Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configuration protection in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

29 September 2026Doc update+50 / −50 lines

In brief

The page title, description, headings, tables, and references now use “Configuration protection” instead of “Controlled configuration.” The documented enforcement behavior and rules were correspondingly renamed.

What Defender admins need to know

Administrators should use the new term when searching for or referring to this capability. No required administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Controlled configurationConfiguration protection in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Important

The features described in this article are currently in Preview, aren't available in all organizations, and are subject to change.

Controlled configurationConfiguration protection is a configuration enforcement model that makes cloud-managed policy the single source of truth for Microsoft Defender Antivirus settings. When controlled configuration protection is enabled, Intune and Microsoft Defender for Endpoint policies take precedence. The device ignores settings from Group Policy, scripts, Microsoft Configuration Manager, and local admin changes.

Controlled configurationConfiguration protection eliminates configuration drift and policy conflicts by extending tamper-protection-style enforcement to the entire Defender Antivirus configuration surface.

Tamper protection and controlled configuration protection are complementary but distinct capabilities:

Feature Tamper protection Controlled configurationConfiguration protection
Scope Small fixed set of security settings (~10-13 settings) Entire Defender Antivirus configuration surface
Configuration source Microsoft-defined defaults only Organization-defined cloud policy (Intune/Defender for Endpoint)
Customization No customization Full policy-driven control
Enforcement Prevents disabling critical protections Overrides all non-cloud configuration channels

Controlled configurationConfiguration protection is a superset of tamper protection that provides policy-driven control over the full Microsoft Defender Antivirus configuration.

Note

Although tamper protection and controlled configuration protection can technically be turned on at the same time, we recommend that your organization selects one or the other.

Prerequisites

  • Devices must run Microsoft Defender for Endpoint EDR Sensor version later than 10.8804 (September 2025).
  • Devices must run Microsoft Defender Antivirus platform version 4.18.26060.3004 or later (June 2026).

Controlled configurationConfiguration protection doesn't currently support:

  • Co-management (Configuration Manager + Intune) environments.
  • GCC High environments.

What controlled configuration protection covers

Currently, controlled configuration protection provides protection and enforcement for Microsoft Defender Antivirus settings, including:

  • Antivirus configuration (scan settings, exclusions, updates)
  • Attack surface reduction (ASR) policies
  • Defender Configuration Service Provider (CSP) and Policy CSP surface (broad set of antivirus-related controls)
  • Local admin merge behavior

Currently, controlled configuration protection doesn't cover:

  • Microsoft Defender Device Control
  • Endpoint detection and response (EDR) settings
  • Windows operating system settings (such as Firewall)

How controlled configuration protection enforcement works

Controlled configurationConfiguration protection enforces cloud-managed policy through three mechanisms:

  • Single-source enforcement: When controlled configuration protection is enabled, the following enforcement rules apply:

    • Only Intune and Defender for Endpoint policies are honored for Defender Antivirus settings.
    • Group Policy Object (GPO), scripts, Configuration Manager, and local admin changes are ignored.
    • Microsoft Defender Antivirus doesn't honor local exclusions. Organizations can still choose to allow local administrator-defined exclusions by enabling the local administrator merge setting through policy. When local administrator merge is enabled, locally defined exclusions can be merged with centrally managed exclusions.

  • Secure defaults: If a setting isn't explicitly configured in a policy, controlled configuration protection applies Microsoft-defined defaults. This behavior ensures that devices maintain a strong security posture even when administrators haven't configured every available setting.

  • Conflict resolution: Controlled configurationConfiguration protection uses a value-based precedence model rather than a last-write-wins model:

    • On takes precedence over Off. If one policy sets controlled configuration protection to On and another sets it to Off, the feature stays enabled on the device.
    • If multiple policies assign different values, a conflict is reported, but the On value is still enforced.
    • If multiple policies assign the same value, the result is success with no conflict.

    Important

    Not configured doesn't mean Off. To disable the feature, explicitly deploy a policy that sets controlled configuration protection to Off.

Enable controlled configuration protection

You can enable controlled configuration protection through either Microsoft Intune or Microsoft Defender for Endpoint security settings managementMicrosoft Defender for Endpoint security settings management.

Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and it isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. If you don't have Intune, you can use any of the other methods in this article. For more information, see Microsoft Intune licensing.

