Question

Your organization runs a pooled Azure Virtual Desktop host pool with Windows 11 Enterprise multi-session session hosts that are onboarded to Microsoft Defender for Endpoint. A security review finds that a local administrator on one session host disabled Microsoft Defender Antivirus real-time protection during a troubleshooting session, leaving the host unprotected for several hours. You must ensure that security settings such as real-time protection cannot be turned off locally, even by users with administrative rights on the session host, while requiring the least ongoing administrative effort. What should you do?

Accepted Answer

Enable Tamper Protection for the session hosts through the Microsoft Defender for Endpoint / Intune endpoint security portal.

Answer

Configure Controlled Folder Access in audit mode and add the Defender program files to the protected folder list.

Answer

Remove all users from the local Administrators group on the session hosts using a Group Policy Restricted Groups setting.

Answer

Create an Azure Firewall rule that blocks outbound traffic to the endpoints used to change Defender configuration.