How to Configure Microsoft Defender SmartScreen Using Microsoft Intune

Open your web browser and navigate to the Microsoft Intune admin center. We'll use the Settings Catalog method as it provides comprehensive SmartScreen configuration options.

https://intune.microsoft.com

Sign in with your administrative credentials. Once logged in, navigate to Devices in the left navigation pane, then select Configuration profiles. Click Create profile to start creating a new configuration policy.

In the profile creation wizard, select:

• Platform: Windows 10 and later
• Profile type: Settings catalog

Click Create to proceed to the configuration screen.

In the Settings Catalog interface, use the search bar to find SmartScreen settings. Type SmartScreen in the search field. You'll see several SmartScreen-related settings appear.

Select and configure these essential SmartScreen settings:

1. Allow Smart Screen:

• Setting: Allow Smart Screen
• Value: Enabled
• Description: This is the master switch that enables SmartScreen functionality

2. Enable Smart Screen In Shell:

• Setting: Enable Smart Screen In Shell
• Value: Enabled
• Description: Activates SmartScreen protection in Windows File Explorer and Shell

3. Enable App Install Control:

• Setting: Enable App Install Control
• Value: Enabled
• Description: Provides protection against potentially malicious app installations

Click Add for each setting you want to include in your policy.

Now we'll add more granular SmartScreen controls to prevent users from bypassing security warnings. Continue searching for these additional settings:

1. Prevent Override For Files In Shell:

• Setting: Prevent Override For Files In Shell
• Value: Enabled
• Description: Prevents users from ignoring SmartScreen warnings about malicious files in File Explorer

2. Prevent Smart Screen Prompt Override:

• Setting: Prevent Smart Screen Prompt Override
• Value: Enabled
• Description: Blocks users from bypassing SmartScreen warnings for websites and applications

3. Prevent Smart Screen Prompt Override For Files:

• Setting: Prevent Smart Screen Prompt Override For Files
• Value: Enabled
• Description: Specifically prevents override of file-related SmartScreen warnings

These settings create a more restrictive security posture where users cannot easily bypass SmartScreen protections.

Click Next to proceed to the profile naming and assignment section. Provide a clear, descriptive name for your SmartScreen policy:

Name: Microsoft Defender SmartScreen - Enhanced Protection
Description: Enables SmartScreen protection with user override prevention for enhanced security against phishing, malware, and malicious downloads

Click Next to proceed to the Assignments tab. Here you'll specify which devices or users should receive this policy.

Assignment Options:

• All devices: Applies to all Intune-enrolled Windows devices
• All users: Applies to devices of all enrolled users
• Selected groups: Target specific Azure AD groups (recommended for testing)

For initial deployment, select Selected groups and choose a pilot group of devices or users. Click Select groups to include and choose your target group.

Click Next to reach the Review + create section. Carefully review all your SmartScreen configuration settings:

Settings to verify:

• Allow Smart Screen: Enabled
• Enable Smart Screen In Shell: Enabled
• Enable App Install Control: Enabled
• Prevent Override For Files In Shell: Enabled
• Prevent Smart Screen Prompt Override: Enabled
• Prevent Smart Screen Prompt Override For Files: Enabled

Review the assignment details to ensure you're targeting the correct groups. Once satisfied with the configuration, click Create to deploy the policy.

The policy will now be created and begin deploying to assigned devices. Intune will show the policy status as "Deploying" initially.

After creating the policy, monitor its deployment status to ensure devices are receiving and applying the SmartScreen configuration. Click on your newly created SmartScreen policy from the Configuration profiles list.

In the policy overview, you'll see deployment statistics:

• Succeeded: Devices that successfully applied the policy
• Error: Devices that encountered errors during policy application
• Conflict: Devices with conflicting policies
• Not applicable: Devices that don't meet the policy requirements

Click on Device status to see detailed per-device deployment information. This view shows:

• Device name and user
• Compliance status
• Last check-in time
• Error details (if any)

For troubleshooting, click on individual devices to view detailed error messages and resolution guidance.

Once the policy shows successful deployment, test SmartScreen functionality on a target device to confirm the configuration is working correctly.

Test 1: File Explorer SmartScreen

On a target device, download a test file that might trigger SmartScreen (like an unsigned executable from the internet). SmartScreen should display a warning dialog.

Test 2: Verify Override Prevention

If you enabled override prevention settings, users should not be able to bypass SmartScreen warnings by clicking "Run anyway" or similar options.

Test 3: Check SmartScreen Status via PowerShell

Run this PowerShell command on the target device to verify SmartScreen status:

Get-MpPreference | Select-Object EnableNetworkProtection, SmartScreenEnabled, SmartScreenPuaEnabled

Test 4: Registry Verification

Check the registry to confirm MDM policies are applied:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableSmartScreenInShell"

Microsoft Defender SmartScreen also protects Microsoft Edge browsing. While the shell-based settings we configured protect file downloads, you should also configure Edge-specific SmartScreen settings for comprehensive protection.

Create a new configuration profile specifically for Edge SmartScreen:

Navigate to Devices > Configuration profiles > Create profile

• Platform: Windows 10 and later
• Profile type: Settings catalog

Search for "Microsoft Edge" settings and configure:

1. SmartScreen for Microsoft Edge:

• Setting: Configure Microsoft Defender SmartScreen
• Value: Enabled

2. SmartScreen for Downloads:

• Setting: Configure Microsoft Defender SmartScreen to block potentially unwanted apps
• Value: Enabled

3. Prevent SmartScreen Override:

• Setting: Prevent bypassing Microsoft Defender SmartScreen prompts for sites
• Value: Enabled

Assign this policy to the same groups as your main SmartScreen policy.

Establish ongoing monitoring to track SmartScreen effectiveness and policy compliance across your organization.

1. Configure Intune Reporting:

Navigate to Reports > Device compliance to create custom reports for SmartScreen policy compliance. Set up automated reports to track:

• Policy deployment success rates
• Devices with policy conflicts
• Non-compliant devices requiring attention

2. Enable Microsoft Defender for Endpoint Integration (if available):

If your organization uses Microsoft Defender for Endpoint, SmartScreen events will appear in the security dashboard. Configure alerts for:

• SmartScreen blocks and warnings
• Attempts to bypass SmartScreen protections
• Malware detection events

3. Set Up Regular Policy Reviews:

Schedule monthly reviews of SmartScreen policy effectiveness:

# PowerShell script to check SmartScreen policy status across devices
$devices = Get-IntuneManagedDevice
foreach ($device in $devices) {
    Get-IntuneDeviceConfigurationPolicyStatus -DeviceId $device.id
}

4. User Training and Communication:

Develop user awareness materials explaining SmartScreen warnings and proper responses to security prompts.