I have a physical Windows Server 2025 Hyper-V host onboarded to Microsoft Defender for Endpoint through Azure Arc and managed with MDE Security Settings Management. The device appears normally in Defender, Intune, and Entra, shows successful enrollment and recent check-ins, and has an Entra managementType of MicrosoftSense. Other Intune Endpoint Security policies apply successfully.
The problem is limited to Attack Surface Reduction policies. A production ASR policy assigned to all devices never includes this server in its reporting, even though other MDE-managed servers receive it. Initially, Get-MpPreference showed two ASR rules that were coming from Local Group Policy. I removed that policy, verified the registry path was gone, and confirmed through Event ID 5007 that the rules were removed. After about a week, the Intune ASR policy still had not applied, and Get-MpPreference showed no ASR rules.
I also created a separate test policy containing only one ASR rule in Audit mode and assigned it directly to a group containing the server. That policy initially did not appear in reporting either. The Sense and WinDefend services are running, Defender is healthy, the MDE Client Analyzer confirms connectivity to the required cloud endpoints, and no local Defender or ASR Group Policy settings remain. The server is a workgroup host rather than domain joined.
Has anyone seen ASR policy delivery fail specifically on Azure Arc- and MDE-managed Windows Server 2025 devices, and what resolved it?
2 Answers
Check the ASR-related registry locations under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR, including ASROnlyPerRuleExclusions. In some environments, ASR configuration still depends on policy values being present in the registry, even when most Defender settings are cloud-managed. Be aware that exclusion entries can be stored as separate REG_SZ values containing long, concatenated paths, so scripts may be easier than editing them manually.
The issue turned out to be a compatibility problem in the original policy, not a general MDE enrollment or connectivity failure. That policy enabled the setting controlling Win32 API calls from Office macros, which is not supported on Windows Server 2025. It caused the whole ASR policy to fail applicability, but the reporting did not clearly identify the incompatible setting.
A separate test policy eventually applied because it did not include that setting. I created a new ASR policy specifically for Server 2025 systems without the unsupported configuration, and the servers now report successful application.
I checked that location and the entire ASR policy tree is absent. Get-MpPreference also shows no ASR rules, while the other Intune security policies continue to apply normally.