3.5MD-102Intermediate
Est: ~15 mins•Verified: 2026-08

Windows Firewall & Network Protection via Intune

Configure host-based firewall profiles (Domain, Private, Public), rule merging logic, and SmartScreen Network Protection to safeguard endpoints against network intrusions.

Tags:#Firewall#Network Protection#SmartScreen#Security#Intune#MD-102
01

Overview

Microsoft Defender Firewall with Advanced Security provides two-way host-based stateful packet inspection on Windows endpoints.

Managing Firewall through Microsoft Intune Endpoint Security policies provides centralized governance:

  1. Three Profile Segmentation: Individual settings for Domain (connected to corporate network), Private (home/trusted LAN), and Public (cafes, airports, untrusted Wi-Fi).
  2. Rule Merging Control: Dictates whether local administrator-created firewall rules or third-party installer rules are merged with corporate Intune baselines (RuleMerger).
  3. Network Protection (SmartScreen): Extends Microsoft Defender SmartScreen protection to block outbound network connections to known phishing domains, C2 servers, and low-reputation IP addresses across ALL applications (not just Edge browser).

---

02

When to Use

CapabilityRecommended SettingProduction Rationale
Inbound ConnectionsBlock All (Default)Protects endpoints from lateral network scanning and worms when working from untrusted Wi-Fi.
Outbound ConnectionsAllow (Default)Permits legitimate user internet traffic while monitoring via Network Protection.
Local Firewall Rules MergeBlock / DisablePrevents local users and installers from punching unauthorized holes in the firewall.
Network ProtectionEnabled (Block Mode)Intercepts rogue DNS/HTTP/HTTPS calls from PowerShell, malware payloads, or non-browser tools.

---

03

Prerequisites

Tenant & Licensing Requirements:

  • Intune License: Microsoft 365 E3/E5, Business Premium, or standalone Intune Plan 1.
  • Admin Role: Endpoint Security Manager or Intune Administrator.

Endpoint Requirements:

  • Windows 11 or Windows 10 (1709+ for basic firewall; 1803+ for Network Protection).
  • Windows Defender Antivirus real-time protection must be active (Network Protection hooks into Defender AV network filter driver WdFilter.sys).

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
    ├── Firewall
    │   ├── Create Policy > Windows 10, Windows 11, and Windows Server
    │   │   ├── Profile: Microsoft Defender Firewall (Profile states & rule merging)
    │   │   └── Profile: Microsoft Defender Firewall rules (Custom inbound/outbound rules)
    └── Attack surface reduction
        └── Create Policy > Windows 10 and later
            └── Profile: Web protection / Network Protection

---

05

Step-by-Step Implementation

Step 1: Configure Firewall Base Profile & Rule Merging

  1. In Intune, navigate to Endpoint security > Firewall > Create Policy.
  2. Platform: Windows 10, Windows 11, and Windows Server | Profile: Microsoft Defender Firewall.
  3. Name the policy: Sec-Firewall-Enterprise-Baseline.
  4. Configure settings across Domain, Private, and Public profiles:
  • Turn on Defender Firewall: True.
  • Default inbound action: Block.
  • Default outbound action: Allow.
  • Shielded (Block all incoming connections, including rules): Set to True for Public profile.
  • Disable rule merge from local policy: True (Locks down firewall against local overrides).
  1. Assign to All Corporate Devices.

Step 2: Create Custom Firewall Inbound Rules

  1. Under Endpoint security > Firewall, click Create Policy.
  2. Platform: Windows 10, Windows 11, and Windows Server | Profile: Microsoft Defender Firewall rules.
  3. Click Add Rule (e.g., allow enterprise remote support tool):
  • Name: Allow-Internal-Admin-SSH
  • Direction: Inbound
  • Action: Allow
  • Network types: Domain, Private
  • Protocol: TCP (Port 22)
  • Local address: Any | Remote address: 10.50.0.0/16 (Management subnet).

