Security Policy Errors

How to Determine if Microsoft Defender Antivirus Policy Came from Intune

Partner Editor Oct 10, 2026 869 views

Question details

Administrators need to verify the deployment source of a Microsoft Defender Antivirus policy to confirm if it originated from Microsoft Intune, Configuration Manager, or Microsoft Defender.

How to Determine Whether a Microsoft Defender Antivirus Policy Came from Intune

Product: Microsoft Defender
Device & OS: not provided
Scenario: Managing and troubleshooting security policy deployments across enterprise devices.
Observed behavior: The administrator needs visibility into the specific management platform that deployed the active antivirus policy to a target device.

Before you start

Ensure you have the necessary administrative privileges to access the Microsoft Defender portal and view enterprise device asset information.

Solution 1Recommended

Verify Policy Source in the Microsoft Defender Portal

Use the Microsoft Defender portal's device asset details to quickly identify where a specific antivirus policy originated.

The Microsoft Defender portal provides a centralized view of device health and security configurations. By inspecting a specific device's assets, administrators can accurately determine which management tool applied the current antivirus policies.

Navigate to Device Assets

Select the Target Device

Use the search bar or filter options in the device list to find the relevant endpoint. Click on the device name to open its details pane.

Locate the Antivirus Policy Section

In the device details pane, scroll down or navigate the tabs to find the 'Antivirus policy' section.

Review the Policy Name and Source

Examine the policy details listed. The 'Source' column will explicitly indicate whether the policy came from Intune, Configuration Manager, or Microsoft Defender.

Sync Delays: If you recently deployed a new policy via Intune, it may take some time for the device to sync and for the updated source to reflect in the Microsoft Defender portal.

Free Microsoft Office alternative

Deploy WPS Office as a Secure and Lightweight Alternative

While troubleshooting enterprise security policies like Microsoft Defender and Intune, consider streamlining your software deployments with WPS Office. It provides a robust, lightweight, and free alternative to Microsoft Office that is easy to deploy and manage across endpoint devices.

1. Download the Installer: Visit the official WPS Office website and download the enterprise or free version installer.
2. Deploy via Management Tools: Use your preferred MDM solution like Microsoft Intune or Configuration Manager to package and deploy the installer to your endpoints.
3. Configure Silent Install: Apply command-line arguments during deployment for a seamless, silent installation across the organization.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Lightweight installation package ideal for rapid enterprise deployments.Cost-effective solution reducing software licensing overhead.Familiar user interface requiring zero learning curve for employees.

microsoft office alternative - wps office

Frequently Asked Questions

Why is my Intune policy not showing in Microsoft Defender?

Device sync delays, configuration profile errors, or conflicts with local group policies might prevent the Intune policy from appearing immediately. You can trigger a manual sync from the Intune portal to expedite the process.

Can I change the policy source directly from the Defender portal?

No, the Defender portal only displays the source of the applied policy. To modify or override the policy, you must use the original management platform, such as Microsoft Intune or Configuration Manager.

What happens if there is a conflict between Intune and Configuration Manager policies?

If a device is co-managed, the co-management workload configurations in your environment will dictate which authority takes precedence for endpoint protection.

How long does it take for a new Intune policy to reflect on the device?

Typically, it can take up to 8 hours for an Intune policy to fully sync and apply to a device in the background, though administrators can force a manual sync from the device or portal.

Microsoft Office Security Issues