[For IT Pros]

If you manage endpoints in 2026, you’re defending laptops that live on café WiFi, mobiles on 5G, and servers that sometimes appear on-prem, sometimes in the cloud. Attackers don’t care about your governance slides; they care about that one misconfigured policy or local admin account. This guide is a pragmatic hardening checklist you can actually roll out across Windows, macOS, mobile, and servers without pausing the business.

Use it as: (1) a design baseline for new environments, (2) a gap-analysis list against your current stack, or (3) a quick win roadmap for the next 90 days. Everything here assumes a Microsoft-centric enterprise (Entra ID, Intune, Defender), but the principles translate to any stack.

1. Identity First: Kill Local Admins, Fix Join Model, Enforce MFA

1.1 Standardise How Devices Join and Authenticate

Messy identity is where many endpoint compromises start. Decide your primary model and commit:

  • Cloud-first: Entra ID join + Intune MDM as default for laptops and mobiles.
  • Hybrid: Hybrid join only where legacy apps require domain auth; avoid it for net-new workloads.

On Windows, block unmanaged or rogue joins:

# Entra ID: restrict device join to specific groups
# Entra ID > Devices > Device settings
# "Users may join devices to Entra ID" = Selected "Device Joiners" group

1.2 Remove Local Admin Wherever Possible

By 2026, there’s no excuse for blanket local admin. Your target:

  • 0% of regular users with permanent local admin.
  • 100% of privileged tasks handled via elevation tools (PIM, LAPS, or just-in-time local admin).

Minimums for Windows:

  • Enable Windows LAPS via Intune (no more shared local admin password).
  • Block local admin membership drift.
# Intune > Endpoint security > Account protection > Windows LAPS
# Policy essentials:
# - Configure password backup: Enabled (Entra ID)
# - Administrator account name: Custom (non-default)
# - Password complexity: Large
# - Password age: 7–30 days depending on risk

1.3 Enforce Strong MFA and Device-Based Access

Endpoint hardening is wasted if identity is weak. Align Conditional Access to support device state:

  • Require phishing-resistant MFA (FIDO2, Windows Hello for Business, or Entra ID Passkeys) for admins and high-value apps.
  • Block access from non-compliant or unmanaged devices to sensitive apps.
# High-level Conditional Access pattern
- Assignment: All users (exclude break-glass), All cloud apps (or sensitive set)
- Conditions:
    - Locations: Exclude trusted networks only if needed
    - Client apps: Browser + Mobile/Desktop
- Access controls:
    - Grant: Require authentication strength = Phishing-resistant
    - Require device to be marked as compliant

2. Baseline OS Hardening: Windows, macOS, Mobile

2.1 Windows: Use the Baselines, Then Tighten

Don’t handcraft every setting. Start with Microsoft’s 2026 security baselines and layer your requirements on top. In Intune:

  • Assign the “Windows 11 Security Baseline (2026)” to all corporate Windows devices.
  • Scope additional baselines to high-risk roles (developers, admins, finance).

Key Windows hardening items to verify (and not just assume from the baseline):

  • BitLocker: Enabled with XTS-AES 256, recovery keys escrowed to Entra ID.
  • Secure Boot + TPM: Required for compliance.
  • Credential Guard & VBS: On for all supported endpoints.
  • SMB: Disable SMBv1, restrict anonymous sessions.
# Sample BitLocker Intune config summary
- OS drive encryption: Enabled
- Encryption method: XTS-AES 256
- Minimum PIN length (if used): 8+
- Store recovery info in Entra ID: Enabled

2.2 macOS: Close the “Nice to Have” Gaps

macOS fleets often lag on basics because “Macs are secure by default”. In 2026, that excuse doesn’t survive a single incident review. Use Intune or your MDM of choice to enforce:

  • FileVault enabled with recovery keys escrowed.
  • Gatekeeper limited to App Store + identified developers.
  • System extensions controlled by allow-list.
  • Firewall enabled, block all incoming by default except approved services.
# Example macOS profile highlights
- Password policy: min length 12, history 5, max age 365
- Screen lock: 5–10 minutes of inactivity
- FileVault: Enabled, escrow personal recovery key to MDM

2.3 Mobile: Enforce Real Management, Not Just MAM

Mobile devices are now full endpoints, not “email viewers”. For corporate-owned devices, use full MDM. For BYOD, at least enforce App Protection Policies with conditional access.

  • Require device compliance (PIN/biometrics, encryption, no jailbreak/root) for corporate app access.
  • Disallow unmanaged mail clients for corporate mail.
  • Block copy/paste from corporate apps into personal apps where appropriate.
# Intune Device Compliance – example minimums
- Require device to be marked as compliant: Yes
- Require password to unlock: Yes
- Minimum OS versions: Align with your app stack, not vendor EOL
- Jailbreak/root detection: Block

3. Reduce Attack Surface: Apps, Browser, and Local Services

3.1 Application Control: From Wild West to Allow-List (Gradually)

Attackers love uncontrolled app ecosystems. Move gradually from “anything goes” to enforced allow-listing:

  • Step 1: Inventory software usage with Defender for Endpoint / Intune discovery.
  • Step 2: Use Smart App Control or WDAC (audit mode) to learn what breaks.
  • Step 3: Roll out WDAC/Smart App Control in enforced mode for standard users.
# Simple WDAC policy creation (PowerShell on a reference device)
$PolicyPath = "C:\WDAC\Base.xml"
New-CIPolicy -Level Publisher -FilePath $PolicyPath -UserPEs  \
  -Fallback Hash -ScanPath "C:\Program Files","C:\Program Files (x86)"
ConvertFrom-CIPolicy $PolicyPath "C:\WDAC\Base.bin"

3.2 Browser and Web Hardening

Most attacks arrive over the browser. Make Edge/Chrome/Firefox a controlled workspace:

  • Deploy managed browser profiles on corporate devices.
  • Enforce Safe Browsing/SmartScreen and Reputation-based protection.
  • Block unauthorized browser extensions; maintain an allow-list of vetted ones.
# Example Edge ADMX/Intune settings
- Configure extension management settings: Block all, allow specific IDs
- SmartScreen: Enabled, prevent user override on high-risk sites
- Password manager: Controlled – avoid saving corporate credentials in personal profiles

3.3 Turn Off What You Don’t Use

Every unused service is potential attack surface. Build a “services diet” as part of your gold image:

  • Disable legacy protocols: LLMNR, NetBIOS over TCP/IP where possible.
  • Disable remote access tools you don’t explicitly use (e.g., legacy RDP configurations, consumer remote support apps).
  • Limit built-in schedulers and scripting engines to trusted admins (e.g., restrict PowerShell for non-admins if realistic).
# Disable LLMNR via GPO/Intune OMA-URI
# HKLM\Software\Policies\Microsoft\Windows NT\DNSClient
# EnableMulticast = 0 (DWORD)

4. Defender & EDR: Configure It Like You Paid For It

4.1 Defender for Endpoint: From License to Value

Many orgs in 2026 have Defender for Endpoint E5/E3+addon but run it like basic antivirus. Minimum configuration for real value:

  • Onboard all platforms: Windows, macOS, Linux servers, iOS/Android.
  • Enable EDR in block mode, not just audit.
  • Turn on Attack Surface Reduction (ASR) rules in block mode for standard users.
# Example high-value ASR rules (Intune – Endpoint security > Attack surface reduction)
- Block all Office apps from creating child processes: Enabled
- Block executable content from email and web clients: Enabled
- Block credential stealing from LSASS: Enabled

4.2 Tuning Alerts to Avoid Alert Fatigue

Hardening fails if the SOC ignores the noise. Spend dedicated time on:

  • Creating suppression rules for known-good, noisy processes (internal tools, deployment scripts).
  • Building custom detection rules for your environment: unusual PowerShell, new lateral movement patterns, suspicious OAuth app registrations.
  • Integrating Defender with your SIEM/SOAR for automated enrichment and triage.

