How to Block Executable Content from Email Clients Using Microsoft Intune

Start by logging into the Microsoft Intune admin center to create your Attack Surface Reduction policy.

Open your browser and navigate to https://intune.microsoft.com. Sign in with your administrative credentials that have Endpoint Security Administrator or Global Administrator permissions.

Once logged in, navigate to Endpoint security in the left navigation pane, then click Attack surface reduction.

Click Create Policy to start creating a new ASR policy.

Configure the basic policy settings for your ASR rule deployment.

In the policy creation wizard:

1. Select Windows 10, Windows 11, and Windows Server as the platform
2. Choose Attack surface reduction rules as the profile type
3. Click Create

On the Basics page:

1. Enter a descriptive name like ASR - Block Email Executable Content
2. Add a description: Prevents executable files and scripts from running when downloaded through email clients and webmail services
3. Click Next

Now configure the specific ASR rule that blocks executable content from email clients.

In the Configuration settings page, locate the rule Block executable content from email client and webmail. This rule has the GUID D3E037E1-3EB8-44C8-A917-57927947596D.

Set the rule to one of these modes:

• Audit mode - Recommended for initial deployment to identify false positives
• Warn - Shows user notification but allows bypass
• Block - Prevents execution entirely
• Not configured - Rule is disabled

For initial deployment, select Audit mode. This allows you to monitor what would be blocked without impacting users.

Click Next to proceed to scope tags.

Set up scope tags (if used) and assign the policy to target groups.

On the Scope tags page, add any relevant scope tags for your organization's administrative boundaries, or leave blank if not using scope tags. Click Next.

On the Assignments page:

1. Click Add groups under "Included groups"
2. Search for and select a pilot group of devices (recommended: 10-50 devices initially)
3. Avoid assigning to "All devices" on first deployment
4. Click Select, then Next

Review your settings on the Review + create page and click Create.

Verify that the policy deploys successfully to target devices.

In the Intune admin center, navigate to Endpoint security > Attack surface reduction and click on your newly created policy.

Click the Device status tab to monitor deployment progress. You should see devices listed with their compliance status.

To force immediate policy check-in on a test device, you can use the Company Portal app or run this PowerShell command as administrator on the target device:

Get-ScheduledTask | Where-Object {$_.TaskName -eq "PushLaunch"} | Start-ScheduledTask

Alternatively, restart the device to ensure policy application.

Confirm that the ASR rule is active on enrolled devices using PowerShell.

On a target device, open PowerShell as administrator and run:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

This should return the GUID D3E037E1-3EB8-44C8-A917-57927947596D if the rule is configured.

To check the rule's current mode, run:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

The output values mean:

• 0 = Disabled
• 1 = Block mode
• 2 = Audit mode
• 6 = Warn mode

Since you configured Audit mode, you should see 2 in the output.

Perform a controlled test to verify the ASR rule is functioning correctly.

Create a test scenario by sending an email with a harmless executable attachment to a user on a target device. You can use a simple batch file for testing:

@echo off
echo This is a test executable
pause

Save this as test.bat and send it as an email attachment to a test user.

When the user attempts to run the attachment directly from their email client (Outlook, Thunderbird, etc.), the ASR rule should trigger.

Since you're in Audit mode, the file will execute but an event will be logged. Check the Windows Event Viewer on the target device:

1. Open Event Viewer
2. Navigate to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational
3. Look for Event ID 1122 (Audit mode trigger)

Use the Microsoft Defender portal to monitor ASR rule effectiveness across your environment.

Navigate to https://security.microsoft.com and sign in with your administrative credentials.

Go to Reports > Attack surface reduction rules in the left navigation.

Click on the Detections tab to view ASR rule triggers. You should see entries for your test and any legitimate triggers from the "Block executable content from email client and webmail" rule.

Click on the Configuration tab to see which devices have the rule enabled and their current configuration status.

Review the data for at least one week in Audit mode to identify patterns and potential false positives before switching to Block mode.

Based on your audit data, add exclusions for legitimate applications that are being incorrectly flagged.

Return to your ASR policy in the Intune admin center. Click Properties, then Edit next to Configuration settings.

Scroll down to find Attack Surface Reduction Rules Exclusions. Add file paths, folder paths, or file extensions that should be excluded from this rule.

Common exclusions might include:

• Specific executable paths: C:\Program Files\YourApp\app.exe
• Folder exclusions: C:\Program Files\LegitimateApp\*
• File extensions (use cautiously): *.msi

Example exclusion configuration:

C:\Program Files\RemoteMonitoring\winagent.exe
C:\Program Files (x86)\BusinessApp\*

Click Review + save to apply the exclusions.

After validating the rule in Audit mode and configuring necessary exclusions, switch to Block mode for full protection.

Edit your ASR policy and change the "Block executable content from email client and webmail" rule from Audit mode to Block.

Save the policy changes. The new setting will deploy to devices within the next policy refresh cycle (typically 8 hours, or immediately with manual sync).

Once you've confirmed Block mode works correctly with your pilot group, expand the assignment:

1. Edit the policy assignments
2. Add larger device groups or "All devices" as appropriate
3. Consider excluding specific groups that require different handling

Monitor the Microsoft Defender portal for Block events (Event ID 1121) to ensure the rule is working as expected.

Set up regular monitoring schedules to review ASR effectiveness and adjust exclusions as needed.