Profiles created after that date use a new settings format as found in the Settings Catalog. This section details the settings in App and browser isolation profiles created before April 18, 2023. Profile: Attack Surface Reduction RulesĪttack surface reduction (MDM) App and browser isolation profile.Windows 10, Windows 11, and Windows Server: Use this platform for policy you deploy to devices managed through Security Management for Microsoft Defender for Endpoint. Profile: Web Protection (ConfigMgr)(preview).Profile: Exploit Protection(ConfigMgr)(preview).Windows 10 and later (ConfigMgr): Use this platform for policy you deploy to devices managed by Configuration Manager. Profile: Web protection (Microsoft Edge Legacy).Profile: Attack surface reduction rules.Windows 10 and later - Use this platform for policy you deploy to devices managed with Intune. If you save the above code in a file named cfa-events.xml, then you can import it into the event viewer to evaluate the logs for controlled folder access.View the settings you can configure in profiles for Attack surface reduction policy in the endpoint security node of Intune as part of an Endpoint security policy. This has since disappeared from Microsoft's website without a trace.Īmong other things, the package included the export file of a custom log view that contained a filter for all controlled folder access events: Evaluation of the logsĪfter the introduction of this feature, Microsoft provided an Exploit Guard Evaluation Package, which contained tools for testing controlled folder access.

The existence of the directory passed via this parameter is not checked. They require the path to the directories and applications, respectively: Set-MpPreference -ControlledFolderAccessProtectedFolders 'c: emp' In PowerShell, the Set-MpPreference cmdlet is also capable of this, with the ControlledFolderAccessProtectedFolders (for additional folders) and ControlledFolderAccessAllowedApplications parameters for additional allowed applications. Defining allowed applications via a Group Policy

Controlled folder access intune