You have an Azure AD tenant and 100 Windows 10 devices that are Azure AD joined and managed by using Microsoft Intune. You need to configure…

For Azure AD joined and Intune-managed Windows devices, Microsoft Intune is the designated management platform. To minimize administrative effort, configurations should be applied using Intune profiles rather than legacy tools like Group Policy Objects (GPOs).

The Endpoint protection device configuration profile template in Intune is specifically designed to consolidate security settings. This single profile type contains distinct categories for configuring both Microsoft Defender Antivirus (e.g., real-time protection, scan settings, exclusions) and Microsoft Defender Firewall (e.g., domain, private, and public network settings, connection security rules). Using this profile type provides a centralized and efficient method to manage these security features.

A. GPOs are designed for on-premises Active Directory and are not the native or most efficient management tool for Azure AD joined, Intune-managed devices.

B. The Device restrictions profile template is used for general device settings like password requirements or hardware limitations, not for configuring Microsoft Defender Firewall.

D. The Device restrictions profile template does not contain the comprehensive settings required to manage Microsoft Defender Antivirus policies.

F. GPOs are not the appropriate tool for this scenario; Intune configuration profiles should be used for cloud-managed endpoints to minimize administrative effort.

1. Microsoft Learn. "Windows 10/11 (and later) settings to protect devices using Intune." Microsoft Intune documentation. This document details the settings available in the Endpoint protection profile template. Under the "Settings" section

it explicitly lists "Microsoft Defender Firewall" and "Microsoft Defender Antivirus" as configurable categories within this profile type.

2. Microsoft Learn. "Endpoint protection settings for Windows 10/11 in Microsoft Intune." Microsoft Intune documentation. This article provides a comprehensive list of settings. The "Microsoft Defender Antivirus" section details the antivirus configurations

and the "Microsoft Defender Firewall" section details the firewall settings

all managed within the Endpoint protection profile.

3. Microsoft Learn. "Overview of device profiles in Microsoft Intune." Microsoft Intune documentation. This document explains the purpose of different profile types

stating

"Use these profiles to configure device security settings. For example

you can configure endpoint protection settings for Windows devices

including BitLocker and Microsoft Defender." This confirms Endpoint protection is the correct profile type for security features.