Turn on network protection (audit, then block)¶
Licence and role
Defender for Endpoint Plan 1/2 (Defender Antivirus active mode with real-time, behaviour monitoring and cloud protection on). Windows 10 1709+ / Windows 11 Pro or Enterprise.
Why it matters¶
Network protection stops apps, not just browsers, from connecting to domains that host phishing, exploits and malware. It is also a prerequisite for web content filtering and indicators in browsers other than Edge.
Steps¶
- Intune > Endpoint security > Antivirus > Microsoft Defender Antivirus policy: Enable network protection = Enabled (audit mode) for two weeks.
- Review blocked-in-audit connections with the security team.
- Switch to Enabled (block mode).
- Windows Server: network protection is opt-in (AllowNetworkProtectionOnWinServer); on DNS, file servers and domain controllers set AllowDatagramProcessingOnWinServer to false.
Impact on users¶
Block mode stops connections to malicious or suspicious domains for every app on the device. Users see a notification.
Rollback¶
Set Enable network protection back to audit mode or Disabled.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Windows with Microsoft Defender Antivirus (Defender PowerShell module is built in). No tenant connection.
Run on 3-5 sample devices per device type (laptops, kiosks, servers) as administrator.
Tenant-wide views are in the Microsoft Defender portal (Reports > Device health; Advanced hunting) as described in each control.
Get-MpPreference | Select-Object EnableNetworkProtection | Format-List | Out-String
'0 = off, 1 = block, 2 = audit'
How to verify¶
EnableNetworkProtection is 1 (block) on sample devices after the audit period.
Sources¶
This control is in the Defender for Endpoint and ASR Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 15 controls.