Allow intrusion Prevention system depreciated.

Question

What's the equivalent of it ? Why MSFT remove this important feature ? How do we protect our devices against Network attack ????

Answer 1

@Étienne Fiset, Thanks for posting in Q&A.

From your description, I know you are looking for a replacement of Intrusion Prevention feature in Intune.

Based on my research, Intrusion Prevention is a feature that helps protect devices from network-based attacks, however you can create a real-time protection policy under Microsoft Defender Antivirus and enable network protection under Microsoft Defender for Endpoint Baseline to protect your devices from being attacked by network to replace Intrusion Prevention.

Here are steps about how to configure real-time protection you can refer.

1.Go to the Microsoft Endpoint Manager admin center > Go to Endpoint security > Antivirus > Microsoft Defender Antivirus.

2.Select Create Policy > Select Windows 10 and Windows 11, and Windows Server (ConfigMgr) as Platform and Select Microsoft Defender Antivirus as Profile > In Configuration settings page, select Real-time protection > Set Turn on real-time protection Yes.

3.In Assignments page, assign it to device group.

https://learn.microsoft.com/en-us/mem/intune/protect/antivirus-microsoft-defender-settings-windows#real-time-protection

Here are steps about how to configure Microsoft Defender for Endpoint Baseline you can refer.

1.Go to the Microsoft Intune admin center > Go to Endpoint security > Security baselines > Microsoft Defender for Endpoint Baseline.

2.Select Create a profile > In the Configuration settings section, go to Attack Surface Reduction Rules > set Enable for Enable network protection.

3.In Assignments, assign it to device group.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-network-protection?view=o365-worldwide#microsoft-defender-for-endpoint-baseline-method

Hope above information can help you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.