approved. Senserva reports security-relevant Intune changes from the last 30 days, and configuration drift management covers keeping a tenant on its baseline.

Our MISA-approved Microsoft Intune integration

Every Intune check in this guide runs through that approved integration. Here is how the 234 Intune and device checks break down:

Approved area	What Senserva reads through Microsoft's own APIs	Checks
Compliance policies	Required device properties: boot integrity, encryption, antivirus state, OS floor, local passwords, Defender risk	35
Configuration profiles	Defender Antivirus, attack surface reduction, firewall, application control, and Windows Security settings	79
Encryption	BitLocker policy for operating system, fixed, and removable drives, and recovery handling	22
Update rings	Update rings, feature, quality and driver profiles, Windows Autopatch, and missing patches per device	36
Intune administration	RBAC roles, Multi Admin Approval policies, and audit events for security policy changes	14
Managed devices and apps	Per-device state (compliance, ownership, staleness, OS support, Defender protection, vulnerabilities) and Win32 app deployment	48

The audit reads your tenant read-only and least privilege, so running it changes no policy and no device; each finding comes with a proposed fix for you to review. The Microsoft partnership page covers what MISA membership means and our approved Entra ID integration.

Frequently asked questions

Require a compliant device in Conditional Access, with a compliance policy that checks real protection: BitLocker, Secure Boot, Microsoft Defender Antivirus with real-time protection, and a minimum OS version. Without that link, Intune policy describes devices but does not protect data.

Scope Intune roles with scope tags, remove destructive permissions from roles that do not need them, protect admin accounts with phishing-resistant MFA and PIM, and configure Intune Multi Admin Approval so device wipe, retire, and delete require a second administrator from a named approver group.

Block, after a short audit period. Turn on the standard protection rules (vulnerable signed drivers, LSASS credential theft, WMI persistence) in block mode first, run the rest in audit mode long enough to find legitimate exceptions, then switch them to block.

Briefly. A few days of deferral gives a test ring time to catch a bad update, while zero deferral removes the test window and long deferrals or pauses leave devices exposed to vulnerabilities already being exploited.

Senserva is a member of the Microsoft Intelligent Security Association (MISA) with an approved Microsoft Intune integration for device management, and an approved Microsoft Entra ID integration for identity and access. MISA membership is invitation-only and requires technical validation.

Next: read the Entra ID security best practices and Microsoft Defender security best practices guides, or scan your own tenant free.