Enable and Configure Windows Defender Firewall rules using Intune

- July 04, 2021

If you’re managing your devices using Microsoft Intune, you may want to control your Windows Defender Firewall policy. A firewall controls what network traffic is allowed and not allowed to pass through ports. For regular devices like laptops and desktops, the firewall should allow very little inbound traffic. There is rarely any legitimate reason for other devices to connect to your device, or home network, unsolicited. Therefore, it's important to have Microsoft Defender Firewall switched on to protect your device from unauthorized access.

As always, I am going to refer to a use case as I feel that is the best way of putting things in context. While working on an assignment, I noticed that an end user would receive Windows Defender FW prompt stating that some executables are getting blocked. These were related to an application called AS 400.

At this point, I had not configured any FW rules to allow any Inbound or Outbound traffic, but soon realized that the FW was getting enabled due to the fact that I had already deployed the MDM Security Baseline which enables the Defender FW with some basic rules.

It is not ideal if relevant traffic is being blocked and your users can't do anything about it because they are setup as Standard users. Which is why it is imperative to configure FW rules for smooth and secure running.

At the time of writing this blog, there are 2 ways to configure Defender FW rules in Intune right out of the box.

1. Endpoint Protection Device Configuration Profile.

2. Endpoint Security Firewall Profile.

I chose to use EP Device Configuration Profile as I was configuring other aspects of EP, but if you are specifically configuring FW profile & rules, then consider Endpoint Security FW Profile instead. The important thing is not to mix both as it can result in conflicts. According to Microsoft,

When a conflict exists between two policy instances or types of policy that manage the same setting with different values, the setting isn't sent to the device. This form of policy conflict applies to the Microsoft Defender Firewall profile, which can conflict with other Microsoft Defender Firewall profiles, or a firewall configuration that’s delivered by a different policy type, like device configuration.

Microsoft Defender Firewall profiles don't conflict with Microsoft Defender Firewall rules profiles.

Creating an Endpoint Point Device Configuration Profile -

1. Sign-in to the https://endpoint.microsoft.com

2. Head over to Device – Configuration Profiles

3. Click on Create Profile then select Windows 10 and later as platform type.

4. Under Profile Type, select Templates and then Endpoint Protection and click on Create.

5. Fill the relevant fields Name, Description.

6. In the Configuration settings section, select Microsoft Defender Firewall.

7. Based on your FW requirements, enable the FW for relevant network types. In my case, I am enabling for Domain and Private. Note - If you are using MDM security Baseline, then you can leave the rest of the settings as it is, else go ahead and configure them as necessary. Please also note that not everything is configured in the MDM Security baseline.

8. Then head over to the Firewall rules a little further down and configure the relevant FW rules.

9. Once complete, they will show up like this.

10. Assign as normal.

The FW rules will get applied and the end user should not receive the Windows Defender FW blocking prompt anymore.

Validation -

Defender FW is enabled as expected.

The rules can be validated at the following locations -

Conclusion -

Security settings are like build, assign and repeat where there is no single configuration that can be implemented at a particular given time to bullet proof the IT security in your organization. While Microsoft has released security baselines, they are only good for configuring some basic settings and are an excellent starting point. However, there may come a time when you have to consider adding additional configuration to strengthen your organizational security governance and fine tune the settings to improve over all experience of your end users.