Maester Packs
LowScript packFree

CIS Intune for Microsoft Defender Antivirus Benchmark

Checks that Intune policies configure the Level 1 recommendations of the CIS Intune for Microsoft Defender Antivirus Benchmark v1.0.0. One test per setting.

Version
0.2.1
Tests
52
Connectors
0
Published
8 Nov 2026

Pacers31Colts18 · pacers31colts18.cis-defender-intune-l1 · 2 stars · Open source · MIT

PowerShell 
Install-MtPack Pacers31Colts18/maester-packs-joeloveless/cis-defender-intune-l1

Install only packs from sources you trust. This pack is made by Pacers31Colts18, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Pacers31Colts18/maester-packs-joeloveless.

maester-packs.lock.json entry 
{  "Id": "pacers31colts18.cis-defender-intune-l1",  "Source": "Pacers31Colts18/maester-packs-joeloveless/cis-defender-intune-l1",  "Version": "0.2.1",  "Commit": "426b7a4b0f89b2f6d67606e61fff5b49e80144fd",  "Digest": "sha256:4a756e3994ac8a72b74e512beadc3c172ad23900437fb81d8a146a193940cb43"}

← All tests

MP.JL.CISDEFINT.L1.008 Allow Email Scanning is set to Allowed

Severity: MediumGraph

Description

CIS Intune for Microsoft Defender Antivirus Benchmark, recommendation 2.4 (Level 1).

The test passes when an assigned settings catalog policy for Windows sets Defender > Allow Email Scanning to Allowed, and no other assigned policy sets it to something else.

Remediation action

  1. In the Microsoft Intune admin center, go to Devices > Configuration and open (or create) a settings catalog policy for Windows 10 and later.
  2. Add Defender > Allow Email Scanning and set it to Allowed.
  3. Assign the policy to your Windows devices, and remove any other assigned policy that sets it to something else.

Related links

%TestResult%