Configuring Windows Defender Policy on Windows Devices

Windows Defender is the built-in antivirus and threat protection suite on Windows 10 and 11. 

Mobile Guardian supports managing Windows Defender policy on enrolled devices through a dashboard-based approach using Windows MDM Settings, and through Intune configuration profiles for administrators who need more granular control. 

Both methods push settings through Microsoft Intune to enrolled devices.

What You Will Learn

• How Windows Defender policy maps to Profiles in Mobile Guardian
• How to configure Defender settings using the dashboard (Windows MDM Settings)
• How to configure Defender using the Intune Settings Catalog for advanced control
• How to verify Defender status on enrolled devices

Prerequisites

• Windows 10/11 Pro or higher
• Devices enrolled in Mobile Guardian via Microsoft Intune (see Windows OS Onboarding: Part 1)
• Admin access to the Mobile Guardian Dashboard
• Admin access to Microsoft Intune (for advanced configuration)

How Windows Defender Policy Fits Into Mobile Guardian Profiles

Windows Defender configuration in Mobile Guardian is applied at the profile level, not per-device. Defender policy is defined once and pushed to all Windows devices assigned to that profile.

Recommended profile structure for Defender:

Note: All devices will have a baseline profile applied. Use a conditional profile when Defender settings need to differ from the school-wide default.

Method 1: Dashboard-Based Configuration (Windows MDM Settings)

This method uses the built-in Windows MDM settings in the Mobile Guardian dashboard. It covers the most common Defender settings and is the recommended starting point for most schools.

Step 1: Access Windows MDM Settings

• Navigate to Settings in the left-hand menu
• Select Windows MDM Settings

Step 2: Configure Windows Defender Settings

Under the Security or Windows Defender section, configure the following:

Real-Time Protection

Scan Settings

Exclusions

Important: Only add exclusions when a known false positive is occurring with trusted software. Each exclusion reduces the protection surface. Document any exclusions added and review them periodically.

Step 3: Configure Firewall Settings

If firewall settings are available under Windows MDM Settings:

Step 4: Save and Apply

• Click Save Changes at the bottom of the Windows MDM Settings page
• The policy will be pushed to enrolled devices on their next Intune sync (typically within 15 minutes)

Method 2: Intune Settings Catalog (Advanced Configuration)

This method provides access to the full range of Windows Defender CSP settings through the Intune Settings Catalog. Use this when you need settings not exposed in the MG dashboard, or when deploying standardised security baselines across multiple tenants.

Step 1: Create a New Configuration Profile

Sign in to the Microsoft Intune Admin Centre and navigate to:

1. Devices
2. Manage Devices (drop-down)
3. Configuration
4. Create > New Policy

On the Create Profile window:

• Platform: Windows 10 and later
• Profile type: Settings catalog
• Click Create

Step 2: Complete the Basics

• Name: Enter a descriptive name (e.g. Mobile Guardian Windows Defender Policy)
• Description: Optional but recommended
• Click Next

Step 3: Add Defender Settings

Click Add settings and search for the following categories in the Settings picker:

Defender (Antivirus)

Search for Defender and add:

Firewall

Search for Firewall and add:

Click the X to close the Settings picker once all settings are added. Configure each setting to the values above.

Click Next.

Step 4: Skip Scope Tags

Click Next on the Scope Tags tab. No changes required.

Step 5: Assign to a Group

Under the Included groups section:

• Click Add groups
• Select the Azure AD group corresponding to your student or staff devices
• Click Next

Step 6: Review and Create

Review your settings and click Create. The policy will sync to enrolled devices within approximately 15 minutes of the next Intune check-in.

Step 7: Link Back to Mobile Guardian Profiles

Once the Intune policy is deployed:

• Navigate to Profiles in the Mobile Guardian left-hand menu
• Select the Baseline Profile (for school-wide enforcement) or the relevant Conditional Profile
• Under the What section of the profile, select restrictions 
• Confirm that Windows device settings are active for the assigned group
• The Intune policy will apply automatically to any device enrolled in the matching Azure AD group

Verifying Defender Status

From the Mobile Guardian Dashboard

• Navigate to Devices in the left-hand menu
• Select All Devices and locate the Windows device
• Click the eye icon to open the Device Information view
• Confirm the device is enrolled and active

Note: The Mobile Guardian dashboard confirms device enrolment status, not the state of individual Intune policies. Use Microsoft Intune to verify that Defender policy has been applied successfully.

From the Device Directly

On the Windows device:

1. Open Windows Security (search for “Windows Security” in the Start menu)
2. Select Virus & threat protection
3. Confirm:

• “Real-time protection is on”
• “Cloud-delivered protection is on”
• The last scan date and next scheduled scan time are shown

4. Select Firewall & network protection to confirm firewall is active on all profiles

From Microsoft Intune

Per-policy view:

1. Navigate to Devices > Configuration in the Intune Admin Centre
2. Select the Defender policy profile you created
3. Select Device and user check-in status
4. Confirm the device shows a state of Succeeded

Per-device view:

1. Navigate to Devices > All Devices
2. Select the device
3. Under Monitor, select Configuration
4. Locate the Defender policy profile and confirm the state shows Succeeded

Troubleshooting

Please let us know if you found this helpful.

Thanks for reading!