Hello All, we are presenting this post for the successful implementation of Turn On Behavior Monitoring Policy using Intune. We are making use of Settings Catalog of Configuration Profiles from Intune to deploy Turn On Behavior Monitoring Policy.
Turn On Behavior Monitoring Policy setting is instrumental in defining how an antivirus solution or security software observes and responds to the behavior of programs and processes on a system. Enabling or leaving this setting unconfigured activates behavior monitoring. Conversely, disabling this setting turns off behavior monitoring.
Behavior monitoring involves the continuous observation of program behavior, analyzing activities, and detecting patterns that may indicate malicious or suspicious actions. This capability allows security software to identify threats based on behavior rather than relying solely on predefined signatures.
By enabling behavior monitoring, the antivirus solution can detect and respond to threats in real-time. This proactive approach is particularly effective in identifying and mitigating zero-day attacks and emerging threats that may not have known signatures.
The policy setting allows administrators to configure the behavior monitoring feature based on the specific needs and security requirements of their environment. This configurability ensures flexibility in adjusting the level of monitoring and response.
Turn On Behavior Monitoring Policy using Intune
Below are the steps to create a Turn On Behavior Monitoring Policy
- First, we must sign in to the Intune Admin Center portal using the link – https://intune.microsoft.com/.
- Now Navigate to Devices > Windows > Configuration profiles > Create a profile.
Here, in the Create a Profile section, select the values as shown below in the table and click on Create.
| Platform | Profile Type |
|---|---|
| Windows 10 and later | Settings catalog |
After this, in the Basics tab, I provide a name for the policy “Turn On Behavior Monitoring Policy.”
- Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.
Now in Configuration Settings, Click Add Settings to browse or search the catalog for the settings I want to configure.
In the Settings Picker windows, on searching with the keyword Behavior, I found the category Administrative Templates\Windows Components\ Microsoft Defender Antivirus\ Real-time Protection. And we need to select this.
- After selecting the above-stated option, I see the sub-category Turn on behavior monitoring. After selecting that, click the cross mark at the right-hand corner, as shown below.
Here in Administrative Templates, I have Enabled the Turn on behavior monitoring as this is the recommended state considering the digital security importance.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.
- Click Next to continue.
Now in Assignments, in Included Groups, you need to click on Add Groups and choose Select Groups to include one or more groups. Click Next to continue.
In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.
After successfully creating the “Turn On Behavior Monitoring Policy,” a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for Turn On Behavior Monitoring Policy
From the Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.
To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list, which is the Turn On Behavior Monitoring Policy. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.
- If you require more detailed information, you can click on “View Report” to access additional insights.
Client Side Verification – Turn On Behavior Monitoring Policy
You can leverage event IDs 813 and 814 to verify the successful implementation of String or integer policies for the Turn On Behavior Monitoring Policy on Windows 10 or 11 devices through Intune.
These event IDs provide valuable insights into the Turn On Behavior Monitoring Policy’s application status and the specific value assigned to the policy on those devices. In the case of this particular policy, the value is String and is linked to the event ID 814.
By analyzing these event IDs, you can clearly understand the policy’s application status and the corresponding value associated with it on the devices in question.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (