To configure Controlled Folder Access via Intune, we need a configuration policy and the profile type needs to be endpoint protection. Besides from the visuals you get from running the script you must run in the browser you can filter on the following event IDs in the Windows, Defender eventlog: 5007, 1124, 1123.īy testing it you will see a popup from Windows Defender, this will bring you to the protection history if you click on it and it will show you what has been happening.Ĭonfigure Controlled Folder Access with Intune To test this you will need to open a browser and go to. This can be done by selecting audit only in the configuration policy or by using PowerShell on your test machine: Set-MpPreference -EnableControlledFolderAccess AuditMode Select Manage ransomware protection to turn it on or to configure it. There you will find Ransomware protection. In order to make sure that Controlled Folder Access is turned on, open Windows Defender and navigate to Virus & Threat protection. How can we test Controlled Folder Access?Īs mentioned before, do some testing first before configuring Controlled Folder Access via Intune. This may impact your organization, so consider to test it first in audit mode. It is possible that it blocks a legitimate app from making changes to your files. For evaluation there is an audit mode that can be used.Ĭontrolled Folder Access monitors apps for activities that may be malicious.It is possible to add additional folders.

Default protected folders include common system folders.

Apps can be added manually to the list.

Apps determined by Microsoft as friendly are always allowed. Most of your apps will be allowed by Controlled Folder Access without adding them manually.

Apps are added to the trusted list based upon their prevalence and reputation.

It allows apps to access protected folders if the app is on the trusted apps list.

It helps you protect valuable date from malicious apps and threats such as ransomware. It prevents an application or process in making changes to a file in a given folder. Controlled Folder Access or CFA is build into Windows Defender on Windows 10 and Windows Server 2019 and is part of Windows Defender. Configuring Controlled Folder Access (CFA) with Intune to protect users against ransomware.

Windows defender folder protection