[For IT Pros]

If you’re responsible for laptops, desktops, and mobiles in 2026, you already know: the endpoint is where most attacks actually land. Phishing kits now auto-deploy infostealers, browser session hijacking is standard, and AI-powered malware is getting better at hiding in plain sight.

This isn’t a theoretical hardening guide. It’s a practical, opinionated checklist you can compare against your current setup, with concrete examples for Windows, macOS, mobile, and mixed environments (Azure AD / Entra ID + Intune + Defender + third-party tools).

1. Start with the Baseline: Know What “Hardened” Means in Your Org

Before tightening bolts, you need a clear baseline. Otherwise, you’ll end up with one-off fixes and no consistent posture.

1.1 Define your endpoint security tiers

In 2026, most mature orgs run at least two endpoint tiers mapped to risk, not job title:

  • Tier 1 – Standard users: Office users, call centre, retail. Balanced security vs usability.
  • Tier 2 – High-risk users: Admins, finance, execs, product & source code access, security team.

Each tier gets a different policy bundle: stricter device compliance, stronger app control, tighter USB rules, more aggressive Defender settings.

1.2 Minimum baseline controls (for all corporate endpoints)

  • Managed identity (Entra ID / AD joined or at least registered MDM-managed)
  • Full disk encryption (BitLocker / FileVault / mobile OS encryption) enforced, escrowed keys
  • EDR/XDR agent deployed and monitored (Defender for Endpoint or equivalent)
  • Local admin removed for users (with a controlled escalation workflow)
  • OS and browser patching <= 14 days for normal, <= 48h for critical
  • Baseline CIS-like configuration per platform (Windows, macOS, iOS, Android)

If any of these are missing, pause here and fix them first. Hardening on top of an unmanaged, unpatched device is theatre.

2. Device Identity, Compliance, and Conditional Access

By 2026, Zero Trust is not a slogan anymore – your control plane is identity + device compliance. If your endpoints aren’t feeding strong signals into Conditional Access, your security stack is flying blind.

2.1 Enforce “known, healthy device” as a gate

In Entra ID, build Conditional Access policies that make device state a first-class condition:

  • Require compliant device for access to any Tier 0/Tier 1 apps (admin portals, finance, source control)
  • Block legacy auth everywhere (still worth checking in 2026)
  • Require MFA + compliant device for risky sign-ins and privileged roles

Example Entra ID Conditional Access (baseline concept):

// High-level design, not literal JSON
Policy: "Require Compliant Device for Sensitive Apps"
Assignments:
  Users: Admins, Finance, Engineering
  Cloud apps: Exchange Online, SharePoint, OneDrive, Azure Portal, Git hosting
Conditions:
  Device state: Require device to be marked as compliant
Controls:
  Grant: Require MFA, Require compliant device

2.2 Intune compliance policy essentials (Windows 11/12)

  • Require BitLocker with TPM, startup PIN only if risk justifies it
  • Block devices with TPM disabled or Secure Boot off
  • Minimum OS version (e.g. Windows 11 24H2+), block anything below
  • Require real-time protection and cloud-delivered protection in Defender
  • Mark non-compliant after short grace period (e.g. 3–7 days for missing updates)

Same principle applies for macOS and mobile: require encryption, OS version, and EDR. If it can hold company data, it must be in compliance scope.

3. OS Hardening: Windows, macOS, and Mobile

This is where most endpoint security checklists get bloated and unrealistic. Focus on controls that actually break modern attack chains: credential theft, persistence, data exfil, and lateral movement.

3.1 Windows 11/12: core hardening controls

Key settings that give high security value for typical enterprise fleets:

  • Secure Boot & TPM 2.0 enforced at BIOS/UEFI and via compliance
  • Credential Guard for all devices, especially anything with admin tools
  • LSA protection (RunAsPPL) to block credential scraping from LSASS
  • Attack Surface Reduction (ASR) rules with audit->enforce rollout
  • Windows Firewall enabled with domain/company profiles locked down

Example: enabling LSA protection via PowerShell (for GPO/Intune custom OMA-URI you can set same registry path):

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name "RunAsPPL" -Value 1 -PropertyType DWord -Force

Example: core ASR rules (Defender) via PowerShell, starting in audit mode:

$rules = @(
  "D4F940AB-401B-4EFC-AADC-AD5F3C50688A", # Block all Office child processes
  "3B576869-A4EC-4529-8536-B80A7769E899", # Block Office from creating executables
  "26190899-1602-49e8-8b27-eb1d0a1ce869"  # Block credential stealing from LSASS
)

$rulesString = ($rules | ForEach-Object { $_ + "=Audit" }) -join "|"

Set-MpPreference -AttackSurfaceReductionRules_Actions $rulesString

Once you’re comfortable with impacts and have exceptions, flip the actions to Enabled for enforcement.

