Let’s learn how to turn on Real-time Monitoring using Intune Antimalware Policy. The present discourse aims to elucidate the process of setting the real-time Monitoring policy with Intune and deploying the configuration profiles to the Security group.
Microsoft Defender Antivirus is a robust security solution that helps protect Windows devices from malware and other security threats. Intune, on the other hand, is a cloud-based service provided by Microsoft that enables organizations to manage and secure their devices and applications.
Intune endpoint security Antivirus policies can be employed to manage device security settings. These policies follow a similar concept to a device configuration policy template, which is a logical grouping of related settings. By utilizing AV policies, you can ensure that your device security settings align with your organizational security standards. Security administrators can ensure uniform deployment and configuration of antivirus solutions across managed device fleets to maintain consistent standards and reduce security risks.
According to Microsoft, the Microsoft Defender Antivirus and Microsoft Defender Antivirus Exclusions profiles were designed for the Windows 10 and later platform for endpoint security Antivirus policy prior to April 5, 2022. However, on April 5, 2022, the Windows 10 and later platform was replaced by the Windows 10, Windows 11, and Windows Server platforms.
Advantages of Turning On Real-Time Monitoring for Microsoft Defender
Enabling Real-Time Monitoring in Microsoft Defender Antivirus offers several benefits. Real-time protection continuously examines the files and processes on your device, actively identifying malware and potentially unwanted software that may attempt to execute or install. In the event that a threat is detected, the system prompts the user to take necessary action, thus ensuring that the system remains secure.
Real-time monitoring involves using behaviour-based detection techniques to identify patterns commonly associated with malware. The process entails close observation of various system activities, including processes, file modifications, and registry changes. Any deviation from the normal or expected behaviour is detected, and an alarm is raised to alert the system administrator or user to take immediate action. This ensures that critical security settings are continuously checked and remain unchanged.
- Protect Security Settings with Tamper Protection in Windows
- Manage Microsoft Defender Antivirus Updates using Intune
- End of Defender Application Guard for Office
- Free Microsoft Defender for Endpoint MDE Training Videos
This feature provides a crucial layer of defence that every organization should consider implementing to ensure the safety and security of its digital assets. Real-time monitoring is similar to having a watchful guardian for your digital space. Let’s learn how you can configure Real-time Monitoring using Intune Antimalware Policy.
Turn On Real-time Monitoring in Microsoft Intune
Let’s learn how to turn on Real-time Monitoring for Microsoft Defender Antivirus policy in Microsoft Intune for Windows devices.
- Sign in to the Microsoft Intune Admin Portal.
- Select Endpoint security > Antivirus > Create Policy
When you click Create Policy, a new window will open. In Platform, select Windows 10, Windows 11, and Windows Server. Select Profile Type as Microsoft Defender Antivirus, and Click on Create.
| Platform | Profile Type |
|---|---|
| Windows 10, Windows 11, and Windows Server | Microsoft Defender Antivirus |
On the Basics page, enter a Name and Description for the profile, then choose Next.
On the Configuration settings page, expand Defender settings, and configure the settings you want to manage with this profile. In this example, I will configure the settings to Allow Real-time Monitoring. Scroll down slightly to find the corresponding option.
NOTE! Changes to this setting are not applied when tamper protection is enabled.Please note that by default, the Allow Real-time Monitoring policy is not configured. We wanted to bring this to your attention for your reference and consideration.
| Value | Description |
|---|---|
| Not configured | The setting is restored to the system’s default |
| Not Allowed | The setting is disabled. Device users can’t change this setting. Turns off the real-time monitoring service. |
| Allowed | Enforce the use of real-time monitoring. Device users can’t change this setting. |
When you are done Configuring settings, review the settings and Click Next to go further.
On the Scope tags page, Add the Scope tags if you wish and click Next to assign the policy to computers. I will deploy it to the HTMD – Test Computers Group. Your devices will receive your policy settings when they check in with Intune service.
On the Review + Create page, carefully review all the settings you’ve defined. Once you’ve confirmed that everything is correct, select Save to implement the changes. The new profile is now visible in the policy type list, where you can select it.
Monitor Antivirus Policy Deployment from the Intune
The Antivirus Policy is deployed to Azure AD groups. Let’s see how we can monitor the deployment and status of installation from the Intune portal. To monitor the Intune policy assignment, follow these steps:
- Navigate to the list of Antivirus Policies and select the policy you targeted.
- Check the device and user check-in status from here.
- If you click “View Report,” you can see additional details.
Monitor Antivirus Policy Deployment from the Windows Client Side
Let’s learn how to Monitor Antivirus Policy Deployment from the Windows Client Side. We can Monitor Antivirus Policy Deployment from the Windows Client Side using different methods.
- Antivirus Agent Status Intune Report | Endpoint Manager
- Monitor Intune App Protection Policy Status
- Monitor Device Enrollment Profile Deployment Report in Intune
- You can use the below PowerShell command to check real-time protection.
Get-MpComputerStatus | select RealTimeProtectionEnabled
- Also, you can check the below Registry Key to verify the real-time protection status.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\B1E9301C-8666-412A-BA2F-3BF8A55BFA62\default\Device\Defender
End User Experience
As per the above report, the Antivirus policy is deployed to Azure AD groups. Let’s learn about the End User Experience after turning on Real-time Monitoring for Microsoft Defender Antivirus policy.
- In Windows 10 or 11 devices, In the search box, type Windows Security and then select Windows Security in the list of results.
- In Windows Security, select Virus & Threat Protection.
- Scroll down to the Virus & Threat Protection settings and select Manage settings.
- You can check if Real-time Monitoring is turned On or Off from here.
Thank you for your patience in reading this post. I look forward to seeing you in the next post. Keep supporting the HTMD Community.
We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here – HTMD WhatsApp.
Author
About Author – Sujin Nelladath has over 10 years of experience in SCCM device management and Automation solutions. He writes and shares his experiences related to Microsoft device management technologies, Azure, and PowerShell automation.