Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Endpoint protection

Mdb Firewall

1 October 2026Doc update+21 / −27 lines

In brief

The article updates wording, links, step references, and portal terminology such as “flyout pane.” Instructions continue to cover firewall policies, custom rules, profiles, and the 150-rule limit.

What Defender admins need to know

No administrator action is required. Use the revised instructions when managing Defender for Business firewall settings.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

You can use firewall protection to specify whether to allow or to block connections on devices in various locations. For example, your firewall settings can allow inbound connections on devices that are connected to your company's internal network but prevent connections when the device is on a network with untrusted devices.

This article describes:

  • How to view or edit your firewall policies and custom rules
  • Default firewall settings in Defender for Business
  • Firewall settings you can configure in Defender for Business

View or edit your firewall policies and custom rules

Depending on whether you're using the Microsoft Defender portal or Intune to manage your firewall protection, use one of the following procedures.

  1. Go to the Microsoft Defender portal (https://security.microsoft.com), and sign in.

  2. In the navigation pane, choose Device configuration. Policies are organized by operating system and policy type.

  3. Select an operating system tab (suchtab, such as Windows clients).

  4. Expand Firewall to view your list of policies.

  5. Select a policy to view the details. To make changes or to learn more about policy settings, see the following articles:

  6. Go to https://intune.microsoft.com and sign in. You're now in the Intune admin center.

  7. Select Endpoint security.

  8. Select Firewall to view your policies in that category. Custom rules that are definedyou define for firewall protection are listedappear as separate policies. To get help with managing your security settings in Intune, start with Manage endpoint security in Microsoft Intune.

Manage your custom rules for firewall policies in Microsoft Defender for Business

You can useUse custom rules to define exceptions for your firewall policies. That is, you canFor example, use custom rules to block or allow specific connections.

Create a custom rule for a firewall policy

  1. Go to the Microsoft Defender portal (Microsoft Defender portal) and sign in.

  2. Go to Endpoints > Device configuration, and review the list of policies.

  3. In the Firewall section, select an existing policy, or add a new policy.

  4. On the Configuration settings step,page, review the settings. Make any needed changes to Domain network, Public network, and Private network.

  5. To create a custom rule, follow these steps:

    1. Under Custom rules, choose + Add rule. (YouYou can have up to 150 custom rules.)
    2. On the Create new rule flyout,flyout pane, specify a name and description for the rule.
    3. Select a profile. (YourYour options include Domain network, Public network, or Private network.)
    4. In the Remote address type list, select either IP or Application file path.
    5. In the Value box, specify an appropriate value. Depending on what you selected in step 6d,the previous step, you might specify an IP address, an IP address range, or an application file path. (SeeSee Firewall settings.)
    6. On the Create new rule flyout,flyout pane, select Create rule.

  6. On the Configuration settings screen, choose Next.

  7. On the Review your policy screen, review the changes that were made to firewall policy settings. Make any needed changes, and then choose Create policy.

Edit a custom rule for a firewall policy

  1. Go to the Microsoft Defender portal (Microsoft Defender portal) and sign in.

  2. Go to Endpoints > Device configuration, and review the list of policies.

  3. In the Firewall section, select an existing policy, or add a new policy.

  4. Under Custom rules, review the list of rules.

  5. Select a rule, and then choose Edit. Its flyout pane opens.

  6. To edit your custom rule, follow these steps:

    1. On the Edit rule flyout,flyout pane, review and edit the rule's name and description.
    2. Review and if necessary, edit the rule's profile. (YourYour options include Domain network, Public network, or Private network.)
    3. In the Remote address type list, select either IP or Application file path.
    4. In the Value box, specify an appropriate value. Depending on what you selected in step 6c,the previous step, you might specify an IP address, an IP address range, or an application file path. (SeeSee Firewall settings.)
    5. Set Enable rule to On to make the rule active. Or, to disable the rule, set the switch to Off.
    6. On the Edit rule flyout, select Update rule.

  7. On the Configuration settings screen, choose Next.

Delete a custom rule

  1. Go to the Microsoft Defender portal (Microsoft Defender portal) and sign in.
  2. Go to Endpoints > Device configuration, and review the list of policies.
  3. In the Firewall section, select an existing policy, or add a new policy.
  4. Under Custom rules, review the list of rules.
  5. Select a rule, and then choose Delete. Its flyout pane opens.
  6. On the confirmation screen, choose Delete.

Default firewall settings in Defender for Business

Firewall settings you can configure in Defender for Business

Defender for Business includes firewall protection through Windows Firewall. The following table lists settings that you can be configuredconfigure in Defender for Business.

Setting Description
Domain network The domain network profile applies to your company's network. Firewall settings for your domain network apply to inbound connections that are initiated on other devices on the same network.network initiate. By default, incoming connections are set to Block all.
Public network The public network profile applies to networks that you can use in a public location, such as a coffee shop or airport. Firewall settings for public networks apply to inbound connections that are initiated on other devices on the same network.network initiate. Because a public network can include devices that you don't know or don't trust, set incoming connections are set to Block all by default.
Private network The private network profile applies to networks in a private location, such as your home. Firewall settings for private networks apply to inbound connections that are initiated on other devices on the same network.network initiate. In general, you can trust all devices on the same private network are assumed to be trusted devices.network. However, by default, incoming connections are set to Block all.
Custom rules Custom rules let you block or allow specific connections. For example, you want to block all incoming connections on devices connected to a private network except for connections through a specific app on a device. Set Private network to block all incoming connections, and then add a custom rule to define the exception. You can use custom rules to define exceptions for specific files, apps, or IP addresses. For example:
- App file path: C:\Windows\System\Notepad.exe or %WINDIR%\Notepad.exe.
- Single IPv4 or IPv6 address: 192.168.11.0 or fd12:3456:789a:1::1.
- IPv4 or IPv6 Classless Inter-Domain Routing (CIDR): 192.168.1.0/24 or fd12:3456:789a::/64.
- IPv4 or IPv6 address range: 192.168.1.0-192.168.1.9 or fd12:3456:789a::1—fd12:3456:789a::ffff (no spaces).
\ No newline at end of file