Test your tuning monthly: run a controlled simulation (e.g., test attack chains from Microsoft’s built-in simulations) and verify that alerts are timely and actionable.

4.3 Endpoint Firewall Policies

EDR is not a firewall. Keep local firewalls strict even if you have network firewalls:

  • Require Windows Defender Firewall enabled on all profiles (domain/private/public).
  • Block inbound traffic by default; only allow required ports per role.
  • Use Intune to distribute per-role firewall policies (e.g., developer laptop vs kiosk vs call centre).

5. Hardening Admin Workstations and Privileged Access

5.1 Separate Admin Identities

Admin actions from everyday laptops are still a common weakness. Target state:

  • Each admin has at least two identities: normal user and privileged admin.
  • No email, web browsing, or productivity apps on privileged session accounts.

Use Entra ID PIM to time-box privilege and produce an approval trail.

5.2 Secure Admin Workstations (PAWs)

For high-privilege roles (Entra/Azure admins, Domain Admins, security team), use hardened PAWs:

  • Dedicated device or dedicated, locked-down VM for admin tasks.
  • Strong policies: no local admin except via PIM, tight WDAC, zero consumer apps.
  • Restricted network access – ideally only to management planes, not general internet.
# Example compliance rule for PAW devices
- Require BitLocker: Yes
- Require TPM & Secure Boot: Yes
- Require OS build: Only latest Windows 11 LTSC or specific image
- Require device category = "PAW" for privileged access policies

5.3 Just-in-Time and Just-Enough Admin

Replace standing admin rights with JIT/JEA:

  • Use Entra ID PIM or equivalent to activate role assignments for limited periods.
  • Implement JEA (Just Enough Administration) PowerShell endpoints for routine tasks.
# Very simple JEA endpoint example
New-PSSessionConfigurationFile -Path .\HelpdeskJEA.pssc  \
  -VisibleCmdlets 'Get-Service','Restart-Service'  \
  -SessionType RestrictedRemoteServer
Register-PSSessionConfiguration -Name "HelpdeskJEA" -Path .\HelpdeskJEA.pssc

6. Operationalising the Checklist: Make It Stick

6.1 Turn the Checklist into Policies and Baselines

Move from “nice checklist” to actual enforcement:

  • Define Gold Images per platform (Win, Mac, server builds) and keep them versioned.
  • Use Intune configuration profiles + security baselines as your single source of truth.
  • Document decisions in a short, living standard (e.g., “Endpoint Security Standard v2026.1”).

6.2 Measure Compliance and Exceptions

Security you can’t measure is security you don’t have. At minimum:

  • Track these metrics monthly: BitLocker/FileVault coverage, EDR coverage, baseline compliance, local admin presence, MFA coverage, OS patch currency.
  • Maintain an exceptions register with owners and review dates.

6.3 30-Day Action Plan You Can Start Today

If you do nothing else, use the next month for these concrete moves:

  • Week 1: Enable Windows LAPS, turn on BitLocker/FileVault where missing, onboard missing devices to Defender for Endpoint.
  • Week 2: Deploy Windows/macOS baselines in audit/light mode, start inventorying software for application control.
  • Week 3: Enforce phishing-resistant MFA for admins, create at least one PAW build, tighten browser controls.
  • Week 4: Enable key ASR rules in block mode, disable legacy protocols, publish your first “Endpoint Security Standard” PDF and share it with IT + security.

One Clear Next Step

Pick one high-impact gap from this list – for most orgs it’s removing local admin and enabling LAPS or rolling out real baselines – and schedule it this week. Once that’s in motion, move to the next item. Endpoint hardening isn’t a one-time project; it’s the habit of continuously closing the easiest doors attackers still walk through.