Question

A security incident is underway, and the SOC team reports that a batch of 40 Windows 11 devices in the 'Finance-Workstations' Microsoft Entra ID group may be running outdated Microsoft Defender Antivirus security intelligence. You need to force these specific devices to pull the newest Defender signatures immediately, using the fewest administrative steps in the Microsoft Intune admin center. What should you do?

Accepted Answer

Create a bulk device action, select the 'Update Windows Defender security intelligence' remote action, and target the devices.

Answer

Deploy a new device configuration profile that enables cloud-delivered protection and assign it to the Finance-Workstations group.

Answer

Run the 'Sync' remote action on each device individually so they re-check in with Intune.

Answer

Create a Windows Update for Business ring that expedites quality updates to the affected devices.