🎯 Intune Course · Module 7 of 7 · Final
Security Baselines, Endpoint Security & Monitoring
📂 Course: Intune & Endpoint Management
📦 Module: 7 of 7 · Final
🎯 Exam: MD-102
⏱ Read time: ~24 min
📦 Module: 7 of 7 · Final
🎯 Exam: MD-102
⏱ Read time: ~24 min
MD-102 Exam Alignment
MD-102
- Know that Security baselines in Intune are Microsoft-recommended preconfigured groups of Windows settings that enforce a security configuration — they are NOT a single policy but a pre-built Settings Catalog-style template of hundreds of settings
- Know the difference between Security baselines (preconfigured templates, e.g., MDM Security Baseline) and Endpoint security policies (focused policies for specific security areas: Antivirus, Disk Encryption, Firewall, ASR)
- Know that Microsoft Defender for Endpoint (MDE) integration with Intune allows device risk score from MDE to flow into Intune compliance policies — devices with High risk can be blocked via Conditional Access
- Know where to find key Intune reports: Reports → Device compliance for overall compliance state, Endpoint analytics for device health trends, Endpoint security for security posture monitoring
Exam Tip: Security baselines and Endpoint security policies can conflict if they configure the same setting differently. When a conflict occurs, neither setting applies and Intune reports a conflict for that setting. Best practice: choose either baselines OR granular Endpoint security policies for a given setting category — don’t manage the same settings in both.
This final module covers the security layer of Intune endpoint management: Security baselines that apply Microsoft’s pre-vetted security configurations at scale, Endpoint security policies that give granular control over specific security areas, integration with Microsoft Defender for Endpoint for threat-based compliance, and Intune’s reporting capabilities for ongoing monitoring and visibility into your device estate.
🛡️ Security Baselines
Security baselines are Microsoft-curated collections of recommended security settings for Windows devices. In Intune, deploying a baseline is like deploying a large Settings Catalog profile with hundreds of pre-configured security settings.
| Baseline | Focus | Key Settings Covered |
|---|---|---|
| MDM Security Baseline | Core Windows security | BitLocker, Windows Defender Antivirus, Firewall, SmartScreen, UAC, Windows Hello, credential guard, account lockout, Windows Update |
| Microsoft Defender for Endpoint Baseline | Advanced threat protection | Defender ATP settings: block at first sight, cloud protection, real-time protection, behaviour monitoring, network protection, exploit protection |
| Microsoft 365 Apps for Enterprise Security Baseline | Office application security | Macro settings, VBA trust, file format security, add-in behaviour, Office update channel, external link handling |
| Windows 365 Cloud PC Security Baseline | Cloud PC security | Specific settings for Windows 365 virtual desktops including session management and RDP security |
⚠️ Baselines vs Configuration Profiles
Security baselines are a specific category of Intune policy — NOT the same as a Settings Catalog profile. Baselines are versioned (Microsoft releases new versions as security guidance evolves), curated (you apply the whole baseline, not individual settings), and tracked with their own compliance reporting. When a baseline is updated to a new version, your existing assignments stay on the old version until you explicitly update them.
🔒 Endpoint Security Policies
Found at Endpoint security in the Intune admin center. These are focused security policies for specific categories — unlike baselines (hundreds of settings), each Endpoint security policy type targets one specific area.
| Policy Type | Controls |
|---|---|
| Antivirus | Windows Defender Antivirus settings: real-time protection, cloud protection, scan schedules, exclusions, quarantine behaviour, Defender updates |
| Disk Encryption | BitLocker configuration for Windows: OS drive encryption method, PIN requirements, startup key behaviour, recovery key storage in Entra ID, fixed/removable drive encryption |
| Firewall | Windows Defender Firewall: enable/disable per network profile (domain/private/public), default inbound/outbound action, firewall rules |
| Endpoint Detection and Response (EDR) | Onboarding configuration for Microsoft Defender for Endpoint — connects devices to MDE for advanced threat detection and investigation |
| Attack Surface Reduction (ASR) | ASR rules that block behaviour patterns used by malware: block Office macros from creating child processes, block credential stealing from LSASS, block untrusted executable content |
| Account Protection | Windows Hello for Business configuration, credential guard, account lockout policies |
🔗 Microsoft Defender for Endpoint Integration
Intune and Microsoft Defender for Endpoint (MDE) can be connected to share device risk intelligence, creating a feedback loop between your EDR solution and your MDM policy engine.
