HOW-TO GUIDE 2

Antivirus, EDR and USB device control with Microsoft Defender for Business

1. Purpose

This guide explains how to protect company Windows devices with Microsoft Defender for Business: next-generation antivirus, ransomware protection, endpoint detection and response (EDR), automatic remediation, and control of USB pen drives and other removable storage. Policies are deployed from Intune so that all settings are managed in one place.

2. Applies to / licence required

3. Prerequisites

• Devices are Entra joined and enrolled in Intune (Guide 1) and show as Compliant or at least Managed.
• A pilot device group, for example SG-Intune-Pilot (users) or a device group SG-Devices-Pilot.
• Any third-party antivirus documented. Plan to uninstall it after Defender is confirmed working, or keep Defender in passive mode with EDR in block mode during transition.
• Windows Update working, so Defender platform and security intelligence updates install.

4. Step-by-step procedure

Part A – Open Defender for Business and connect Intune

1. Sign in to the Microsoft Defender portal (security.microsoft.com). The first time, a setup wizard may appear – you can complete it or skip it and use Intune policies as described below.
2. Go to Settings > Endpoints > General > Advanced features. Turn on Microsoft Intune connection and Tamper protection. Select Save preferences.
3. In the Intune admin center, go to Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint (also reachable from Endpoint security > Microsoft Defender for Endpoint). Turn on Connect Windows devices version 10.0.15063 and above to Microsoft Defender for Endpoint and select Save. The connection status should show Connected (can take up to 15 minutes).

[SCREENSHOT PLACEHOLDER – Intune – Microsoft Defender for Endpoint connector showing Connected]

Note: Defender for Business can also manage policies directly in the Defender portal (Endpoints > Configuration management > Device configuration). Use one place – Intune is recommended here – to avoid conflicting settings.

Part B – Onboard devices with an EDR policy

4. In Intune, go to Endpoint security > Endpoint detection and response > Create policy.
5. Platform Windows, Profile Endpoint detection and response, select Create. Name it EDR-Windows-Onboarding.
6. Set Microsoft Defender for Endpoint client configuration package type to Auto from connector. Leave sample sharing at the default unless your policy says otherwise.
7. Assign to the pilot group, select Create. After a sync, devices appear in the Defender portal under Assets > Devices.

Part C – Antivirus and ransomware protection

8. In Intune, go to Endpoint security > Antivirus > Create policy, Platform Windows, Profile Microsoft Defender Antivirus. Name it AV-Windows-Baseline.
9. Configure at least the settings in the table below, assign to the pilot group, and select Create.

10. For ransomware protection, go to Endpoint security > Attack surface reduction > Create policy, Platform Windows, Profile Attack Surface Reduction Rules.
11. Set rules such as Use advanced protection against ransomware, Block executable content from email client and webmail, Block Office applications from creating child processes and Block credential stealing from the Windows local security authority subsystem to Audit first. After 1–2 weeks with no business impact, change them to Block.
12. Optionally enable Controlled folder access in Audit mode first – it can block legitimate line-of-business or CNC/plant software from writing to protected folders.

Part D – EDR in block mode and automated investigation

13. In the Defender portal, go to Settings > Endpoints > General > Advanced features and turn on Enable EDR in block mode. This lets EDR stop malicious items after a breach is detected, even if another antivirus is primary and Defender is in passive mode.
14. Automated investigation and remediation is switched on by default in Defender for Business – there is no separate setting to enable.

Important: Microsoft states that from 1 September 2026, Automated Investigation and Response (AIR) no longer runs as a separate investigation experience and cannot be triggered manually; its detection and response logic runs automatically within Defender's default protection. For an on-demand check, run a full antivirus scan on the device. Verify what your portal currently shows.

Part E – Control USB and removable storage (device control)

15. In Intune, go to Endpoint security > Attack surface reduction > Create policy, Platform Windows, Profile Device Control. Name it DC-USB-Control.
16. Simple option (read-only USB): set Removable Disk Deny Write Access to Enabled. Users can read pen drives but cannot copy company files out.
17. Granular option (block all except approved drives): first create reusable settings in Endpoint security > Attack surface reduction > Reusable settings – one group for all removable media, and one for approved company USB drives (by Vendor ID/Product ID or serial number, taken from Device Manager on a test PC).
18. In the Device Control profile, add a rule that Denies Read/Write/Execute for the removable media group, and exclude the approved group (or add an Allow rule for it). Turn on auditing of denied events.
19. Assign to a pilot group first. Inform users before enforcing; plant and engineering teams often rely on USB for machine programs.

[SCREENSHOT PLACEHOLDER – Intune – Device Control profile with Deny rule and approved USB exclusion]

5. Verification and testing

• Defender portal > Assets > Devices: pilot devices show Onboarded, sensor health Active.
• On the device, run Get-MpComputerStatus in PowerShell (as administrator): AMRunningMode = Normal, RealTimeProtectionEnabled = True, IsTamperProtected = True.
• Run the detection test shown in Settings > Endpoints > Device management > Onboarding on a pilot device; an alert should appear under Incidents & alerts within minutes.
• Download the harmless EICAR test file (eicar.org) to confirm antivirus blocks it.
• Insert a non-approved USB drive: writing (or access) should be blocked with a Windows notification; an approved drive should work.
• In Intune, check each policy's Device and user check-in status shows Succeeded.

Ongoing monitoring

• Incidents & alerts > Incidents – review daily; assign and resolve.
• Actions & submissions > Action center – review remediation actions taken automatically or awaiting approval.
• Exposure management / Vulnerability management (menu name may vary) – review missing updates and vulnerable software.
• Reports – security and device health reports; share monthly with management.

6. Troubleshooting / common issues

7. Best practices

• Always use Audit mode before Block for ASR rules, controlled folder access and device control.
• Keep tamper protection on so local admins or malware cannot turn Defender off.
• Keep exclusions to a minimum and document the reason for each.
• Remove third-party antivirus once Defender is verified, to avoid conflicts.
• Review incidents daily and device health weekly; set email notifications under Settings > Endpoints > Email notifications (verify location).

8. Glossary

9. Need help with rollout?

Need help planning or rolling this out across your sites? Contact Kalpesh Adhvaryu (IT consultancy) for rollout support, pilot planning and hands-on configuration.

Portal menus change regularly. This guide was checked against Microsoft Learn documentation in October 2026; if a menu name differs in your tenant, search for the setting name in the portal or check the linked Microsoft Learn topic.