Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Vulnerabilities and exposure

Attack Surface Reduction Rules Configure

4 September 2026Doc update+72 / −42 lines

In brief

The page now details precedence among local settings, Group Policy, MDM, and Configuration Manager, including the MDMWinsOverGP setting and OMA-URI. It also updates Intune navigation and explains per-rule exclusions.

What Defender admins need to know

Administrators can use the precedence guidance to troubleshoot conflicting ASR configurations and verify that Intune policies and exclusions are configured in the right locations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • m365-security
  • tier2
  • mde-asr ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-10161015 ms.date: 07/02/08/31/2026 ai-usage: ai-assisted

#customer intent: As a security administrator, I want to configure attack surface reduction rules on devices so that I can block risky software behaviors that attackers exploit. appliesto:

Attack surface reduction (ASR) rules target risky software behavior on Windows devices that attackers commonly exploit through malware (for example, launching scripts that download files, running obfuscated scripts, and injecting code into other processes). This article describes how to enable and configure ASR rules.

For best results, use enterprise-level management solutions like Microsoft Intune or Microsoft Configuration Manager to manage ASR rules. ASR rule settings from Intune or Configuration Manager overwrite any conflicting PowerShell settings from group policy or PowerShell on startup. To learn how conflicts between MDM and Group Policy settings are resolved, see How policy conflicts are handled.

Prerequisites

For more information, see Requirements for ASR rules.

How policy conflicts are handled

When the same ASR rule is configured through more than one method, precedence is resolved as described in the following list:

  • Local device settings (Set-MpPreference): These settings have the lowest precedence. Any policy-based method overwrites them on startup.

  • Group Policy: Overwrites conflicting local device settings on startup. When both Group Policy and a mobile device management (MDM) solution configure the same ASR rule, Group Policy takes precedence by default, unless MDMWinsOverGP is enabled (see the next item). To avoid conflicts, don't configure the same ASR rules in both Group Policy and MDM.

  • MDM: Microsoft Intune or another MDM solution overwrites conflicting local device settings on startup. Whether MDM also overwrites Group Policy depends on the MDMWinsOverGP setting in the ControlPolicyConflict Policy CSP:

    • A value of 0 (the default) means the Group Policy setting takes precedence.
    • A value of 1 means the MDM setting applies and the conflicting Group Policy setting is blocked.

    You can configure MDMWinsOverGPonly through Policy CSP, for example, by using an Intune custom profile with an OMA-URI or in another MDM solution. There's no Group Policy setting or PowerShell cmdlet for it. In an Intune custom profile, use the following setting:

    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP
    Data type: Integer
    Value: 1

  • Microsoft Configuration Manager: Applies ASR rules through the Policy CSP in both classic Exploit Guard policy mode and tenant attach mode, so it follows the same MDM precedence and MDMWinsOverGP behavior.

Configure ASR rules and exclusions in Intune using endpoint security policies

To configure ASR rules using aand exclusions in Microsoft Intune Endpoint SecurityIntune, use an endpoint security Attack surface reduction policy,policy. For detailed instructions, see Create endpoint security policies (opens in aor Modify existing policies (links open new tabtabs in the Intune documentation).

When creatingyou create the policy, use these specific settings:

When you create or modify the policy, use these specific settings on the Configuration settings tab:

  • Attack surface reduction rules: Typically, you can enable the standard protection rules in Block or Warn mode without testing. You should test other ASR rules in Audit mode before you switch them to Block or Warn mode. For more information, see the ASR rules deployment guide.

    After you set the rule mode to Audit, Block, or Warn, an ASR only per rule exclusions section appears where you can specify exclusions that apply to that rule only.

  • Attack surface reduction only exclusions: Use this section to specify exclusions that apply to all ASR rules.

    To specify per-ASR rule exclusions or global ASR rule exclusions, use either of the following methods:

    • Select :::image type="icon" source="media/defender-portal-icon-create.png" border="false"::: Add. In the box that appears, enter the path or path and filename to exclude. For example:

      • C:\folder
      • %ProgramFiles%\folder\file.exe
      • C:\path

    • Select :::image type="icon" source="media/intune-icon-import.png" border="false"::: Import to import a CSV file that contains the names of files and folders to exclude. The CSV file uses the following format: 

      AttackSurfaceReductionOnlyExclusions
"C:\folder"
"%ProgramFiles%\folder\file.exe"
"C:\path"
...

For more information about exclusions, see File and folder exclusions for ASR rules.

Configure global ASR rule exclusions in Intune using custom profiles with OMA-URIs and CSPs

The steps to configure global ASR rule exclusions in Intune using a custom profile are very similar to the ASR rule steps in Configure ASR rules in Intune using custom profiles with OMA-URIs and CSPs. The only difference is on the Configuration settings tab, where you enter the information for ASR rule exceptionsexclusions instead of ASR rules:

On the Configuration settings tab, select Add. In the Add row flyout that opens, configure the following settings:

If your organization manages endpoint security policies in the Microsoft Defender portal, you can configure ASR rules and their exclusions with the same endpoint security policies that Intune uses.

OnFor detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).

When you create the policy on the Windows policies tab of the Endpoint security policies page ofin the Defender portal at https://security.microsoft.com/policy-inventoryhttps://security.microsoft.com/policy-inventory?osPlatform=Windows, select :::image type="icon" source="media/defender-portal-icon-create.png" border="false"::use these specific settings:

  • Select platform: Select Create new policyWindows and then create an.
  • Select template: Select Attack surface reduction rules policy. For.

When you create or modify the full procedure, see Create an endpoint security policy.

Usepolicy, use the sameAttack Surface Reduction Rules profile and settings described in Configure ASR rules and exclusions in Intune using endpoint security policies. on the Configuration settings tab. These settings include global attack surface reduction only exclusions and per-ASR rule exclusions.

When you assign the policy, note that assignment group limitations apply to devices managed through security settings management. For details, see the Assignments step.

Configure ASR rules and exclusions in group policyGroup Policy

  1. In Centralized Group Policy, open the Group Policy Management Console (GPMC)
    1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

    The available settings are described in Configure ASR rules in Group Policy, Configure global ASR rule exclusions in Group Policy, and Configure per-ASR rule exclusions in Group Policy.

    Configure ASR rules in group policyGroup Policy

    Use the following steps to configure ASR rules and their modes in the Group Policy Attack Surface Reduction settings:

    Configure global ASR rule exclusions in group policyGroup Policy

    The paths or filenames with paths you specify are used as exclusions for all ASR rules.

    Configure per-ASR rule exclusions in group policyGroup Policy

    The paths or filenames with paths you specify are used as exclusions for specific ASR rules.

    The following example uses Set-MpPreference to configure four ASR rules in a single command, setting each rule to a different mode (Enabled, Disabled, or AuditMode): 

    Set-MpPreference -AttackSurfaceReductionRules_Ids 26190899-1602-49e8-8b27-eb1d0a1ce869,3b576869-a4ec-4529-8536-b80a7769e899,e6db77e5-3df2-4cf1-b95a-636979351e5b,636979351e5,01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions Enabled,Enabled,Disabled,AuditMode

    Configure global ASR rule exclusions in PowerShell