What this check looks at
Checks each Windows device Intune manages for Microsoft Defender Antivirus that is turned off, has real-time protection off, or has out-of-date security intelligence, as the device last reported it.
Microsoft Defender Antivirus is built into Windows 10 and 11. Each Windows device Intune manages reports its state: whether the antivirus is running, whether real-time protection (which scans files as they are opened and downloaded) is on, and whether its security intelligence, the definitions it recognises malware by, is up to date.
This check reads that state for every Windows device in Intune and lists the devices with the antivirus off, real-time protection off, or security intelligence out of date, as each device last reported it. It fails when 10% or more of the devices that reported have a problem and warns when fewer do. A device that reported nothing is counted separately and never as protected; when none reported at all, the result is not checked.
A compliance policy that requires antivirus says what should be true; this says what is. Real-time protection gets turned off to install software or "speed up" a slow laptop and is never turned back on, and a device that has been offline or blocked from updating can run on definitions weeks old, blind to the malware circulating now.
Why it matters
A compliance policy can require antivirus, but only the device says whether it is actually running and current. A laptop with real-time protection off, or security intelligence weeks old, lets known malware and ransomware run unchallenged. Cyber Essentials assessors and insurers ask about it.
A typical case: a 25-person accountancy practice’s compliance policy requires antivirus, so every laptop shows compliant. One partner turned real-time protection off months ago to install a tax add-in and never turned it back on. A malicious invoice attachment runs unchallenged, steals the saved browser passwords and the Microsoft 365 session, and the attacker sends fraudulent payment requests to clients from the partner’s mailbox.
Cyber Essentials requires malware protection to be active and kept up to date on every device in scope, and an assessor may ask for evidence of it, not only of the policy. Cyber insurance proposals ask the same question.
It supports ISO 27001 A.8.7 (protection against malware), CIS Controls v8 safeguards 10.1 and 10.2 (deploy and maintain anti-malware software, configure automatic signature updates), PCI DSS 5.2.1 and 5.3.1, and the NCSC Cyber Assessment Framework outcome B4.b on secure configuration.
How to fix it
Where: Intune admin centre → Endpoint security → Antivirus
Before you start
- Check whether any listed device runs another antivirus product: Windows turns Defender off when one is installed, and that product is then the one to check.
Step by step
- Look at each listed device. In the Microsoft Intune admin centre, go to Devices > All devices, open each device in the evidence and choose Windows protection state (under Monitor). It shows whether real-time protection is on, when security intelligence was last updated and when the device last reported.
- Bring it up to date. From the device’s Overview, run Update Windows Defender security intelligence, then Quick scan. Ask the user to restart if a restart is pending. A device that has not checked in for weeks needs to come back online before anything reaches it.
- Turn protection on centrally, and keep it on. Go to Endpoint security > Antivirus > Create Policy, choose Windows and the Microsoft Defender Antivirus profile, set Allow Realtime Monitoring and Allow Cloud Protection to Allowed, and assign it to all Windows devices. Turn tamper protection on (Endpoint security > Antivirus, Windows Security experience profile) so it cannot be switched off locally.
- Make falling behind non-compliant. In the Windows compliance policy (Devices > Compliance > Policies), under System Security, set Microsoft Defender Antimalware, Real-time protection and Microsoft Defender Antimalware security intelligence up-to-date to Require. A device that falls behind is then marked not compliant, and a Conditional Access policy that requires a compliant device blocks it until it is fixed.
- Check for another antivirus product. Windows turns Defender off when another antivirus product is installed. If a listed device runs one, confirm it is managed, licensed and up to date, or remove it so Defender takes over again.
- Confirm the change. Once the devices have checked in, their Windows protection state shows real-time protection on and current security intelligence, and they leave the finding’s evidence at the next assessment.
What users will notice
None. A quick scan may run in the background.
How to confirm it worked
Intune, Devices, the device, Windows protection state: real-time protection on and security intelligence up to date.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware softwareES-3 Ensure anti-malware software and signatures are updated |
| Zero Trust | Endpoints |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.2.1 An anti-malware solution is deployed on all system components5.3.1 The anti-malware solution is kept current |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malware |
| CIS Controls v8.1 | 10.1 Deploy and maintain anti-malware software (IG1)10.2 Configure automatic anti-malware signature updates (IG1) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Vulnerability managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- windowsProtectionState in Microsoft Graph (Microsoft Learn)
- Antivirus policy for endpoint security in Intune (Microsoft Learn)