Controlled Configuration for Defender: deciding which channel actually owns your antivirus settings

Every co-managed estate has the same argument running quietly in the background: Intune says one thing, Group Policy says another, and a script somebody wrote in 2019 says a third. Controlled Configuration, in preview since service release 2607, finally lets you declare a winner.

What it does

When Controlled Configuration is enabled, the Microsoft Defender antivirus settings delivered by Intune, or by Defender for Endpoint security settings management, become authoritative. They override configuration arriving from other channels: Group Policy, Configuration Manager, and local scripts. Microsoft describes it as an extension of Tamper Protection, which is the right way to think about it. Tamper Protection stops the endpoint changing your settings. Controlled Configuration stops your own other management channels changing them.

Why this matters more in co-management than anywhere else

On a cloud-only estate, settings conflict is mostly an Intune-versus-Intune problem, and policy conflict reporting will tell you about it. In a co-managed estate the channels do not know about each other. ConfigMgr applies its baseline, Group Policy refreshes on its own schedule, Intune syncs on another, and the last writer wins until something else refreshes.

The symptom is familiar: a setting that is correct in the console, correct on the device when you check it on Tuesday, and wrong again on Thursday. Nobody changed anything. A different channel simply got there last.

Finding out which channel is winning today

Before enabling anything authoritative, establish what is actually applied and where it came from. Run this on a representative device from each ring.

1# Effective Defender antivirus state as the engine sees it.
2$pref = Get-MpPreference
3$stat = Get-MpComputerStatus
4
5[PSCustomObject]@{
6    TamperProtection   = $stat.IsTamperProtected
7    RealTimeProtection = $stat.RealTimeProtectionEnabled
8    CloudProtection    = $pref.MAPSReporting          # 2 = Advanced
9    SampleSubmission   = $pref.SubmitSamplesConsent
10    PUAProtection      = $pref.PUAProtection          # 1 = Enabled
11    CloudBlockLevel    = $pref.CloudBlockLevel
12    ScanScheduleDay    = $pref.ScanScheduleDay
13} | Format-List
14
15# Where the policy came from. Anything under the Policies hive arrived from
16# Group Policy or ConfigMgr; the non-Policies hive is local or script set.
17$paths = @(
18    ‘HKLM:SOFTWAREPoliciesMicrosoftWindows Defender’
19    ‘HKLM:SOFTWAREMicrosoftWindows Defender’
20)
21foreach ($p in $paths) {
22    if (Test-Path $p) {
23        Write-Host “`n== $p” -ForegroundColor Cyan
24        Get-ItemProperty $p |
25            Select-Object -Property * -ExcludeProperty PS* |
26            Format-List
27    }
28}
29
30# Intune’s own delivered policy, for comparison.
31$mdm = ‘HKLM:SOFTWAREMicrosoftPolicyManagercurrentdeviceDefender’
32if (Test-Path $mdm) {
33    Write-Host “`n== Intune (PolicyManager)” -ForegroundColor Green
34    Get-ItemProperty $mdm | Select-Object -Property * -ExcludeProperty PS* | Format-List
35}

If the Policies hive and the PolicyManager hive disagree, you have found your Thursday problem. That disagreement is exactly what Controlled Configuration resolves, and knowing which values will win before you enable it is the difference between a fix and an incident.

A sane rollout

1. Inventory first. Run the script above across a sample from every ring, including the machines nobody has touched in two years. Those are where the surprises live.
2. Reconcile in Intune. Whatever Controlled Configuration is going to enforce needs to be correct in Intune before you enforce it, because afterwards the other channels stop compensating for gaps.
3. Enable on a small ring. Ten to twenty devices that represent your actual estate rather than your cleanest machines.
4. Re-run the drift script after a Group Policy refresh cycle. The point is to confirm the Policies hive no longer wins. If it still does, stop and find out why before widening.
5. Widen by ring, not by percentage. Antivirus configuration is the wrong place to discover an edge case at scale.

What I would do

If you are cloud-only, this is a tidy improvement and low urgency. Policy conflict reporting already tells you most of what you need.

If you are co-managed and you have ever chased a setting that reverts on its own, this is the feature you have been waiting for and it is still worth piloting carefully. Enable it where the Defender workload has already moved to Intune, not as a way of moving it.

And if you are running Defender configuration from three channels because nobody ever decided which one owns it, Controlled Configuration will not make that decision for you. It will only enforce whichever answer you finally write down.