Attack Surface Reduction
Attack Surface Reduction (ASR) are rules in Microsoft Defender Antivirus that block risky software behavior - such as Office apps spawning child processes or obfuscated scripts. In Intune, ASR rules are deployed via endpoint security policies; before blocking, audit mode is recommended for testing.
Path in the Intune admin center
📍 Endpunktsicherheit › AngriffsflächenverringerungHands-on tasks
- Antivirus policy with cloud protection and PUAMicrosoft Intune - Hands-on Course · Module 16
- ASR policy with 3 rules in audit modeMicrosoft Intune - Hands-on Course · Attack Surface Reduction (ASR)
- Move ASR from audit to block - with exclusionsMicrosoft Intune - Hands-on Course · Attack Surface Reduction (ASR)
Jump straight to the matching course task (sign-in required).
On Microsoft Learn
Related terms