mdb-controlled-folder-access.md

title	description	author	ms.author	manager	ms.date	ms.topic	ms.service	ms.localizationpriority	ms.collection	ms.reviewer	search.appverid	f1.keywords	audience
Set up or edit your controlled folder access policy in Microsoft Defender for Business	Get an overview of attack surface reduction capabilities in Microsoft Defender for Business	siosulli	siosulli	deniseb	06/07/2024	conceptual	defender-business	medium	m365-security tier1	efratka	MET150	NOCSH	Admin

Set up or edit your controlled folder access policy in Microsoft Defender for Business

Controlled folder access allows only trusted apps to access protected folders on Windows devices. Think of this capability as ransomware mitigation. You can set up or edit your controlled folder access policy using Microsoft Intune.

Set up controlled folder access

1. In the Microsoft Intune admin center, go to Endpoint security > Attack surface reduction.

2. Select an existing policy, or choose Create policy to create a new policy.

   • For Platform, choose Windows 10 and later.
   • For Profile, select Attack Surface Reduction Rules, and then choose Create.

3. Set up your policy as follows:

   1. Specify a name and description, and then choose Next.

   2. Scroll down, and set Enable Controlled Folder Access to Enabled. Then choose Next.

   3. On the Scope tags step, choose Next.

   4. On the Assignments step, choose the users or devices to receive the rules, and then choose Next. (We recommend selecting Add all devices.)

   5. On the Review + create step, review the information, and then choose Create.

To learn more about controlled folder access, see Protect important folders with controlled folder access.

Next steps

• Enable your attack surface reduction rules
• Review settings for advanced features and the Microsoft Defender portal.