This guide will show an administrator how to view information about connection handling that has been carried out by the defender firewall for Intune joined devices.
Role Requirements
Procedure Scope: Administrators
Required Group Membership: Admin.Security
Handbook Reference
Package: TBD
Domain: TBD
Modifies: TBD
Defender Firewall Events Reporting
- Navigate to the Firewall Events Report – Microsoft Defender portal, this page provides information about blocked inbound, outbound, and app connections for Intune joined devices that have firewall protection configured through policy. This report also provides information about remote IPs connected by multiple devices, and remote IPs with the most connection attempts.
Need Assistance?
Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? Inquire about arranging a consultation to explore optimizing your Azure environment for painless management.