Intune Endpoint Security: What Every Node Does (and Which Licence You’re Already Paying For)

Intune endpoint security is the part of the Microsoft Intune admin centre where Antivirus, BitLocker, Firewall and friends live, and most tenants I look at are paying for far more of it than they use.

The pattern is familiar. Someone signs off Business Premium or E3 at renewal, Defender quietly does its thing, and the Endpoint security node sits there like the exercise bike in the spare room. Then an auditor asks for proof of encryption and everyone suddenly gets very interested.

This guide walks through every Intune endpoint security node in the order the portal lists them: what it configures, when it earns its keep, and which licence unlocks it after the July 2026 Microsoft 365 changes. There is also a Defender connector walkthrough and a PowerShell check for your test device.

Never miss a guide: subscribe here and check out my YouTube channel.

I walk through some of this configuration in my video, if you would rather watch than read:

What is Intune endpoint security?

Intune endpoint security is a node in the Microsoft Intune admin centre that groups security policy types in one place. Each policy shows only the settings for one job, instead of a device configuration profile with Wi-Fi, email and hundreds of other settings.

Under Endpoint security > Manage you will find Antivirus, Disk encryption, Firewall, Endpoint Privilege Management, Endpoint detection and response, App Control for Business, Attack surface reduction, Account protection, Device compliance and Conditional Access. In Intune endpoint security, the policy types configure, compliance measures and Conditional Access enforces.

Intune endpoint security licensing: which licence unlocks what

Good news first. Almost every Intune endpoint security policy only needs Intune Plan 1, which comes with Microsoft 365 Business Premium, E3, E5, and A3 and A5 for education.

Node	Minimum licence	Notes
Antivirus	Intune Plan 1	Tamper protection needs Defender for Endpoint P1 or higher
Disk encryption	Intune Plan 1	BitLocker, Personal Data Encryption and macOS FileVault
Firewall	Intune Plan 1	Windows and macOS
Endpoint Privilege Management	Intune Suite, EPM add-on, or Microsoft 365 E5/E7	E5/E7 inclusion rolling out from July 2026
Endpoint detection and response	Intune Plan 1 plus a Defender licence	Investigation and response need Defender for Endpoint P2 or Defender for Business
App Control for Business	Intune Plan 1	Windows only
Attack surface reduction	Intune Plan 1	Central ASR reporting needs Defender for Endpoint P2 or Defender for Business
Account protection	Intune Plan 1	Includes Windows LAPS and local user group membership
Device compliance	Intune Plan 1	Defender risk scores need the connector
Conditional Access	Microsoft Entra ID P1	Configured in Entra; Intune shows a shortcut

Bundle	Intune	Microsoft Entra ID	Device protection	EPM included?
Microsoft 365 Business Premium	Plan 1	P1	Microsoft Defender for Business (up to 300 users)	No
Microsoft 365 E3	Plan 1 plus Plan 2, Remote Help and Advanced Analytics	P1	Defender for Endpoint P1	No
Microsoft 365 E5 / E7	Everything in E3 plus EPM, Cloud PKI and Enterprise App Management	P2	Defender for Endpoint P2	Yes (rolling out)

The E5 additions (EPM, Cloud PKI and Enterprise App Management) roll out gradually, with a notice in the Microsoft 365 admin centre 30 days before your tenant changes. E3 gains Intune Plan 2, Remote Help and Advanced Analytics. The detail is on the Intune licensing page, and if you are on E5 while still paying for an EPM add-on, have a quiet word with whoever handles your renewal.

What each Intune endpoint security node does

Antivirus

The Antivirus node manages Microsoft Defender Antivirus on Windows, and Defender for Endpoint antivirus on macOS and Linux. Windows profiles include Microsoft Defender Antivirus, Microsoft Defender Antivirus exclusions, Defender Update controls and Windows Security experience.

This is the Intune endpoint security policy most tenants should build first. Standardise cloud-delivered protection, real-time protection, scan schedules and exclusions, and use the Windows Security experience profile to add your help desk contact details for when Dave from accounts clicks on everything.

Disk encryption

In Intune endpoint security, Disk encryption covers BitLocker and Personal Data Encryption on Windows, plus FileVault on macOS. BitLocker can encrypt silently on Microsoft Entra joined devices, with recovery keys backed up to Microsoft Entra ID.

You can also block write access to removable drives that aren’t BitLocker protected. Users then have to run the BitLocker wizard before copying the quarterly figures onto a USB stick from a petrol station.

Check progress under Devices > Monitor > Encryption report. Silent encryption needs a TPM, and any TPM startup PIN or key setting that requires user interaction will quietly break it.