Controlled configurationConfiguration protection is configured through the same policy surface as tamper protection. In the Windows Security Experience profile, Intune renames the tamper protection setting to Controlled Configuration protection (Device) when controlled configuration protection is available. You can't enable controlled configuration protection through the Settings Catalog or the Device Control v1 (DCv1) template.

Because controlled configuration protection and tamper protection use the same policy setting, setting Controlled Configuration protection (On) supersedes the tamper protection value on that device. You don't deploy separate tamper protection and controlled configuration protection policies for the same setting. To migrate existing tamper protection (DCv1) policies to controlled configuration,configuration protection, create a Windows Security Experience policy with Controlled Configuration protection (On), then remove the tamper protection setting from your DCv1 policies to avoid conflicts.

  1. On the Endpoint security page in the Microsoft Intune admin center at https://intune.microsoft.com, create a new Windows Security Experience profile or edit an existing one.
  2. Locate the Controlled Configuration protection (Device) setting (formerly Tamper Protection).
  3. Set the value to Controlled Configuration protection (On) to enable controlled configuration.configuration protection.
  4. Assign the policy to the appropriate device groups.

Minimum client version and rollback

Before you assign Controlled Configuration protection (On), update devices to Microsoft Defender Antivirus platform version 4.18.26060.3004 or later, and validate the deployment with a pilot group.

On devices with earlier platform versions, Intune might send Controlled Configuration protection (On) and Tamper Protection (Off), but the device might apply only the tamper protection setting. This behavior leaves both controlled configuration protection and tamper protection turned off.

To roll back, change the Windows Security Experience policy from Controlled Configuration protection (On) to Tamper Protection (On), redeploy the policy, sync the affected devices, and verify that tamper protection is enabled. Normal policy delivery latency applies.

Reporting and monitoring

Controlled configurationConfiguration protection status is visible in both the Intune admin center and the Microsoft Defender portal, depending on how devices are managed.

  • Intune: For devices enrolled directly through Intune by using Mobile Device Management (MDM), you can view:

    • Policy status (Success, Conflict, or Error)
    • Device-level controlled configuration protection status

  • Microsoft Defender portal: For devices managed through Defender for Endpoint security settings management, check the Microsoft Defender portal for effective configuration state.

    Note

    These devices aren't visible in Intune reports. Use the Microsoft Defender portal to verify the effective controlled configuration protection state.

Verify controlled configuration protection on a device

To confirm the controlled configuration protection state directly on a device, run the following PowerShell cmdlet:

Get-MpComputerStatus

Review the following properties in the output:

- **ControlledConfigurationState**: The current controlled configuration protection enforcement state on the device.
- **IsTamperProtected**: Indicates whether tamper protection (the foundation of controlled configuration)configuration protection) is active.
- **TamperProtectionSource**: The source that enforces the current state.

You can also use `Get-MpComputerStatus` to confirm that the Microsoft Defender Antivirus platform version meets the prerequisites, and to validate the configuration state after a policy change or a controlled configuration protection reset.

## Lifecycle behaviors

Controlled configurationConfiguration protection behavior varies depending on device lifecycle changes:

- **Policy unassignment**: Controlled configurationConfiguration protection is removed from the device unless another controlled configuration protection policy still applies.
- **Defender for Endpoint unenrollment**: Controlled configurationConfiguration protection remains **On** (not cleaned up automatically).
- **Device offboarding**: Controlled configurationConfiguration protection is removed and reset to **Off**.

## Reset controlled configuration protection on a device

To clear the controlled configuration protection state on a device, run the following commands in an elevated Command Prompt (a Command Prompt window you opened by selecting **Run as administrator**):

Tip


## Known limitations

Currently, the following limitations apply to controlled configuration:configuration protection:

- You might see false conflicts in Intune when both tamper protection and controlled configuration protection policies target the same device.
- You might see reporting inconsistencies between the Intune admin center and the Microsoft Defender portal.
- Coverage is limited to Microsoft Defender Antivirus settings (device control, EDR, and firewall aren't yet covered).
\ No newline at end of file
- When you turn on controlled configuration protection through Microsoft Defender for Endpoint security settings management or Intune, tamper protection is turned off, unless another tamper protection policy explicitly sets tamper protection to on. When controlled configuration protection is on and tamper protection is off, the tamper protection secure score is lower. We're working to address this gap.
\ No newline at end of file
\ No newline at end of file