Turn on tamper protection tenant-wide¶
Licence and role
Defender for Endpoint Plan 1/2, Defender for Business or Microsoft Defender Antivirus (per Learn 'Applies to').
Why it matters¶
Attackers who reach admin rights try to switch off real-time protection or add exclusions first. With tamper protection on, those settings can't be changed on the device, and exclusions can't be added or modified locally.
Steps¶
- Microsoft Defender portal > Settings > Endpoints > Advanced features: turn on Tamper protection for the tenant (or use Intune for selected devices).
- Run the read-only check on sample devices: IsTamperProtected should be True.
- Tell the desktop team: changes to protected settings may appear to succeed but are silently blocked; use troubleshooting mode for legitimate changes.
- Note: Microsoft is renaming tamper protection to controlled configuration in management experiences, with no change in behaviour.
Impact on users¶
Local and Group Policy changes to protected antivirus settings and exclusions are ignored. Changes must come from your management tool or troubleshooting mode.
Rollback¶
Turn tamper protection off in the portal or exclude a device in Intune (this lowers protection; prefer troubleshooting mode).
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Windows with Microsoft Defender Antivirus (Defender PowerShell module is built in). No tenant connection.
Run on 3-5 sample devices per device type (laptops, kiosks, servers) as administrator.
Tenant-wide views are in the Microsoft Defender portal (Reports > Device health; Advanced hunting) as described in each control.
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled | Format-List
How to verify¶
IsTamperProtected is True on sample devices of every type.
Sources¶
This control is in the Defender for Endpoint and ASR Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 15 controls.