Firewall

The Intune endpoint security Firewall node manages Windows Firewall across the Domain, Private and Public profiles, Windows Firewall rules, and the macOS firewall. Firewall rules support reusable settings groups, so you define a set of addresses once and reference it in several policies.

Start with all three Windows profiles on, then add only the rules your apps need. Host firewalls limit lateral movement, and every extra rule is one more thing somebody will ask you to explain in three years’ time.

Endpoint Privilege Management

Endpoint Privilege Management (EPM) lets standard users run approved files with admin rights without being local administrators. You deploy an elevation settings policy to switch it on, then elevation rules policies for specific files.

Elevation types are Automatic, User confirmed (optionally with business justification or Windows authentication), Support approved, Elevate as current user and Deny. Users get a Run with elevated access option on the right-click menu, and elevations show up in reporting.

Set the default elevation response to Require support approval or Deny, rather than user confirmation. Add file paths standard users can’t modify to your rules, or you have built a very polite way to run anything as admin.

When to bother: when you are removing local admin but a few legacy installers still sulk without it. Licence check: Intune Suite, the EPM add-on, or Microsoft 365 E5/E7.

Endpoint detection and response

The Endpoint detection and response node onboards devices to Microsoft Defender for Endpoint on Windows, macOS and Linux. With the connector live, Intune receives the Windows onboarding package automatically, so you choose Auto from connector as the package type.

The Intune endpoint security EDR policy only onboards. Incidents, the device timeline and automated investigation live in the Defender portal and need Defender for Endpoint P2 or Defender for Business.

App Control for Business

App Control for Business (formerly Windows Defender Application Control, or WDAC) is allow-listing for Windows. Apps you trust run, and everything else is blocked.

The built-in controls option is the easy route: trust Windows components and Store apps, then optionally trust apps with a good reputation and apps from managed installers. Set the Intune Management Extension as a managed installer first, so apps you deploy with Microsoft Intune are tagged as trusted.

Run it in Audit only mode before you enforce. Audit mode logs what would have been blocked, which is far cheaper than finding out from the head teacher in the middle of exams.

When to bother: kiosks, shared devices and high-risk roles. Rolling it to every laptop on day one is a bold career move.

Attack surface reduction

Attack surface reduction covers ASR rules, Device control, Exploit protection, App and browser isolation, and an older Application control profile due for deprecation. It needs Microsoft Defender Antivirus as the primary antivirus.

ASR rules block behaviours malware loves, such as Office spawning child processes or email delivering executables. Good starters include:

• Block all Office applications from creating child processes
• Block executable content from email client and webmail
• Block JavaScript or VBScript from launching downloaded executable content
• Use advanced protection against ransomware

The standard protection rules (vulnerable signed drivers, credential stealing from LSASS, and persistence through WMI event subscription) can usually go straight to Block or Warn. Put the rest in Audit first, review the results, then move them to Block.

When to bother: early, because ASR rules are some of the best value settings in Intune endpoint security. Without Defender for Endpoint P2 or Defender for Business, audit events only appear in Event Viewer (event ID 1122).

Account protection

The Intune endpoint security Account protection node has three profiles: Account protection (Windows Hello for Business and Credential Guard), Local admin password solution (Windows LAPS), and Local user group membership.

Windows LAPS rotates the local administrator password and backs it up to Microsoft Entra ID or Active Directory. You can view it from the device page in Intune, or force a change with the Rotate local admin password device action.

Local user group membership controls who sits in local groups such as Administrators. Pair it with LAPS and EPM and the “everyone is a local admin because it was easier in 2019” era can finally end.

Device compliance

Device compliance policies define a healthy device: OS version, encryption, firewall, antivirus, password rules and, with the connector on, a Defender machine risk score. Each device ends up compliant or not compliant, and that status flows to Microsoft Entra ID.

The risk options are Clear, Low, Medium and High. Low is the recommended balance for most organisations, while High effectively means report only.

When to bother: always. Compliance turns your Intune endpoint security settings into a signal Conditional Access can use.

Conditional Access

The Conditional Access entry is a shortcut to the same policies you find at Entra ID > Conditional Access > Policies in the Microsoft Entra admin centre. It needs Microsoft Entra ID P1.

The classic pairing grants access only when the device is marked as compliant. Create it in Report-only mode, check the sign-in logs for a day, then switch it on.

When to bother: once your compliance policies are stable. Run the Conditional Access What If tool before switching anything on.

How to connect Defender for Endpoint to Intune in 4 steps

The connector is a one-time, tenant-wide switch that links Intune endpoint security to Defender. It costs nothing by itself, but what you get afterwards depends on your Defender licence.