| Step | What Happens |
|---|---|
| 1. Enable connector | In Intune: Endpoint security → Microsoft Defender for Endpoint → Enable the connector. Also enable “Connect Windows devices version 10.0.15063 and above to Microsoft Defender for Endpoint.” |
| 2. Deploy EDR profile | Deploy an Endpoint security → Endpoint Detection and Response policy to Windows devices — this onboards them to MDE and activates telemetry collection |
| 3. MDE assigns risk score | MDE analyses each device’s threat signals (active alerts, vulnerabilities, behavioural anomalies) and assigns a Machine Risk Score: Clear, Low, Medium, or High |
| 4. Compliance policy uses risk score | Intune compliance policy setting: “Require the device to be at or under the machine risk score” — select Maximum allowed threat level (Clear, Low, Medium, High) |
| 5. Conditional Access enforces | A device detected with active malware gets a High risk score → compliance policy marks it non-compliant → CA policy blocks access to M365 resources until the threat is remediated |
📊 Intune Reporting & Monitoring
| Report Location | What It Shows |
|---|---|
| Reports → Device compliance | Overall compliance state across all devices. Drill into non-compliant devices to see which policy and specific setting caused non-compliance. Export to CSV. |
| Reports → Endpoint analytics | Device startup performance (boot time, sign-in time), app reliability (crash data), recommended software, hardware readiness for Windows 11. Shows trends over time. |
| Devices → Monitor → Configuration assignment status | Deployment status for a specific configuration profile across all targeted devices. Filter by Success, Error, Conflict, Pending. |
| Apps → Monitor → App install status | Deployment success/failure for a specific app. Shows per-device install state and error codes for failed installs. |
| Endpoint security → Security baselines → [Baseline] → Per-profile status | Baseline deployment status per device. Shows which settings are in conflict or failed to apply. |
| Tenant administration → Audit logs | Full admin activity log — who changed what policy, when, and from which IP. Required for compliance and forensic review. |
💡 Best Practices
- Deploy the MDM Security Baseline as your foundation and then layer additional Endpoint security policies on top for specific areas needing customisation. Avoid configuring the same setting in both a baseline and a separate policy — resolve conflicts by customising within the baseline or using exclusion groups.
- Enable MDE integration and require machine risk score in compliance policies as early as possible — this is one of the highest-value security controls available in Intune, automatically blocking compromised devices from company resources in near-real-time based on threat intelligence
- Review Endpoint analytics startup scores monthly — devices with degraded startup performance are productivity and stability risks; proactive remediation prevents helpdesk calls and ensures the fleet stays healthy
🎓 Interview Q&A
Q: A laptop is detected by Microsoft Defender for Endpoint as having active malware. How does the MDE-Intune integration prevent this device from accessing SharePoint Online?
The integration creates an automated threat response chain: (1) MDE detects the active malware and assigns the device a High machine risk score. (2) The Intune compliance policy, which is configured to require “machine risk score at or below Medium,” evaluates the device — the High score violates this rule and Intune marks the device as Non-compliant. (3) The Entra ID Conditional Access policy, configured to require compliant devices for Office 365 apps, detects the non-compliant state and blocks the device’s access token request for SharePoint Online. The user’s access to SharePoint is revoked within minutes of the threat detection, without any manual admin intervention. Once MDE clears the threat and the risk score drops, Intune re-evaluates the device as Compliant and CA automatically restores access.
🎯 MD-102 Mock Test — Final
Module 7 — Security Baselines, Endpoint Security & Monitoring
5 questions · Pass mark: 70% · Course Final
Q1 OF 5
An admin deploys the MDM Security Baseline to all Windows devices. They also deploy a separate Endpoint security → Antivirus policy to some of the same devices. Some devices show “Conflict” for Defender Antivirus settings. What is the most likely cause?
✅ B. The MDM Security Baseline includes Defender Antivirus settings as part of its comprehensive security configuration. A separate Antivirus Endpoint security policy targeting the same devices configures some of the same settings with different values. Intune cannot resolve the conflict — neither value applies for the conflicting settings, and the device reports Conflict. Resolution: either customise the Defender Antivirus settings within the baseline, or remove the Antivirus policy and rely solely on the baseline for those settings. Don’t manage the same setting in two different policy types.
Q2 OF 5
What happens when Microsoft releases a new version of the MDM Security Baseline in Intune and your organisation already has the previous version deployed?
✅ C. Security baseline versions in Intune are additive — when Microsoft publishes a new version, your existing baseline deployment continues unchanged on the old version. You receive a notification in the Intune admin center that a newer version is available. You can review the differences, test on a pilot group, and then update your assignment to the new version when ready. This gives admins full control over when baseline updates are applied.
Q3 OF 5
Which Intune report should an admin check first when a user reports that their new Windows laptop is slow to start up after Intune policies were applied?
✅ A. Endpoint analytics → Startup performance provides detailed startup time telemetry broken down into phases: Core boot time (POST to OS load), Group Policy processing time, Windows sign-in time, and Desktop visible time. This allows the admin to pinpoint which phase is slow — for example, if Group Policy/MDM policy processing is adding significant delay, that points to too many or complex policies being processed at startup.
Q4 OF 5
An admin wants to ensure that if Microsoft Defender for Endpoint detects active threats on a device, the device is automatically blocked from accessing Microsoft 365. What must be configured? (Select the correct combination.)
✅ D. Three components are required: (1) MDE-Intune connector (Endpoint security → Microsoft Defender for Endpoint — enable the service-to-service connection so MDE can report device risk scores to Intune); (2) Intune compliance policy with setting “Require device to be at or under machine risk score: Medium” — devices with High risk score are non-compliant; (3) Entra ID Conditional Access policy requiring “Device must be marked as compliant” for Office 365 apps — non-compliant devices are blocked. All three components are necessary — without any one of them, the chain breaks and threats don’t result in access being blocked.
Q5 OF 5
An admin needs to verify which admin made changes to a specific Intune compliance policy last week and what exactly was changed. Where is this information found?
✅ C. Intune admin activity is recorded in Tenant administration → Audit logs. Filter by: Resource type (Compliance policy), Activity (Update), and date range (last 7 days). Each log entry shows: the admin’s UPN who made the change, the timestamp, the action performed, and the “New values” vs “Old values” for changed properties. This is the authoritative source for admin activity forensics in Intune and is required for SOC review and compliance audits.
🔒
Module locked — Complete Module 6 first.