INTUNE-010: Endpoint Detection and Response configuration

Platform
Entra ID / M365
Category
Intune / Endpoint Management
Severity
Critical
Zero Trust pillar
Devices (weight 3)
Golden fixtures
3
Branch coverage
Observed: fixtures prove the verdicts they exercise
Provenance
baseline

What it checks

Endpoint Detection and Response (EDR) capabilities provided by Microsoft Defender for Endpoint enable advanced threat detection, investigation, and automated response on managed devices. Without EDR onboarding and proper sensor configuration, security teams lack visibility into sophisticated attacks that bypass traditional antivirus. EDR is critical for detecting fileless malware, living-off-the-land techniques, and advanced persistent threats.

Recommended value

All managed devices onboarded to Defender for Endpoint with EDR in block mode; sample sharing and cloud protection enabled

Remediation

Verify that all managed Windows devices are onboarded to Microsoft Defender for Endpoint through the Intune EDR policy and that the sensor health status shows as active. Enable EDR in block mode to provide additional blocking capabilities even when a third-party antivirus is the primary engine. Review the device inventory in the Defender portal to identify devices with sensor health issues and remediate connectivity or configuration problems preventing successful onboarding.

Fixture-proven verdicts

Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.

Verdict scenarios for INTUNE-010
ScenarioExpected verdict
cleanPASS
known-badWARN
throttledNot Assessed

Framework mappings

NIST SP 800-53
SI-4
MITRE ATT&CK
T1562.001