Question

Your organization uses Intune to manage Windows 11 devices. Security requires that the Microsoft Defender Firewall be enabled on the Domain, Private, and Public profiles, and that a specific legacy line-of-business application be blocked from receiving unsolicited inbound connections while still allowing its outbound traffic. You must deploy this using an Intune endpoint security firewall policy. Which combination correctly achieves the requirement?

Accepted Answer

Create a Microsoft Defender Firewall profile to enable the firewall on all three profiles, and add a firewall rule with Direction set to Inbound and Action set to Blocked, scoped to the application's file path.

Answer

Create a Microsoft Defender Firewall profile enabling the firewall on all three profiles, then add a firewall rule with Direction set to Outbound and Action set to Blocked for the application.

Answer

Configure an attack surface reduction rule to block the application, since ASR handles inbound connection filtering for line-of-business apps.

Answer

Enable the firewall on the Domain profile only and rely on the default 'block all inbound' behavior without creating any application-specific rule.