Enable Tamper Protection in Defender for Endpoint (Windows, Mac)

Platforms

WindowsmacOS

Products

IntuneDefender for Endpoint

Result

Defender for Endpoint settings and the macOS agent are protected; tampering attempts are blocked and logged

Overview

Stop malware and local admins from switching off Microsoft Defender: turn on tamper protection for the whole tenant in the Defender portal, then enforce it with Intune on Windows and switch Macs from Audit to Block mode.

Tamper Protection is an endpoint security feature that adds an extra layer of protection to Windows and Mac devices. It protects critical Microsoft Defender Antivirus settings from unwanted changes by programs, scripts, command-line tools, registry changes or group policies. Tamper Protection stops malicious actors from turning off threat protection features, and it detects and responds to tampering attempts, which may indicate an attack in which threat actors change security settings to persist and stay undetected. You can manage Tamper Protection with the following tools:

• Manage using Microsoft Intune
• Manage using Tenant Attach with Configuration Manager v2006
• Manage using the Microsoft Defender portal

Intune lets you configure Tamper Protection for the entire organization or for selected device and user groups. Tamper Protection is available on Windows 10, Windows 11 and Windows Server, and on macOS since August 2022 (general availability announcement). Without Tamper Protection, malicious apps can change important Microsoft Defender for Endpoint settings, for example disable virus and threat protection, real-time protection or cloud-delivered protection.

On Mac devices, Tamper Protection started in audit mode on every onboarded device in 2022, and an Intune administrator could switch it to block mode. Today, Macs use block mode when tamper protection is on in the Microsoft Defender portal, and an MDM profile always takes precedence.

• Audit: Tampering operations are logged, but not blocked
• Block: Tamper protection is on, tampering operations are blocked
• Disabled: Tamper protection is completely off

In block mode, any attempt to stop or uninstall the Defender for Endpoint agent is blocked, as is creating, editing or deleting files in the Defender installation folder.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, turn it on tenant-wide first, then enforce it per platform with Intune.

Step	Console	What you set
3.1	Defender	Tamper Protection for the whole tenant
3.2	Intune	Antivirus policy for Windows: Tamper protection On
3.3	Intune	Settings catalog policy for Mac: enforcement level Block
3.4	Defender	Advanced hunting query for tampering attempts (optional)

Enable tenant-wide Tamper Protection

Microsoft Defender portal

Tamper Protection can be turned on tenant-wide (a global setting), which affects all onboarded devices running Windows 10/11 and Windows Server 2012 R2 or later.

As a Security Administrator, sign in to the Microsoft Defender portal (security.microsoft.com):

• Go to Settings > Endpoints > General > Advanced features and turn on Tamper Protection

Note: On new tenants (since the November 2021 update), cloud-delivered protection is turned on automatically together with Tamper Protection if it wasn't enabled before.

Tamper Protection for Windows

Intune admin center

In the Intune admin center (intune.microsoft.com), go to Endpoint security > Antivirus and create a new policy for platform Windows with the Windows Security Experience profile.

Set Tamper protection (device) to On to prevent Microsoft Defender from being disabled on onboarded Windows 10, Windows 11 and Windows Server devices. My 2022 screenshot shows the old setting name and values:

• Enabled turns on the Tamper Protection restrictions.
• Disabled turns off the Tamper Protection restrictions.
• Not configured is the default and has no effect.

Tamper Protection for Mac devices

Intune admin center

On Mac devices managed by Intune, the easiest way today is a settings catalog policy with Microsoft Defender > Tamper protection > Enforcement level set to Block. In 2022 I used a custom configuration profile, which still works; see the full example in Microsoft docs. The part that sets block mode is:

<key>tamperProtection</key>
<dict>
    <key>enforcementLevel</key>
    <string>block</string>
</dict>

Note: Use com.microsoft.wdav as the configuration profile name, or Defender for Endpoint ignores the preferences.

• Custom configuration profile name: com.microsoft.wdav
• Deployment channel: Device channel

Optional: Advanced hunting query for tampering events

Microsoft Defender portal

Run the following query to view details about tampering attempts on devices:

DeviceInfo
| where OSPlatform == 'macOS' or OSPlatform == 'Windows'
| join kind=rightsemi (
    DeviceEvents
    | where ActionType contains 'TamperingAttempt'
) on DeviceId

Result

On a device that got the policy, check that Tamper Protection is on.

Windows

PowerShell command to check that Tamper Protection and real-time protection are enabled:

Get-MpComputerStatus | select IsTamperProtected, RealTimeProtectionEnabled

Example output:

IsTamperProtected RealTimeProtectionEnabled
----------------- -------------------------
             True                      True

Windows Security app:

Mac

To check that Tamper Protection is enabled on macOS, run:

mdatp health

Example output (shortened):

healthy                                     : true
health_issues                               : []
licensed                                    : true
engine_version                              : "1.1.19500.2"
app_version                                 : "101.78.13"
...
real_time_protection_enabled                : true [managed]
...
tamper_protection                           : "block"

Check the output values of tamper_protection and real_time_protection_enabled, or show only the tamper protection mode with mdatp health --field tamper_protection.