{"id":20697424,"url":"https://github.com/epomatti/azure-endpoint-security","last_synced_at":"2026-04-18T20:02:00.303Z","repository":{"id":224649428,"uuid":"757719953","full_name":"epomatti/azure-endpoint-security","owner":"epomatti","description":"Microsoft Endpoint reference resources","archived":false,"fork":false,"pushed_at":"2025-07-29T20:44:43.000Z","size":340,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-07-29T23:05:03.359Z","etag":null,"topics":["azure","azure-security","company-portal","defender-for-endpoint","entra","entra-id","intune","laps","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/epomatti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-02-14T20:49:47.000Z","updated_at":"2025-07-29T20:44:47.000Z","dependencies_parsed_at":"2024-11-17T00:20:22.946Z","dependency_job_id":"9f140308-61ba-4995-8d91-98e3018c3ff4","html_url":"https://github.com/epomatti/azure-endpoint-security","commit_stats":null,"previous_names":["epomatti/azure-endpoint-security"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/epomatti/azure-endpoint-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Fazure-endpoint-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Fazure-endpoint-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Fazure-endpoint-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Fazure-endpoint-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/epomatti","download_url":"https://codeload.github.com/epomatti/azure-endpoint-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Fazure-endpoint-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31982755,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T17:30:12.329Z","status":"ssl_error","status_checked_at":"2026-04-18T17:29:59.069Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","azure-security","company-portal","defender-for-endpoint","entra","entra-id","intune","laps","terraform"],"created_at":"2024-11-17T00:17:58.454Z","updated_at":"2026-04-18T20:02:00.171Z","avatar_url":"https://github.com/epomatti.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure Endpoint Security\n\nSample resources for Intune, Defender for Endpoint, and more.\n\n## Setup\n\nSet the variables file:\n\n```sh\ncp config/local.auto.tfvars .auto.tfvars\n```\n\nSet the **required variables**:\n\n```terraform\nsubscription_id       = \"\"\nentraid_tenant_domain = \"\"\nallowed_public_ips    = [\"\"]\n```\n\n\u003e [!TIP]\n\u003e Check for the latest [Windows images](#windows-images) available.\n\nCreate the resources:\n\n```sh\nterraform init\nterraform apply -auto-approve\n```\n\n### Users\n\n\u003e [!IMPORTANT]\n\u003e You must manually assign an Intune [license](https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses) to all users.\n\nThe users described in this section will be created.\n\n#### Intune administrator\n\nA user named `IntuneAdmin@example.com` will be created to manage Intune.\n\nThe following roles will be assigned:\n\n- `Intune Administrator`\n- `Security Administrator`\n\nThis will allow access to the following applications:\n\n- https://intune.microsoft.com\n- https://security.microsoft.com\n\n#### Endpoint user\n\nA user named `EndpointUser@example.com` will be created to operate the endpoint.\n\nDepending on the architecture, the device enrollment can take one of these forms:\n\n- [Registered device](https://learn.microsoft.com/en-us/entra/identity/devices/concept-device-registration)\n- [Joined device](https://learn.microsoft.com/en-us/entra/identity/devices/concept-directory-join)\n- [Hybrid joined device](https://learn.microsoft.com/en-us/entra/identity/devices/concept-hybrid-join)\n\n\n## Defender for Endpoint\n\nConnect MDE with Intune. (Microsoft Intune Plan)\n\n\u003e 💡 An addon or equivalent [license][1] needs to be purchased for this integration.\n\nMicrosoft Defender Antivirus [works together][2] with Microsoft Defender for Endpoint\n\nIntune EDR policy (onboard)\n\nThis [video][3] shows how to configure Device Guard with Microsoft Intune.