Intune and Defender settings for Cyber Essentials

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. Enrolling your devices into Intune

Before Intune policies can apply, every in-scope company Windows laptop, Mac, iPhone and Android device must be enrolled:

• New Windows 11 PCs: Use Windows Autopilot so the machine joins Microsoft Entra ID and Intune automatically the first time the user signs in with their work email.
• Existing Windows 11 PCs: Go to Settings → Accounts → Access work or school → Connect (or enrol via Group Policy if hybrid-joined).
• macOS, iOS and Android: Install the Microsoft Intune Company Portal app (or use Apple Business Manager automated device enrolment) so compliance and security profiles apply centrally.

2. The six Intune & Defender policies that map to Cyber Essentials

1. Compliance policy (Control 2 & 3): In Devices → Compliance, require BitLocker / FileVault encryption, active firewall and antivirus, a minimum 6-character PIN/password, maximum 10 failed sign-in attempts, and a minimum OS build number (blocking Windows 10 without ESU or retired macOS/iOS versions).
2. Windows Update rings (Control 3 — Auto-fail): In Devices → Windows → Update rings, set Quality update deferral to 0 days, Deadline to 5 days, and Grace period to 2 days so critical updates install and restart well inside the 14-day rule.
3. Endpoint Security Firewall (Control 1): In Endpoint security → Firewall, enable Windows Defender Firewall across Domain, Private and Public networks and enable the macOS built-in firewall with stealth mode.
4. Endpoint Security Antivirus & SmartScreen (Control 5): In Endpoint security → Antivirus, enable Microsoft Defender real-time scanning, cloud-delivered protection, and SmartScreen / Network Protection to block connections to malicious websites. On macOS, push Microsoft Defender for Business.
5. Settings Catalog for Auto-play (Control 2): In Devices → Configuration, enable Turn off Autoplay (All drives) to stop automatic execution from removable media.
6. Account Protection & Windows LAPS (Control 4): In Endpoint security → Account protection, enable Windows LAPS to rotate local administrator passwords in Entra ID and strip standard users out of the local Administrators group.

3. Using Defender Vulnerability Management before a Plus audit

Before a Cyber Essentials Plus auditor scans your devices, open security.microsoft.com → Vulnerability management → Weaknesses and filter for vulnerabilities with a CVSS v3 score of 7.0+ or published more than 14 days ago. That view shows you the exact third-party applications (Chrome, Adobe Reader, Zoom, 7-Zip, Git) that need updating or uninstalling before audit day.