This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 50%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
Is AMSI enabled by default in Defender AV or needs to be enabled? If so is there a control available in Intune?
@Pa_D Thanks for posting in our Q&A.
For this issue, AMSI is just an API and it isn't an application. We will call this API to request a scan of the content when writing scripts.
https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
I have done a lot of research, there is no control about AMSI in intune.
Thanks for understanding.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 81%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERA%3C/text%3E%3C/svg%3E)
AMSI is nothing to do with the Microsoft Intune, this is an interface where the developer could call and implement into their application and in case you are a developer you may implement it. However, it has been implemented by default in Microsoft script components like the Windows PowerShell and in case Microsoft Defender is on and user enter an malicious script, it will be blocked.
Got an confirmation from Microsoft PM too, "Windows Defender AV is automatically registered to work with AMSI".