Step 3: Enable Network Protection (SmartScreen Web Defense)

  1. Go to Endpoint security > Attack surface reduction > Create Policy.
  2. Profile: Attack Surface Reduction Rules (or Web Protection).
  3. Find setting: Enable network protection > Set to Enabled (Block).
  4. Save and assign to all Windows devices.

---

06

PowerShell Automation

Inspect Active Firewall Profile State Locally:

PowerShell
# Query status of all 3 firewall profiles
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction, AllowInboundRules, AllowLocalFirewallRules

# Check if Network Protection is actively running in Block mode
Get-MpPreference | Select-Object EnableNetworkProtection

(EnableNetworkProtection value 1 = Enabled/Block; 2 = Audit mode).

Test Network Protection with Microsoft Evaluation URL:

PowerShell
# Attempt network handshake against Microsoft safe evaluation test site
# This will be blocked and log Event ID 1125/1126
Invoke-WebRequest -Uri "https://smartscreentestratings2.net" -UseBasicParsing

---

07

Microsoft Graph Automation

Query Firewall Policy Settings via Graph:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# List all Endpoint Security Firewall policies
Get-MgDeviceManagementIntent | 
    Where-Object { $_.DisplayName -like "*Firewall*" } | 
    Select-Object id, displayName, description, lastModifiedDateTime

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
All three firewall profiles (Domain, Private, Public) show Enabled : True.
Attempting to modify firewall settings via local wf.msc shows "These settings are managed by your administrator".
Network Protection is active (Get-MpPreference.EnableNetworkProtection = 1).
Inbound port scans (Nmap) against untrusted Wi-Fi show all ports filtered/closed.
Visiting smartscreentestratings2.net triggers a Windows Defender SmartScreen notification block.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
Firewall Advanced Security LogApplications and Services Logs > Microsoft > Windows > Windows Firewall With Advanced Security > FirewallLogs rule additions, profile changes, and dropped packet events (Event IDs 2003, 2004).
Network Protection Operational LogApplications and Services Logs > Microsoft > Windows > Windows Defender > OperationalRecords network blocks (Event ID 1125 = Block; Event ID 1126 = Audit).
Firewall Dropped Packet LogC:\Windows\System32\LogFiles\Firewall\pfirewall.logDetailed text log of dropped TCP/UDP packets when logging is enabled.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Event ID 2003: Rule skippedConflicting GPO exists on machine that takes precedence over Intune MDM policy.Use MDM wins over GPO policy setting (ControlPolicyConflict/MDMWinsOverGPO = 1) or remove old GPOs.
Network Protection blocks legitimate business siteFalse positive in SmartScreen cloud reputation intelligence.Add URL/IP to Tenant Allow/Block Lists at security.microsoft.com under Indicators (URLs/Domains).
Local apps break after firewall policyDisableRuleMerge was set to True, blocking rules created automatically by installed apps.Identify required application ports and author explicit Intune Firewall Rules for those applications.

---

11

Production Best Practices

Production Best Practice

Stage Network Protection in Audit Mode First:

Before setting Enable Network Protection to Block, deploy it in Audit Mode (2) for 14 days. Review Windows Defender Event ID 1126 in your central SIEM/Log Analytics to catch any internal line-of-business applications communicating with low-reputation IP ranges.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Rule Merge Precedence: If AllowLocalFirewallRules is set to False, only Intune MDM rules apply; all locally defined rules are completely ignored.
  2. Network Protection Scope: Network Protection operates at the network packet layer (IP/Winsock) and protects ALL processes (including cURL, PowerShell, and third-party browsers like Chrome/Firefox).
  3. Public Profile Shielding: Setting Shielded to True blocks all incoming traffic regardless of whether an explicit Allow rule exists.

---

13

Official Documentation

PREVIOUS TOPIC3.4 Defender for Endpoint: Intune EDR OnboardingNEXT TOPIC4.1 Settings Catalog & Administrative Templates (ADMX)