What is Attack Surface Reduction in Intune?

Attack Surface Reduction helps reduce common attack paths by blocking or auditing risky behaviors used by malware and threat actors.

Why start ASR rules in Audit mode?

Audit mode lets you observe potential impact on users and apps before enforcing blocks, which helps reduce disruption.

Where can I review ASR impact before enabling?

Use Microsoft Defender recommendations in security.microsoft.com and check user impact details for the rule before switching from Audit to Enabled.

How to Configure Attack Surface Reduction Rules in Intune

Summary: Step-by-step guide to set up Intune Attack Surface Reduction rules in Audit mode, review user impact in Microsoft Defender, and safely switch to Enabled.

What is attack surface?

Attack surface is the collection of possible entry points an attacker can use to compromise devices, apps, identities, and data.
Attack Surface Reduction (ASR) rules help minimize these entry points by controlling high-risk behaviors.

Goal

Create an ASR policy in Intune, set all rules to Audit, review user impact in Microsoft Defender recommendations, then enable rules when impact is acceptable.

Create the ASR policy in Intune

In the Microsoft Intune admin center, go to:

Endpoint security
Attack surface reduction
Create Policy

Set platform/profile for your environment, then configure the rules.

Set all ASR rules to Audit

Change all rules to Audit first.

Image - ASR rules in Audit mode

Attack Surface Reduction rules set to Audit in Intune

Assign a group and save

Add the target device group to the policy assignment, then click Save.

Validate impact in Microsoft Defender

Go to security.microsoft.com and open Recommendations.

Apply filters:

Category
Add filter -> Security controls -> Attack Surface reduction

Image - Recommendations filter for ASR

Filter recommendations to Attack Surface reduction controls

Check user impact before enabling

Open one of the recommendations and review User impact.

If no issues are identified, return to the ASR rule in Intune and change it from Audit to Enabled.

Image - User impact review in recommendations

Review user impact for an ASR recommendation

Result

You deploy ASR in a safer rollout model: audit first, validate impact, then enforce to strengthen protection with lower risk of business disruption.