How to Enable Private Network Firewall Using Microsoft Intune

Start by navigating to the Microsoft Endpoint Manager admin center and creating a new configuration policy using the Settings Catalog method, which provides the most granular control over firewall settings.

https://endpoint.microsoft.com

Sign in with your Intune Administrator credentials. Once logged in, navigate to Devices > Configuration > Create > New policy. Select Windows 10 and later as the platform and choose Settings catalog as the profile type.

Name your policy something descriptive like "Private Network Firewall - Enable & Block Inbound" to clearly identify its purpose in your policy list.

Now you'll configure the specific firewall settings for the private network profile. Click Add settings and search for "Firewall" in the settings browser. Expand Windows Defender Firewall to access the firewall configuration options.

Configure these three critical settings:

Setting 1: Enable Private Network Firewall

Path: Administrative Templates/Network/Windows Defender Firewall/Private Profile
Setting: Private Network Firewall
Value: Enable

Setting 2: Default Inbound Action

Path: Administrative Templates/Network/Windows Defender Firewall/Private Profile
Setting: Private Network Firewall - Default Inbound Action
Value: Block

Setting 3: Default Outbound Action

Path: Administrative Templates/Network/Windows Defender Firewall/Private Profile
Setting: Private Network Firewall - Default Outbound Action
Value: Allow (Standard) or Block (High security environments)

Navigate to the Assignments tab to specify which devices or users will receive this firewall policy. Click Select groups to include and choose your target device groups or user groups.

For device-based assignment (recommended for firewall policies):

Assignment type: Device groups
Target: All Corporate Devices (or specific security groups)
Filter: None (unless using assignment filters)

For user-based assignment:

Assignment type: User groups
Target: IT Security Team, Remote Workers, etc.
Filter: Platform = Windows

Review your assignments carefully. Firewall policies can impact network connectivity, so start with a pilot group before rolling out to all devices.

Click Next to proceed to the review screen, then click Review + create to finalize the policy.

As an alternative or complementary approach, you can create a dedicated endpoint security firewall policy. Navigate to Endpoint security > Firewall > Create Policy.

Configure the policy with these settings:

Platform: Windows 10, 11, and Windows Server
Profile: Microsoft Defender Firewall
Name: Private Network Security Policy

In the configuration settings, focus on the Private Profile section:

{
  "Enable Private Network Firewall": "Yes",
  "Default inbound action": "Block",
  "Default outbound action": "Allow",
  "Notifications": "Block",
  "Unicast response to multicast": "Block"
}

This method provides a more streamlined interface specifically designed for security policies and integrates better with Intune's security reporting dashboard.

Assign this policy to the same groups as your configuration policy, or use it as a standalone solution if you prefer the endpoint security approach.

To expedite policy deployment, force a sync on your target devices. You can do this through the Intune admin center or directly on the devices.

Method 1: Through Intune Admin Center

Navigate to Devices > All devices, select a target device, and click Sync. This triggers an immediate policy refresh.

Method 2: On the Device Directly

Open Settings on the Windows device and navigate to Accounts > Access work or school. Click on your work account and select Sync.

Method 3: PowerShell Command

# Check device registration status
dsregcmd /status

# Force Intune policy sync
Get-ScheduledTask -TaskName "PushLaunch" | Start-ScheduledTask

# Alternative sync method
Invoke-Command -ScriptBlock {Get-ScheduledTask | Where-Object {$_.TaskName -eq "PushLaunch"} | Start-ScheduledTask}

Wait 5-10 minutes after forcing the sync before checking policy application status.

Once policies have been deployed and synced, verify that the firewall configuration has been applied correctly on your target devices.

PowerShell Verification Commands:

# Check private network firewall profile status
Get-NetFirewallProfile -Profile Private

# Verify specific firewall settings
Get-NetFirewallProfile -Profile Private | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

# Check Windows Firewall service status
Get-Service -Name "MpsSvc" | Select-Object Name, Status, StartType

Expected output for a properly configured private network firewall:

Name                 : Private
Enabled              : True
DefaultInboundAction : Block
DefaultOutboundAction: Allow
LogAllowed           : False
LogBlocked           : False

Registry Verification:

# Check MDM firewall policy registry entries
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\MDM\DMMap\AutoEnroll\Extensions\firewall"

# Verify private profile registry settings
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile"

Use Intune's built-in reporting capabilities to monitor firewall policy compliance across your managed devices. Navigate to Reports > Endpoint security > Firewall to access comprehensive firewall reporting.

Key Reports to Monitor:

1. MDM Firewall status - Overall compliance summary
2. Firewall policy compliance - Device-level compliance details
3. Firewall configuration - Applied settings per device
4. Non-compliant devices - Devices requiring attention

Access the firewall reports dashboard:

https://endpoint.microsoft.com/#view/Microsoft_Intune_Reporting/FirewallBlade

Set up automated compliance monitoring by creating custom reports that filter for:

• Devices with firewall disabled
• Devices with policy application failures
• Devices not checking in for policy updates

PowerShell Monitoring Script:

# Create a monitoring script for firewall compliance
$FirewallStatus = Get-NetFirewallProfile -Profile Private
if ($FirewallStatus.Enabled -eq $false) {
    Write-Output "ALERT: Private network firewall is disabled"
    # Add logging or alerting logic here
} else {
    Write-Output "OK: Private network firewall is enabled"
}

Address common issues that may prevent proper firewall policy application. Use these troubleshooting steps when devices don't show compliant status or firewall settings aren't applied correctly.

Issue 1: Policy Not Applying

# Check device enrollment status
dsregcmd /status | findstr "AzureAdJoined\|DomainJoined\|WorkplaceJoined"

# Verify Intune management extension
Get-Process -Name "Microsoft.Management.Services.IntuneWindowsAgent" -ErrorAction SilentlyContinue

# Check event logs for policy errors
Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" -MaxEvents 50

Issue 2: Group Policy Conflicts

# Check for conflicting GPO settings
gpresult /r /scope:computer | findstr "Firewall"

# View applied group policies
gpresult /h c:\temp\gpresult.html

Issue 3: Local Administrator Overrides

Prevent local administrators from disabling the firewall by adding this setting to your policy:

Setting: Private Network Firewall - Prevent users from disabling firewall
Value: Enable

Common Resolution Steps:

1. Force device sync: Get-ScheduledTask -TaskName "PushLaunch" | Start-ScheduledTask
2. Restart Windows Firewall service: Restart-Service -Name "MpsSvc" -Force
3. Clear policy cache: Remove-Item "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" -Force
4. Reboot device if persistent issues occur