How to Configure Default Inbound Action for Public Profile in Windows Defender

Open your browser and navigate to the Microsoft Intune admin center. Sign in with your administrator credentials that have Endpoint Security permissions.

Navigate to Endpoint security in the left navigation pane, then select Firewall. You'll see the Firewall summary page showing existing policies and their deployment status.

Click on Summary to view the current firewall policy overview. This page displays all active firewall policies, their assignment status, and device compliance metrics.

From the Firewall summary page, click Create policy to start the policy creation wizard.

In the policy creation dialog, select the following options:

• Platform: Windows 10, Windows 11, and Windows Server
• Profile: Microsoft Defender Firewall

Click Create to proceed to the policy configuration wizard.

On the Basics tab, provide the following information:

Name: Public Network Firewall - Block Inbound
Description: Blocks unsolicited inbound connections on public networks for enhanced security
Platform: Windows 10, Windows 11, and Windows Server

Click Next to proceed to the configuration settings.

In the Configuration settings tab, locate the Public Profile section. This section controls firewall behavior when devices connect to public networks like coffee shops, airports, or hotels.

Configure the following critical settings:

Enable Public Network Firewall (Device): True
Default Inbound Action for Public Profile (Device): Block
Default Outbound Action (Device): Allow
Shielded: True

Here's what each setting does:

• Enable Public Network Firewall: Activates the firewall when connected to public networks
• Default Inbound Action - Block: Denies all unsolicited inbound connections (recommended for security)
• Default Outbound Action - Allow: Permits outbound traffic for normal application functionality
• Shielded - True: Prevents end users from modifying these firewall settings

For comprehensive protection, configure the Domain and Private profiles as well. Scroll to the Domain Profile section and set:

Enable Domain Network Firewall (Device): True
Default Inbound Action for Domain Profile (Device): Allow
Default Outbound Action (Device): Allow
Shielded: True

Next, configure the Private Profile section:

Enable Private Network Firewall (Device): True
Default Inbound Action for Private Profile (Device): Block
Default Outbound Action (Device): Allow
Shielded: True

Private networks include home and work networks where you have more control over the network infrastructure.

Scroll to the Auditing section to enable comprehensive logging for troubleshooting and security monitoring.

Configure the following audit settings:

Audit Dropped Packets: Success + Failure
Audit Successful Connections: Success + Failure

These settings enable detailed logging of both successful connections and blocked traffic attempts. The logs will be available in Windows Event Viewer under:

Applications and Services Logs > Microsoft > Windows > Windows Firewall With Advanced Security > Firewall

Logging helps with:

• Identifying blocked legitimate applications
• Detecting potential security threats
• Troubleshooting connectivity issues
• Compliance reporting

Click Next to proceed to the Scope tags section. If your organization uses scope tags for role-based access control, select the appropriate tags. For most deployments, you can leave this as default and click Next.

On the Assignments tab, click Add groups to specify which device groups will receive this firewall policy.

Select Include and choose your target groups. Common group selections include:

• All Windows devices
• Remote workers group
• Mobile device users
• Specific department groups

Example assignment configuration:

Assignment Type: Include
Selected Groups: 
  - All Windows 10/11 Devices
  - Remote Workers
  - Executive Mobile Devices

Click Next to reach the Review + create tab. Carefully review all configured settings:

Policy Summary:
✓ Public Profile: Block inbound, Allow outbound
✓ Domain Profile: Allow inbound, Allow outbound  
✓ Private Profile: Block inbound, Allow outbound
✓ Auditing: Enabled for both success and failure
✓ Shielded: True (prevents user modification)
✓ Target Groups: [Your selected groups]

Verify the policy configuration matches your security requirements. Pay special attention to:

• Public profile has "Block" for inbound action
• Domain profile has "Allow" for inbound action (critical for Intune management)
• Correct device groups are assigned
• Shielded is enabled to prevent user tampering

Click Create to deploy the policy. The policy will begin deploying to assigned devices immediately.

Navigate back to Endpoint security > Firewall to monitor your policy deployment. Click on your newly created policy to view detailed deployment status.

The policy overview shows:

Deployment Status:
- Succeeded: [number] devices
- In progress: [number] devices  
- Failed: [number] devices
- Not applicable: [number] devices

Click Device status to see per-device deployment results. Look for devices showing "Not applicable" - these may be using Security Management for Microsoft Defender for Endpoint, which is expected behavior.

Common deployment statuses:

• Succeeded: Policy applied successfully
• In progress: Policy deployment underway
• Failed: Check device connectivity and permissions
• Not applicable: Device doesn't support the setting or uses alternative management

Connect a test device to a public network (coffee shop, mobile hotspot, or guest network) to validate the firewall policy is working correctly.

On the test device, open Command Prompt as administrator and run:

netsh advfirewall show allprofiles state

Expected output should show:

Public Profile Settings:
State: ON
Firewall Policy: BlockInbound,AllowOutbound

Domain Profile Settings:
State: ON  
Firewall Policy: AllowInbound,AllowOutbound

Private Profile Settings:
State: ON
Firewall Policy: BlockInbound,AllowOutbound

Test inbound blocking by attempting to connect to the device from another machine on the same public network. The connection should be blocked.

Verify outbound connectivity works by browsing websites or accessing cloud services.

Check Windows Event Viewer for firewall logs:

eventvwr.msc

Navigate to: Applications and Services Logs > Microsoft > Windows > Windows Firewall With Advanced Security > Firewall

After deploying the restrictive firewall policy, you'll likely need to create exception rules for legitimate applications that require inbound connections.

Return to Endpoint security > Firewall and click Create policy. Select:

• Platform: Windows 10, Windows 11, and Windows Server
• Profile: Microsoft Defender Firewall Rules

Configure application-specific rules:

Rule Name: Allow Remote Desktop - Public Networks
Action: Allow
Direction: Inbound
Protocol: TCP
Local Port: 3389
Profile: Public
Program Path: %SystemRoot%\system32\svchost.exe
Service Name: TermService

Common applications requiring inbound exceptions:

• Remote Desktop (TCP 3389)
• File sharing (TCP 445, 139)
• VPN clients (various ports)
• Business applications with peer-to-peer features

Assign the exception rules to the same device groups as your main firewall policy.