Microsoft 365 Endpoint AdministratorManage devices and apps (55-60%)Medium
A Microsoft 365 Endpoint Administrator is managing a fleet of corporate-owned Windows 11 devices. The company policy requires that all devices must have a specific set of security configurations applied, including Defender antivirus settings, firewall rules, and attack surface reduction rules. These settings need to be consistently applied and monitored for compliance. Which Intune feature is designed to deploy and manage these types of security settings?
- AConfiguration profiles > Custom OMA-URI
- BDevices > Compliance policies
- CEndpoint security > Security baselines
- DApps > Windows apps > Win32 app
Show answer & explanationAnswer & explanation
Correct answer: C. Endpoint security > Security baselines
Security baselines in Intune are pre-configured sets of Windows security settings recommended by Microsoft. They provide a standardized way to deploy and manage a comprehensive suite of security configurations, including Defender, firewall, and attack surface reduction rules, to ensure devices meet organizational security postures.
Why the other options are wrong
- A. Custom OMA-URI is for individual, non-standard settings, not a comprehensive suite of security configurations like a baseline.
- B. Compliance policies *monitor* devices against security settings, they do not *deploy* or *enforce* the settings themselves.
- D. Win32 apps are for deploying applications, not for configuring security settings like antivirus or firewall rules.
Intune Security Baselines
Pre-configured groups of Windows security settings recommended by Microsoft, deployable via Intune to enforce a consistent security posture across managed devices.
- Based on Microsoft security recommendations.
- Includes settings for Defender, Firewall, BitLocker, etc.
- Simplifies deployment of comprehensive security configurations.
- Monitored for compliance within Intune.
Memory trick: Baselines set the standard for device security.