Step 1: Check the connection status

1. Sign in to the Microsoft Intune admin centre with the Endpoint Security Manager role or equivalent.
2. Go to Endpoint security > Microsoft Defender for Endpoint (under Setup).
3. If Connection status shows Enabled, skip to step 3.

Step 2: Switch on the Intune connection in Defender

1. Open the Microsoft Defender portal at security.microsoft.com as a Security Administrator.
2. Go to System > Settings > Endpoints > General > Advanced features.
3. Turn on Microsoft Intune connection and select Save preferences.
4. Back in Intune, the status should show Enabled within about 15 minutes. Time for tea.

Step 3: Choose which platforms share risk

1. On the same Intune page, under Compliance policy evaluation, turn on Connect Windows devices to Defender for Endpoint (and Android or iOS/iPadOS if you use them).
2. Optionally turn on App protection policy evaluation for mobile devices.
3. Select Save.

Step 4: Onboard and enforce

1. Create an Endpoint detection and response policy with the package type Auto from connector, assigned to a pilot device group.
2. Add a compliance policy that requires the machine risk score to be at or under Low.
3. Build a Conditional Access policy that requires a compliant device, in Report-only first.

Prove Intune endpoint security is working

Policy status in the admin centre tells you Intune delivered the settings, not that the device agrees. I run this on a test device after any Intune endpoint security change, then check the device appears in the Defender portal under Endpoints > Device inventory.

# Quick local check of Intune endpoint security settings (run as administrator)
$av = Get-MpComputerStatus
[pscustomobject]@{
    AVMode             = $av.AMRunningMode
    RealTimeProtection = $av.RealTimeProtectionEnabled
    TamperProtected    = $av.IsTamperProtected
    SignaturesUpdated  = $av.AntivirusSignatureLastUpdated
}

# BitLocker on the system drive
Get-BitLockerVolume -MountPoint $env:SystemDrive |
    Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod

# Windows Firewall profiles
Get-NetFirewallProfile | Select-Object Name, Enabled

# Defender for Endpoint onboarding (1 = onboarded)
$status = 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status'
if (Test-Path $status) {
    (Get-ItemProperty -Path $status).OnboardingState
} else {
    'Not onboarded to Defender for Endpoint'
}

# ASR rules and their mode (0 off, 1 block, 2 audit, 6 warn)
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    [pscustomobject]@{
        RuleId = $p.AttackSurfaceReductionRules_Ids[$i]
        Action = $p.AttackSurfaceReductionRules_Actions[$i]
    }
}

Check	Where	Healthy result
Antivirus mode	Get-MpComputerStatus (AMRunningMode)	Normal, or Passive alongside another antivirus
BitLocker	Encryption report or Get-BitLockerVolume	ProtectionStatus On
Defender onboarding	EDR Onboarding Status tab or the OnboardingState value	1, and the device listed in the Defender portal
ASR rules	Get-MpPreference	1 (block), 2 (audit) or 6 (warn) as you intended
Compliance	Devices > Compliance	Compliant

Intune endpoint security gotchas

Policy conflicts. Intune endpoint security policies, security baselines and device configuration profiles all have equal priority. If two set the same setting differently, it is flagged as conflicted and may not apply, so decide which policy type owns each setting.

200 recovery keys. Microsoft Entra ID stores up to 200 BitLocker recovery keys per device. Hit that limit and silent encryption fails, because the key backup fails first.

LAPS and registered devices. Windows LAPS backup to Microsoft Entra ID isn’t supported on Entra registered devices. It is for Microsoft Entra joined and Microsoft Entra hybrid joined devices.

Should you switch on every Intune endpoint security node?

Probably not on day one, and that is fine. A sensible Intune endpoint security rollout starts with Antivirus, Firewall and Disk encryption, then the Defender connector and EDR, then compliance and Conditional Access.

After that, move ASR rules from Audit to Block and roll out Account protection with LAPS. App Control for Business and EPM come last because they change how people work, so pilot them with a friendly group, ideally not the directors.

If you are on Business Premium, you already own most of Intune endpoint security plus Defender for Business. On E5, check whether EPM has landed in your tenant before buying it again.

Intune endpoint security FAQs

Further reading

• Manage endpoint security in Microsoft Intune (Microsoft Learn)
• Microsoft Intune licensing (Microsoft Learn)
• Configure Microsoft Defender for Endpoint with Intune and onboard devices (Microsoft Learn)
• Plan and prepare for Endpoint Privilege Management (Microsoft Learn)
• Intune Remediations: fix problems before users notice
• Intune settings for Windows 11 25H2

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.