Always-on protection

In addition to Cloud-delivered protection, MDAV has always-on protection. This refers to client-based protective layers used to identify risky files and processes and includes real-time protection (RPT) and behavior monitoring. Always-on protection is enabled by default but should be force-enabled using your central management tool. Additionally, you can use these management tools to disable local setting override. This prevents a local administrator’s local settings from overriding your centrally managed settings.

You can find the always-on protection settings for Intune in Endpoint security | Antivirus, then within the Microsoft Defender Antivirus profile type. The settings available include Allow Realtime Monitoring, Allow Behavior Monitoring (identify threats based on risky behavior such as process, registry, and file activity), and Allow Intrusion Prevention System (inspects network traffic for exploits). The general recommendation is to force enable...