MDE Network Protection Policy Deployment Using Intune HTMD Blog

Let’s learn MDE Network Protection Policy Deployment using Intune. You can easily enable Microsoft Defender Network Protection using Intune. We have covered several articles about Microsoft Defender integration with Intune; Onboarding Intune managed devices into Microsoft Defender using Intune policies, etc.

Microsoft Defender Network Protection is a feature of Microsoft Defender Antivirus that helps you to protect devices from accessing malicious domains and IP addresses. The Network Protection policy allows you to configure settings related to network protection, such as blocking inbound and outbound connections, blocking specific IPs or domains, and enabling network firewall rules.

Network protection helps protect devices from Internet-based events. Network protection is an essential attack surface reduction capability crucial in safeguarding devices from internet-based threats. By enabling network protection, you create an additional layer of defense that helps prevent employees from accessing dangerous domains through various applications.

With network protection in place, potentially harmful domains hosting phishing scams, exploit-hosting sites, and other malicious content are effectively blocked. This proactive measure protects employees from inadvertently exposing themselves or the organization to online threats.

How to Configure Defender Network Protection Policy on a Windows Device?

MDE Network Protection Policy Deployment using Intune 1

You can use Intune Antivirus template to configure Defender Network Protection Policy on a Windows Device and deploy the Microsoft Defender network protection policy.

What are Intune Security Policies?

MDE Network Protection Policy Deployment using Intune 2

Intune Security Policies refer to the set of configuration settings and rules that you can define and enforce on devices managed through Microsoft Intune, and it also helps you to secure the managed devices.

MDE Network Protection Policy Deployment using Intune – Video

The video series on Microsoft Defender Network Protection Policy Deployment using Intune provides comprehensive insights into the features, configuration, and deployment of this powerful security capability.

It covers all the essential aspects of Microsoft Defender Network Protection, including enabling the feature and leveraging Intune for seamless implementation.

MDE Network Protection Policy Deployment using Intune – Video 1

Windows CSP Details EnableNetworkProtection

Let’s see Windows CSP Details for EnableNetworkProtection. You can enable or disable Microsoft Defender Exploit Guard network protection to safeguard your organization’s employees from accessing dangerous domains hosting phishing scams, exploit-hosting sites, and other malicious content on the internet.

Allow Value	Description
0 (Default)	Disabled.
1	Enabled (block mode).
2	Enabled (audit mode).

MDE Network Protection Policy Deployment using Intune – Table 1

CSP URI – ./Device/Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection

MDE Network Protection Policy Deployment using Intune - fig.1 — MDE Network Protection Policy Deployment using Intune – fig.1

Enable MS Defender Network Protection (Block)

Sign in to the Intune Admin Center portal and select the Endpoint security on the left side of the Microsoft Intune admin center. Endpoint security is the comprehensive approach to safeguarding devices such as desktops, laptops, mobile phones, and tablets against many malicious threats and cyberattacks.

Select Antivirus from Endpoint Security
Select Create Policy from the below window

MDE Network Protection Policy Deployment using Intune - fig.2 — MDE Network Protection Policy Deployment using Intune – fig.2

Windows Defender Antivirus is the next-generation protection component of Microsoft Defender for Endpoint. Next-generation protection combines machine learning,big-data analysis, in-depth threat resistance research, and cloud infrastructure to protect devices in your enterprise organization.

Select the Platform as Windows 10, Windows 11, and Windows Server
Select Profile as Microsoft Defender Antivirus

MDE Network Protection Policy Deployment using Intune - fig.3 — MDE Network Protection Policy Deployment using Intune – fig.3

Select the Name and Description on the Basic tab as Enable MS Defender Network Protection ( Block). The Platform is automatically selected as Windows 10 and later.

MDE Network Protection Policy Deployment using Intune - fig.4 — MDE Network Protection Policy Deployment using Intune – fig.4

Configuration settings are an important step for the Deployment of a Network Protection Policy using Intune. Expand the Defender dropdown arrow and search for Network protection. By default, the Network protection is Not configured means Disabled.

Policy Name	Description
Enable Network Protection	This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. The value type is an integer. If you enable this setting, network protection is turned on, and employees can’t turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the Block option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. If you enable this policy with the Audit option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center. If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center. If you do not configure this policy, network blocking will be disabled by default.

Policy Name

Description

Enable Network Protection

This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. The value type is an integer.

If you enable this setting, network protection is turned on, and employees can’t turn it off. Its behavior can be controlled by the following options: Block and Audit.

If you enable this policy with the Block option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center.

If you enable this policy with the Audit option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center.

If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center.

If you do not configure this policy, network blocking will be disabled by default.

MDE Network Protection Policy Deployment using Intune – Table 2

MDE Network Protection Policy Deployment using Intune - fig.5 — MDE Network Protection Policy Deployment using Intune – fig.5

The below settings window shows the scope tag section. If you don’t select a scope tag, then the Default scope tag is automatically selected. These scope tags allow you to apply settings selectively to devices, users, or other entities within defined categories.

MDE Network Protection Policy Deployment using Intune - fig.6 — MDE Network Protection Policy Deployment using Intune – fig.6

In the Assignments section of Intune, you can include or exclude specific groups for a policy or resource. Click the “Add Groups” button below to add a specific group. Here we are adding HTMD Anoop Test Group. You can easily exclude groups by clicking the Add group button from Excluded groups.

MDE Network Protection Policy Deployment using Intune - fig.7 — MDE Network Protection Policy Deployment using Intune – fig.7

The “Review + Create” tab offers a comprehensive overview, allowing you to verify and confirm all the specified information before finalizing the creation. It summarizes the item’s attributes, ensuring everything aligns with your intended configuration.

MDE Network Protection Policy Deployment using Intune - fig.8 — MDE Network Protection Policy Deployment using Intune – fig.8

Use PowerShell Command to Check the Results

Once you create the policy and deploy it to the devices, you can easily check it using a PowerShell command. You can use the command line called MpPreference and select EnableNetworkProtection, as you can see from the below window.

EnableNetworkProtection the Value is 1

MDE Network Protection Policy Deployment using Intune - fig.9 — MDE Network Protection Policy Deployment using Intune – fig.9

The Intune portal shows that one device has succeeded, and you can see the details information by clicking the View Report button below.

MDE Network Protection Policy Deployment using Intune - fig.10 — MDE Network Protection Policy Deployment using Intune – fig.10

In the below-displayed window, you will see 2 sets of information regarding the settings: the settings name and the setting status. The settings name, “Enable Network Protection,” is a clear identifier for the configuration or policy implemented.

The setting status, denoted as “Succeeded,” signifies that the implementation of the “Enable Network Protection” settings has been completed successfully.

MDE Network Protection Policy Deployment using Intune - fig.11 — MDE Network Protection Policy Deployment using Intune – fig.11

Author

About Author – Vidya is a computer enthusiast. She is here to share quick tips and tricks with Windows 11 or Windows 10 users. She loves writing on Windows 11 and related technologies. She is also keen to find solutions and write about day-to-day tech problems.