Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Endpoint protection

View or Edit Policies in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

13 October 2026Doc update+42 / −42 lines

In brief

The article’s title, wording, formatting, and links were revised. Guidance on next-generation protection, firewall policies, controlled folder access, and attack surface reduction was reorganized and simplified.

What Defender admins need to know

Administrators can use the updated article to more easily understand default policy types and available security controls.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

View or edit policiesEdit Policies in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

In Defender for Business, you configure security settings are configured through policies that are applied to devices. To help simplify your setup and configuration experience, Defender for Business includes several preconfigured policies. These policies to help protect your company's devices as soon as they're onboarded. There areyou onboard them. You can also create other types of policies you can create as well (seepolicies. For more information, see Set up, review, and edit your security policies and settings in Microsoft Defender for Business).

This article describes how to view, edit, and create security policies in Defender for Business.

This article includes:includes:

  • A list of default policies that are included in Defender for Business (Next-generation protection and firewall)
  • Extra policies that you can be set up in Defender for Business (Web content filtering, controlled folder access, and attack surface reduction rules)
  • How to view existing policies
  • How to edit an existing policy
  • How to create a new policy

Default policies in Defender for Business

In Defender for Business, there are two main types of default policies that are designed to protect your company's devices as soon as they're onboarded:you onboard them:

  • Next-generation protection policies, which determine how Microsoft Defender Antivirus and other threat protection features are configured; and

  • Firewall policies, which determine what network traffic is permitted to flow to and from your company's devices.
configured.

Next-generation protection Next-generation protection includes robust antivirus and anti-malware protection for computers and mobile devices. The default policies are designed to protect your devices and users without hindering productivity. However, youYou can customize your policies to suit your business needs. For more information, see Review or edit your next-generation protection policies.

  • Firewall policiesFirewall policies determine what network traffic is permitted to flow to and from your company's devices.

    Firewall policies help secure devices by establishing rules that determine what network traffic is permitted to flow to and from devices. You can use firewall protection to specify whether to allow or to block connections on devices in various locations. For example, your firewall settings can allow inbound connections on devices that are connected to your company's internal network, but prevent connections when the device is on a network with untrusted devices. For more information, see Firewall in Microsoft Defender for Business.

    • Policies to set up in Defender for Business

    In addition to next-generation protection and firewall policies, there are three other types of policies to configure for the best protection with Defender for Business:

    • Web content filtering, which enables your security team to track and regulate access to websites based on content categories. Examples of categories include adult content, high bandwidth content, and legal liability content. When you set up your web content filtering policy, you enable web protection for your organization. For more information, see Web content filtering.
    • Controlled folder access (CFA) allows only trusted apps to access protected folders on Windows devices. Think of this capability as ransomware mitigation. For more information, see Deployment and configuration methods for CFA.
    • Attack surface reduction (ASR) rules target certain software behaviors that are often considered risky because attackers commonly abuse these behaviors through malware. Examples of such behaviors include launching executable files and scripts that attempt to download or run files. Attack surface reduction rules can constrain software-based risky behaviors,behaviors and help keep your organization safe. At a minimum, we recommend configuring the standard protection rules to help protect your network without causing disruption for users. For more information, see Deployment and configuration methods for ASR rules.

    View your existing policies

    You can view your existing policies in either Microsoft Defender portal (Microsoft Defender portal) or the Intune admin center (Intune admin center) (if if you're using Intune). use Intune.

    Microsoft Defender portal

    1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.
    2. In the navigation pane, chooseselect Configuration management > Device configuration. Policies are organized by operating system (suchsystem, such as Windows client), and policy type (suchtype, such as Next-generation protection and Firewall).
    3. Select an operating system tab (fortab, for example, Windows clients), and then review. Review the list of policies under each category (suchcategory, such as Next-generation protection and Firewall).
    4. To view more details about a policy, select its name. A side pane opens that provides more information about that policy, such as which devices are protected by that policy.

