How to Enable Advanced Ransomware Protection in Microsoft Intune

Before building a policy, verify the following against your environment:

• Devices are enrolled in Intune and running a supported Windows version. Attack surface reduction (ASR) rules and Controlled folder access are Windows 10, Windows 11, and Windows Server features.
• Microsoft Defender Antivirus is the active antivirus on target devices and is running in active mode (not passive or disabled). ASR rules and Controlled folder access are enforced by Defender Antivirus — if a third-party AV is primary and Defender is passive, these protections will not apply.
• Real-time protection and cloud-delivered protection are turned on. Several ASR rules and Controlled folder access rely on Defender's real-time engine.
• You hold an admin role with rights to create endpoint security policies — for example Intune Administrator, or a custom role with Endpoint Security Manager permissions.
• Confirm licensing. Intune device management requires an Intune license. ASR rules and Controlled folder access are Defender Antivirus features, but rich reporting, per-rule surfacing, and advanced hunting come with Microsoft Defender for Endpoint (Plan 2 / E5). Without Defender for Endpoint you can still deploy and enforce the rules, but reporting detail is reduced.

If devices are co-managed with Configuration Manager, confirm the Endpoint Protection workload is pointed at Intune, otherwise the policy may not take effect. Defender for Endpoint is not strictly required to enforce ASR/CFA, but it is strongly recommended for visibility.

1. Sign in to the Microsoft Intune admin center at https://intune.microsoft.com.
2. Go to Endpoint security in the left navigation, then select Attack surface reduction.
3. Select + Create Policy.
4. For Platform, choose Windows.
5. For Profile, choose Attack surface reduction rules.
6. Select Create.
7. On the Basics tab, enter a clear Name (for example, Ransomware Protection - ASR Rules - Pilot) and an optional Description noting purpose and rollout ring. Select Next.

Use a naming convention that encodes the target ring (Pilot vs Broad) and mode (Audit vs Block) so the policy is easy to identify later. The exact profile names can vary slightly as Intune templates are updated; select the profile explicitly named for ASR rules.

On the Configuration settings tab, set each ASR rule to Block, Audit, or Not configured. For a first rollout, start every rule in Audit so you can measure impact before enforcing.

Enable these ransomware-relevant rules:

• Use advanced protection against ransomware — targets files with ransomware characteristics.
• Block credential stealing from the Windows local security authority subsystem (lsass.exe) — limits credential theft used for lateral movement.
• Block all Office applications from creating child processes — stops a common macro-based delivery technique.
• Block Office applications from creating executable content.
• Block Office applications from injecting code into other processes.
• Block executable content from email client and webmail.
• Block execution of potentially obfuscated scripts.
• Block JavaScript or VBScript from launching downloaded executable content.
• Block process creations originating from PSExec and WMI commands (test carefully — can affect management tooling).

Block vs Audit: In Audit mode the action is logged as an event but not blocked, letting you find false positives. In Block mode the action is prevented and logged. Move rules to Block only after Audit shows no critical business impact.

Leave rules you have not yet evaluated as Not configured rather than guessing at Block — an unexpected Block can disrupt line-of-business apps and management scripts. The PSExec/WMI rule in particular can break remote management workflows, so audit it first.

Still on the Configuration settings tab, locate the Controlled folder access (folder protection) setting.

1. Set Enable controlled folder access to Audit Mode for the initial rollout, or Enabled (block) once validated.
2. Under Controlled folder access protected folders, add any additional folders beyond the default protected system folders (Documents, Pictures, Videos, Music, Desktop, and Favorites are protected by default). Add paths for critical data locations if needed.
3. Under List of apps that have access to protected folders, add the full paths of trusted line-of-business applications that legitimately write to protected folders, to prevent false positives.

Select Next to continue to Scope tags (optional), then Next again.

Start Controlled folder access in Audit Mode — enabling block immediately often blocks legitimate apps (backup agents, PDF editors, custom tools) that write to Documents or Desktop. Review audit events, then allow-list the trusted apps by full path before switching to Enabled.

1. On the Assignments tab, under Included groups, select Add groups.
2. Choose an Entra ID device group (or user group) that represents your pilot ring — a small, representative set of test devices.
3. Optionally set Excluded groups for devices that must not receive the policy.
4. Select Next.

Deploy to a limited pilot group first while rules and Controlled folder access are in Audit mode. Only expand to a broad production group after you have reviewed audit results and moved rules to Block.

Use a dynamic device group for the pilot ring so new test devices are picked up automatically. Avoid assigning an Audit policy and a Block policy for the same rule to overlapping groups — conflicting settings can produce unexpected states.

1. On the Review + create tab, check the summary: profile type, every configured ASR rule and its mode, the Controlled folder access mode and allow-lists, and the assigned groups.
2. Confirm nothing is set to Block that you intended to leave in Audit for the pilot.
3. Select Create.

The policy is now saved and queued for deployment. Devices receive it on their next Intune check-in — this is not instant.

Managed devices typically check in periodically (often within a few hours), and newly enrolled or actively used devices may sync sooner. You can trigger a manual sync from the device's Settings > Accounts > Access work or school or by selecting Sync on the device in Intune to speed up testing.

In Intune (server side): 1. Open the policy under Endpoint security > Attack surface reduction. 2. Review the Device status / Per-setting status report to confirm devices show Succeeded rather than Error or Pending.

On a target device (client side): - Open Windows Security > Virus & threat protection > Ransomware protection to confirm Controlled folder access is on. - Or run PowerShell to inspect the enforced state (see command). AttackSurfaceReductionRules_Ids lists the applied rule GUIDs and AttackSurfaceReductionRules_Actions shows the mode per rule (0 = Not configured/Disabled, 1 = Block, 2 = Audit). EnableControlledFolderAccess shows the CFA state.

Run the PowerShell command in an elevated session. If results are empty or show 0, the device likely has not synced yet — force a sync and recheck. EnableControlledFolderAccess returns 0 (disabled), 1 (enabled/block), or 2 (audit). Cross-check any Block actions against your intended pilot mode before broad rollout.