Device Security - Defender | Augmentt Knowledge Base

Template family: Intune — device compliance
Applies to: Microsoft Intune
Where to find it: Secure → Intune → Device Management → Compliance → Templates → Augmentt Default

What this template is for

Augmentt policy for device security best practices. Requires Bitlocker, Secure Boot, and Code Integrity to be compliant. Requires Encryption on data storage, Firewall, TPM, and Antivirus. Password required to unlock device, simple passwords blocked, password required when returning from idle state. Defender is enforced in this policy. CIS v8: 4.3, 4.5, 7.3, 10.1.

What it actually does

Creates a windows10CompliancePolicy in Microsoft Intune configured as follows.

Setting	Value
`rtpEnabled`	true
`tpmRequired`	true
`defenderEnabled`	true
`bitLockerEnabled`	true
`passwordRequired`	true
`wslDistributions`	(none)
`antivirusRequired`	true
`secureBootEnabled`	true
`signatureOutOfDate`	true
`antiSpywareRequired`	false
`passwordBlockSimple`	true
`codeIntegrityEnabled`	true
`passwordRequiredType`	deviceDefault
`activeFirewallRequired`	true
`memoryIntegrityEnabled`	false
`storageRequireEncryption`	true
`firmwareProtectionEnabled`	false
`kernelDmaProtectionEnabled`	false
`requireHealthyDeviceReport`	false
`deviceThreatProtectionEnabled`	false
`validOperatingSystemBuildRanges`	(none)
`passwordRequiredToUnlockFromIdle`	true
`virtualizationBasedSecurityEnabled`	false
`earlyLaunchAntiMalwareDriverEnabled`	false
`configurationManagerComplianceRequired`	false
`deviceThreatProtectionRequiredSecurityLevel`	unavailable

Anything not listed keeps the Microsoft default.

This is an Augmentt Default template, shipped with the product and shared across all customers. Deploying it creates a new policy in the customer tenant; edit the deployed policy rather than the template.