Windows Firewall: Securing cloud-only clients correctly

With more and more companies, I am moving towards cloud-only management for client devices, including Entra ID Only Autopilot, complete management via Intune and other measures.

One issue that is sometimes overlooked here is the Windows Firewall. Without the appropriate configuration, clients will permanently assume that they are on a "public network" and thus keep this firewall profile active. This means that the corresponding exceptions, even for processes that are only required internally, would then have to be placed on the public profile. This obviously does not sound like the right approach. So what is a better solution?

The solution is the Network List Manager function. This allows us to assign endpoints that the client can use to determine that it is in an "authenticated network" when it is accessible. One way to configure these settings can be found in the firewall profile under Endpoint Security:

Modern IT and cloud scenarios place new demands on security, governance and operations. Telekom's consulting services on Microsoft security help you analyse your environment in a structured manner and develop it in a targeted way – from initial classification to concrete implementation.

Start with a no-obligation orientation meeting or a Microsoft 365 Security Assessment and receive clear recommendations for action to improve security.