    Intune admin center

    1. On the Endpoint security | Overview page of the Microsoft Intune admin center at Microsoft Intune admin center, select the policy type from the Manage section of the navigation pane (forpane, for example, Antivirus, Firewall, or Attack surface reduction).
    2. AnyYou see any existing policies are listed for the policy type you selected. To view more details about a policy, select its name.

    Edit an existing policy

    You can edit your existing policies in either Microsoft Defender portal (Microsoft Defender portal) or the Intune admin center (Intune admin center) (if if you're using Intune). use Intune.

    Microsoft Defender portal

    1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.

    2. In the navigation pane, choose Device configuration. Policies areYou see policies organized by operating system (suchsystem, such as Windows client), and policy type (suchtype, such as Next-generation protection and Firewall).

    3. Select an operating system tab (fortab, for example, Windows clients), and then review. Review the list of policies under the Next-generation protection and Firewall categories.

    4. To edit a policy, select its name, and then chooseselect Edit.

    5. On the General information tab, review the information. If necessary, you can edit the description. Then chooseselect Next.

    6. On the Device groups tab, determine which device groups should receive this policy.

      • To keep the selected device group as it is, chooseselect Next.
      • To remove a device group from the policy, select Remove.
      • To set up a new device group, select Create new group, and then set up your device group. (To getFor help with this task, see Device groups.)
      • To apply the policy to another device group, select Use existing group.

      After you specify which device groups should receive the policy, choose Next.

    7. On the Configuration settings tab, review the settings. If necessary, you can edit the settings for your policy. To getFor help with this task, see the following articles:see:

      After you specify your next-generation protection settings, chooseselect Next.

    8. On the Review your policy tab, review the general information, targeted devices, and configuration settings.

      • Make any needed changes by selecting Edit.
      • When you're ready to proceed, chooseselect Update policy.

    Intune admin center

    To edit an existing endpoint security policy (for example,policy, such as Antivirus, Firewall, or Attack surface reduction), in the Intune admin center, see Modify existing policies (opens. This link opens in a new tab in the Intune documentation).documentation.

    Create a new policy

    Microsoft Defender portal

    1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.

    2. In the navigation pane, choose Device configuration. Policies areYou see policies organized by operating system (suchsystem, such as Windows client), and policy type (suchtype, such as Next-generation protection and Firewall).

    3. Select an operating system tab (fortab, for example, Windows clients), and then review. Review the list of Next-generation protection policies.

    4. Under Next-generation protection or Firewall, select + Add.

    5. On the General information tab, take the following steps:

      1. Specify a name and description. This information helps you and your team identify the policy later on.
      2. Review the policy order, and edit it if necessary. (ForFor more information, see Policy order.)
      3. ChooseSelect Next.

    6. On the Device groups tab, either create a new device group, or use an existing group. Policies are assignedYou assign policies to devices through device groups. Here are some things to keep in mind:

      • Initially, you might only have your default device group, which includes the devices people in your company are usinguse to access company data and email. You can keep and use your default device group.
      • Create a new device group to apply a policy with specific settings that are different from the default policy.
      • When you set up your device group, you specify certain criteria, such as the operating system version. Devices that meet the criteria are included in that device group, unless you exclude them.
      • AllMicrosoft Entra ID stores all device groups, including the default and custom device groups that you define, are stored in Microsoft Entra ID.define.

      To learn more about device groups, see Device groups.

    7. On the Configuration settings tab, specify the settings for your policy, and then chooseselect Next. For more information about the individual settings, see Configuration settings for Defender for Business.

    8. On the Review your policy tab, review the general information, targeted devices, and configuration settings.

      • Make any needed changes by selecting Edit.
      • When you're ready to proceed, chooseselect Create policy.

    Intune admin center

    To configure a policy by using Microsoft Intune endpoint security policies, see Create an endpoint security policy (opens. This link opens in a new tab in the Intune documentation).documentation. When you create the policy, select the Policy type, Platform, and Profile for the protection you want to configure. For the full list of policy types, supported platforms, and available profiles, see Available endpoint security policy types.

    Important