Managing Tamper Protection across tenants

Overview

Tamper Protection prevents local admins (and malware) from disabling Microsoft Defender features. MSPs must standardize enforcement while preserving legitimate break-glass procedures.

Baseline stance

• On for workstations; plan server exceptions where documented.
• Manage through Intune or Configuration Manager—not ad-hoc registry on endpoints.

Steps

1. Confirm tenant-wide Defender policy ownership (avoid conflicting GPO and Intune).
2. Enable Tamper Protection via Microsoft Defender Antivirus profile.
3. Document password/PIN or support flow if local uninstall/repair is required (rare—prefer remote wipe/reimage for compromised devices).

Break-glass

• Store a process to temporarily disable tamper on an isolated machine for forensics—approved by security lead only.
• Re-enable immediately after procedure; verify via Get-MpPreference.

Monitoring

Alert on tamper events and Defender service stops in your SIEM/RMM; correlate with change tickets.

Client-facing explanation

“Tamper Protection is like a seatbelt for your antivirus—only your MSP can adjust certain settings centrally.”