Configure Conditional Access in Microsoft Defender for Endpoint

Artikel
04/24/2024

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

This section guides you through all the steps you need to take to properly implement Conditional Access.

Before you begin

Warning

It's important to note that Microsoft Entra registered devices is not supported in this scenario.
Only Intune enrolled devices are supported.

You need to make sure that all your devices are enrolled in Intune. You can use any of the following options to enroll devices in Intune:

IT Admin: For more information on how to enable auto-enrollment, see Windows Enrollment
End-user: For more information on how to enroll your Windows 10 and Windows 11 device in Intune, see Enroll your Windows 10 device in Intune
End-user alternative: For more information on joining a Microsoft Entra domain, see How to: Plan your Microsoft Entra join implementation.

There are steps you'll need to take in Microsoft Defender XDR, the Intune portal, and Microsoft Entra admin center.

It's important to note the required roles to access these portals and implement Conditional access:

Microsoft Defender XDR - You'll need to sign into the portal with a global administrator role to turn on the integration.
Intune - You'll need to sign in to the portal with security administrator rights with management permissions.
Microsoft Entra admin center - You'll need to sign in as a global administrator, security administrator, or Conditional Access administrator.

Note

You'll need a Microsoft Intune environment, with Intune managed and Microsoft Entra joined Windows 10 and Windows 11 devices.

Take the following steps to enable Conditional Access:

Step 1: Turn on the Microsoft Intune connection from Microsoft Defender XDR
Step 2: Turn on the Defender for Endpoint integration in Intune
Step 3: Create the compliance policy in Intune
Step 4: Assign the policy
Step 5: Create a Microsoft Entra Conditional Access policy

Step 1: Turn on the Microsoft Intune connection

In the navigation pane, select Settings > Endpoints > General > Advanced features > Microsoft Intune connection.
Toggle the Microsoft Intune setting to On.
Click Save preferences.

Step 2: Turn on the Defender for Endpoint integration in Intune

Sign in to the Intune portal
Select Endpoint Security > Microsoft Defender for Endpoint.
Set Connect Windows 10.0.15063+ devices to Microsoft Defender Advanced Threat Protection to On.
Click Save.

Step 3: Create the compliance policy in Intune

In the Azure portal, select All services, filter on Intune, and select Microsoft Intune.
Select Device compliance > Policies > Create policy.
Enter a Name and Description.
In Platform, select Windows 10 and later.
In the Device Health settings, set Require the device to be at or under the Device Threat Level to your preferred level:
- Secured: This level is the most secure. The device cannot have any existing threats and still access company resources. If any threats are found, the device is evaluated as noncompliant.
- Low: The device is compliant if only low-level threats exist. Devices with medium or high threat levels are not compliant.
- Medium: The device is compliant if the threats found on the device are low or medium. If high-level threats are detected, the device is determined as noncompliant.
- High: This level is the least secure, and allows all threat levels. So devices that with high, medium or low threat levels are considered compliant.
Select OK, and Create to save your changes (and create the policy).

Step 4: Assign the policy

In the Azure portal, select All services, filter on Intune, and select Microsoft Intune.
Select Device compliance > Policies> select your Microsoft Defender for Endpoint compliance policy.
Select Assignments.
Include or exclude your Microsoft Entra groups to assign them the policy.
To deploy the policy to the groups, select Save. The user devices targeted by the policy are evaluated for compliance.

Step 5: Create a Microsoft Entra Conditional Access policy

In the Azure portal, open Microsoft Entra ID > Conditional Access > New policy.
Enter a policy Name, and select Users and groups. Use the Include or Exclude options to add your groups for the policy, and select Done.
Select Cloud apps, and choose which apps to protect. For example, choose Select apps, and select Office 365 SharePoint Online and Office 365 Exchange Online. Select Done to save your changes.
Select Conditions > Client apps to apply the policy to apps and browsers. For example, select Yes, and then enable Browser and Mobile apps and desktop clients. Select Done to save your changes.
Select Grant to apply Conditional Access based on device compliance. For example, select Grant access > Require device to be marked as compliant. Choose Select to save your changes.
Select Enable policy, and then Create to save your changes.

Note

You can use the Microsoft Defender for Endpoint app along with the Approved Client app , App Protection policy and Compliant Device (Require device to be marked as compliant) controls in Microsoft Entra Conditional Access policies. There's no exclusion required for the Microsoft Defender for Endpoint app while setting up Conditional Access. Although Microsoft Defender for Endpoint on Android & iOS (App ID - dd47d17a-3194-4d86-bfd5-c6ae6f5651e3) isn't an approved app, it is able to report device security posture in all the three grant permissions.

However, internally Defender requests MSGraph/User.read scope and Intune Tunnel scope (in case of Defender+Tunnel scenarios). So these scopes must be excluded*. To exclude MSGraph/User.read scope, any one cloud app can be excluded. To exclude Tunnel scope, you need to exclude 'Microsoft Tunnel Gateway'.These permission and exclusions enables the flow for compliance information to Conditional Access.

*Please note that applying a Conditional Access policy to All Cloud Apps could inadvertently block user access in some cases, so it's not recommended. Read more about Conditional Access policies on Cloud Apps

For more information, see Enforce compliance for Microsoft Defender for Endpoint with Conditional Access in Intune.