\n\n\u003e 💡 Device guard - Prevents malicious code from running by ensuring only allowed and known good code can run, such as malware or ransomware. (Only Windows Enterprise client)\n\nAmong other available services is [controlled folder access][4].\n\n## Admins\n\nGuests may be allowed as administrators through the [unlicensed admins](https://learn.microsoft.com/en-us/mem/intune/fundamentals/unlicensed-admins) option.\n\nDevice-only licenses are [also available](https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses#device-only-licenses) for devices that are not associated with a user.\n\n## Company Portal\n\nA license is also required. EDR enables Azure Advanced Threat Protection\n\nMake sure to also allow MDM user scope to enroll (Mobility MDM and WIP) - Microsoft Intune\n\n\u003e 💡 This helpful video shows how to enable Defender for Endpoint.\n\n## LAPS\n\nFor Local Administrator Password Solution (LAPS), make sure you've enabled it in the device settings blade:\n\n\u003cimg src=\".assets/laps.png\" /\u003e\n\nIn Intune, create an account protection policy:\n\n1. Select Endpoint security \u003e Account protection \u003e Create policy\n2. Select Windows 10 and Windows LAPS\n3. Create the policy for all devices\n\n## Intune\n\nIf MDE is enabled, it can take a while after joining Intune until everything is synced.\n\n\u003cimg src=\".assets/intune-endpoint.png\" /\u003e\n\nAccess will be granted after the compliance check:\n\n\u003cimg src=\".assets/intune-status.png\" /\u003e\n\n\n## Configuration as Code\n\nMicrosoft has provided [instructions](https://techcommunity.microsoft.com/blog/intunecustomersuccess/configuration-as-code-for-microsoft-intune/3701792) on how to manage configuration as code for Intune.\n\n## Web protection\n\nThis section shows [web protection][6].\n\n### Attack Surface Reduction - Web protection\n\nAn example with Microsoft Edge:\n\n\u003cimg src=\".assets/intune-webprotection.png\" /\u003e\n\nSelect the appropriate configuration for the profile:\n\n\u003cimg src=\".assets/intune-webprotection-profile.png\" /\u003e\n\nTo test SmartScreen, use a [sample URL][7], such as this [demo malware][8] page.\n\n\u003cimg src=\".assets/intune-smartscreen.png\" /\u003e\n\nSecurity can be further enhanced with [Alerts][9], and monitoring can use [Reports][10].\n\n### Defender - Web content filtering\n\nWith MDE, it is also possible to turn on web content filtering:\n\n\u003cimg src=\".assets/intune-defender-webcontentfiltering.png\" /\u003e\n\nProtection includes: adult content, high bandwidth, legal liability, leisure, and uncategorized.\n\nA policy can be created using a blade in the same view above, like this:\n\n\u003cimg src=\".assets/intune-defender-webcontentfiltering2.png\" /\u003e\n\n## Device Guard\n\nCredential guard, VBS, and UEFI, memory integrity, etc.\n\n\u003cimg src=\".assets/intune-deviceguard.png\" /\u003e\n\n## Security Policies\n\n### Entra ID Authentication\n\nWhen using a virtual machine as opposed to the real device, follow [this procedure](https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows) to enable Entra ID authentication.\n\n\u003e [!NOTE]\n\u003e The required RBAC roles already already added by the Terraform configuration\n\nExample using the Azure CLI command:\n\n```sh\naz vm extension set --publisher Microsoft.Azure.ActiveDirectory --name AADLoginForWindows --resource-group rg-endpoint --vm-name vm-win11\n```\n\n\u003e [!IMPORTANT]\n\u003e Before signing in to the VM, make sure to do the first login with the user account and register the MFA.\n\nDownload the RPD file and login.\n\n### BitLocker / Disk Encryption\n\nCreate the encryption policy and assign to the groups.\n\nControl the conditional access depending on your use case.\n\nMake sure the device is a member of the Entra ID assigned group.\n\n### Antivirus\n\nCreate the antivirus policies:\n\n#### Defender Update Controls\n\nAntivirus updates (like security intelligence, engine updates, and platform updates) are delivered and applied.