Intune + AMSI (Defender AV feature)

Question

Intune + AMSI (Defender AV feature)

Pa_D 1,076

Is AMSI enabled by default in Defender AV or needs to be enabled? If so is there a control available in Intune?

Lu Dai-MSFT 28,531 Reputation points

2021-06-17T06:11:37.797+00:00

@Pa_D Thanks for posting in our Q&A.

For this issue, AMSI is just an API and it isn't an application. We will call this API to request a scan of the content when writing scripts.
https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps

I have done a lot of research, there is no control about AMSI in intune.

Thanks for understanding.

Answer accepted by question author

0 additional answers

Your answer

Lu Dai-MSFT 28,531 Reputation points

2021-06-17T06:11:37.797+00:00

@Pa_D Thanks for posting in our Q&A.

For this issue, AMSI is just an API and it isn't an application. We will call this API to request a scan of the content when writing scripts.
https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps

I have done a lot of research, there is no control about AMSI in intune.

Thanks for understanding.

Answer 1

Reza-Ameri 45,816 Volunteer Moderator

AMSI is nothing to do with the Microsoft Intune, this is an interface where the developer could call and implement into their application and in case you are a developer you may implement it. However, it has been implemented by default in Microsoft script components like the Windows PowerShell and in case Microsoft Defender is on and user enter an malicious script, it will be blocked.

Pa_D 1,076 Reputation points

2021-06-17T16:38:07.627+00:00

Got an confirmation from Microsoft PM too, "Windows Defender AV is automatically registered to work with AMSI".

Share via

Intune + AMSI (Defender AV feature)

0 additional answers

Your answer