How to Enable Tamper Protection for Your Organization Using Microsoft Intune

Start by logging into the Microsoft Intune admin center where you'll create and manage your tamper protection policy.

Open your web browser and navigate to https://intune.microsoft.com. Sign in with your Global Administrator or Intune Administrator credentials.

Once logged in, navigate to Endpoint security in the left navigation pane, then select Antivirus. You can also access this directly at https://intune.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/antivirus.

Now you'll create a new antivirus policy specifically designed to enable tamper protection across your organization.

Click + Create Policy in the Antivirus policies dashboard. In the policy creation wizard, you'll need to select the appropriate platform and profile:

• Platform: Select Windows 10 and later
• Profile: Choose Windows Security experience

Click Create to proceed to the policy configuration.

Configure the fundamental details of your tamper protection policy to ensure proper identification and management.

On the Basics tab, fill in the following information:

• Name: Enter a descriptive name like "Enable Tamper Protection - Organization Wide"
• Description: Add a detailed description such as "Prevents unauthorized modifications to Microsoft Defender Antivirus settings and exclusions across all managed devices"

Click Next to proceed to the configuration settings.

This is the core step where you'll actually enable tamper protection to prevent unauthorized changes to Defender settings.

On the Configuration settings tab, locate the Defender section. You'll find several settings here, but focus on the tamper protection option:

• Find Tamper protection (device)
• Set the value to On

Leave other settings at their default values unless you have specific organizational requirements. The tamper protection setting is the primary focus of this policy.

Click Next to continue to scope tags configuration.

Define which devices and users will receive this tamper protection policy through proper assignment configuration.

On the Scope tags tab, you can typically leave the default scope tag selected unless your organization uses specific scope tags for security policies. Click Next to proceed.

On the Assignments tab, configure who receives this policy:

• Include: Select All users and All devices for organization-wide deployment
• Alternatively, select Selected groups if you want to target specific security groups
• Ensure the Target type is set to Include

For most organizations, deploying to all devices is recommended for comprehensive protection.

Click Next to proceed to the final review.

Complete the policy creation process and deploy it to your selected devices.

On the Review + create tab, carefully review all your policy settings:

• Verify the policy name and description
• Confirm tamper protection is set to "On"
• Check assignment scope matches your intentions

Once you've verified all settings are correct, click Create to deploy the policy.

The policy will now be created and begin deploying to assigned devices. This process typically takes 15-30 minutes for devices to receive and apply the policy.

Track the deployment progress and ensure the tamper protection policy is successfully applied to your devices.

Return to Endpoint security > Antivirus in the Intune admin center. Click on your newly created tamper protection policy to view its deployment status.

In the policy overview, you'll see several key metrics:

• Assignment status: Shows how many devices have received the policy
• Device status: Displays success, pending, and error counts
• User status: Shows user-level deployment information

Click on Device status to see detailed per-device information. Look for devices showing "Success" status, which indicates tamper protection has been successfully enabled.

Confirm that tamper protection is actually working on your managed devices using PowerShell verification.

On a test device that received the policy, open PowerShell as an administrator and run the following command:

Get-MpComputerStatus | Select-Object IsTamperProtected

This command should return True if tamper protection is successfully enabled.

You can also verify through the Windows Security app:

1. Open Windows Security from the Start menu
2. Navigate to Virus & threat protection
3. Click on Manage settings under "Virus & threat protection settings"
4. Verify that protected settings show as managed and cannot be modified

Additionally, check the registry for confirmation:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "ManagedDefenderProductType"

This should return a value of 6, indicating the device is managed by Intune.

Enhance your tamper protection by preventing local administrators from adding antivirus exclusions that could weaken security.

Create an additional antivirus policy to protect exclusions. Navigate back to Endpoint security > Antivirus and create a new policy:

• Platform: Windows 10 and later
• Profile: Microsoft Defender Antivirus

In the configuration settings, locate the Defender section and configure:

• Disable Local Admin Merge: Set to Yes

This setting prevents local administrators from adding their own exclusions to the antivirus configuration, ensuring that only Intune-managed exclusions are applied.

Deploy this policy to the same groups as your tamper protection policy for consistent security coverage.

Validate that your tamper protection implementation is working correctly by attempting to modify protected settings.

On a test device with tamper protection enabled, attempt to perform actions that should be blocked:

1. Try disabling real-time protection: Open Windows Security and attempt to turn off real-time protection. This should be prevented.
2. Test PowerShell modifications: Run the following command as administrator:

Set-MpPreference -DisableRealtimeMonitoring $true

This command should fail or have no effect due to tamper protection.

3. Attempt registry modifications: Try to modify Defender settings directly in the registry - these changes should be blocked or reverted.

If you need to temporarily disable tamper protection for troubleshooting, use the troubleshooting mode feature in the Microsoft Defender portal:

1. Access the Defender portal at https://security.microsoft.com
2. Navigate to device management and enable troubleshooting mode for specific devices
3. This provides temporary access while maintaining audit logs