\n\n#### Microsoft Defender Antivirus\n\nUpdates to the antivirus behavior ( real-time protection, scanning options, tamper protection, and remediation actions).\n\n### Device Lock\n\nAdd a new policy:\n\n1. Device \u003e Configuration Profiles \u003e  Settings catalog\n2. + Add Settings \u003e Device Lock \u003e Max Inactivity Time Device Lock\n3. Toggle \"Device Password Enabled\" to `Enabled`\n4. Set the time to the desired value (in minutes)\n\n### Apps\n\n\u003e [!TIP]\n\u003e You can choose for it to be available as a featured app in the Company Portal. Also, choose if required or available.\n\nCheck the [troubleshoot](https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/troubleshoot-app-install) article in case of issues. For example, this URL will help with installation issues:\n\n```\nhttps://aka.ms/IntuneAppDeployment\n```\n\nhttps://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/apps-appear-unavailable\n\n#### Install an App\n\n1. In the `Apps` blade, create a new policy.\n2. Select a source, such as Microsoft Store.\n3. Select an app, such as DBeaver.\n\n#### Remove an App\n\n1. In the `Apps` blade, create a new policy.\n2. Select a source, such as Microsoft Store.\n3. In the assignment, select to uninstall an app.\n\n### Disable AutoPlay\n\nTo check the AutoPlay configuration:\n\n1. Open `gpedit.msc`\n2. Computer Configuration → Administrative Templates → Windows Components → AutoPlay Policies\n\nThe configuration should be `Not Configured`.\n\nTo create the policy on Intune, following this [reference](https://learn.microsoft.com/en-us/answers/questions/726088/disable-removable-drive-autorun-in-azure-ad) to set up [device restrictions](https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-configure):\n\n1. Create a profile, settings option\n2. Search for `AutoPlay`\n3. Select all options (10 in total)\n\nTest by inserting a USB drive with an `autorun.inf` file. Ensure no automatic execution occurs.\n\n### Compliance\n\nCreate a compliance policy and assign to the required devices.\n\n## Other Services\n\nhttps://learn.microsoft.com/en-us/mem/intune/apps/app-management\n\nhttps://github.com/microsoft/Intune-PowerShell-SDK\n\n## Windows images\n\n### Windows Server\n\nTo find updated Windows Server images:\n\n```sh\naz vm image list-skus -l eastus2 -p MicrosoftWindowsServer -f WindowsServer --query [].name\n```\n\n### Windows 11\n\nTo find updated Windows 11 images:\n\n```sh\naz vm image list-skus -l eastus2 -p MicrosoftWindowsDesktop -f Windows-11 --query [].name\n```\n\nSuffixes details:\n\n| Code       | Description                          |\n|------------|--------------------------------------|\n|  avd       | Azure Virtual Desktop                |\n|  ent       | Enterprise                           |\n|  entn      | Enterprise (not with media player)   |\n|  pro       | Professional                         |\n|  pro-zh-cn | Simplified Chinese                   |\n|  pron      | Professional (not with media player) |\n\n\n[1]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide\n[2]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/why-use-microsoft-defender-antivirus?view=o365-worldwide\n[3]: https://youtu.be/wAiH_lDveug\n[4]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-controlled-folders?view=o365-worldwide\n[5]: https://www.youtube.com/watch?v=z3R_aq0pu0Y\n[6]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-threat-protection?view=o365-worldwide\n[7]: https://demo.wd.microsoft.com/Page/UrlRep\n[8]: https://demo.smartscreen.msft.net/other/malware.html\n[9]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-protection-response?view=o365-worldwide\n[10]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-protection-monitoring?view=o365-worldwide\n[11]: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-content-filtering?view=o365-worldwide\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Fazure-endpoint-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fepomatti%2Fazure-endpoint-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Fazure-endpoint-security/lists"}