3.2 macOS hardening via Intune or MDM

On macOS, your priorities are similar but the levers differ:

  • FileVault required, keys escrowed in Intune/Jamf
  • System Integrity Protection (SIP) kept on; block users from disabling via policy
  • Standard accounts only for users; separate admin account for support tasks
  • Application control via notarisation, Gatekeeper, and MDM-approved app lists
  • EDR (Defender for Endpoint, CrowdStrike, etc.) deployed and monitored

Example Intune device configuration profile (concept):

Platform: macOS
Profile type: Templates > Endpoint protection
Settings:
  - FileVault: Enabled, Escrow to Intune
  - Firewall: Enabled, Block all incoming by default
  - Gatekeeper: App Store and identified developers

3.3 Mobile (iOS / Android) – don’t leave the gap

In 2026, a lot of real data exfil happens via mobile apps: messaging, cloud drives, screenshots. Treat mobiles as first-class endpoints:

  • Require device encryption and screen lock with biometric + PIN
  • Enforce OS minimum (e.g. iOS 18+, Android 15+ with Play Integrity attestation)
  • Use App Protection Policies (Intune) for corporate data within Office, Teams, etc.
  • Block rooted/jailbroken and devices with developer mode enabled for corp profiles

4. Application Control and Browser Security

Attackers love your browsers and office apps because they’re always open and trusted by users. Controlling what can execute and what can talk to where is core to modern hardening.

4.1 Windows application control with WDAC

If you’re still relying only on AV signatures and reputation, you’re behind. Implement Windows Defender Application Control (WDAC) for at least your Tier 2 endpoints.

Practical path:

  • Start with a allow Microsoft + line-of-business signers policy in audit
  • Use ConvertFrom-CIPolicy to refine based on audit events
  • Roll out per group: IT & Sec first, then finance, then engineering, etc.

Example: generate a WDAC base policy (simplified):

# From an elevated PowerShell session on a reference machine
$policyPath = "C:\WDAC\BasePolicy.xml"
New-CIPolicy -Level Publisher -FilePath $policyPath -UserPEs 0
ConvertFrom-CIPolicy -XmlFilePath $policyPath -BinaryFilePath "C:\WDAC\BasePolicy.bin"

4.2 Browser hardening (Edge/Chrome/Enterprise browsers)

By 2026, most orgs run managed browsers with sync, extensions, and corporate profiles. Lock down the critical bits:

  • Force sign-in with corporate identity and disable unmanaged profiles on corp devices
  • Control extensions: block by default, allow-list security tools and business-required ones
  • Enable SafeBrowsing/SmartScreen and enterprise phishing protection
  • Enforce password manager policies (allow enterprise manager, block local file exports)

Example Edge policy via Intune (Settings Catalog concept):

Microsoft Edge > Browser sign-in settings:
  - BrowserSignin = Force
  - NonRemovableProfileEnabled = Enabled
Extensions:
  - ExtensionInstallBlocklist = ["*"]
  - ExtensionInstallAllowlist = ["your-security-extension-id", "your-pm-id"]

5. Admin Rights, Privileged Access, and Local Controls

Attackers don’t need domain admin on day one. A single local admin on a laptop with VPN access can be enough. Tighten your privilege story properly; tools are much better in 2026 than a few years ago.

5.1 Remove standing local admin access

Target state: no end user has permanent local admin rights. Instead:

  • Use Privileged Access Workstations (PAWs) for admins, hardened to a stricter baseline
  • Use a privileged access management tool or local admin elevation tool (e.g. Endpoint Privilege Management, BeyondTrust, CyberArk EPM, or similar)
  • Log every elevation: who, when, what binary, justification

For smaller orgs without EPM tools, a pragmatic interim step is a request-based mechanism:

# Example: temporary add a user to local admins for 30 minutes
$User = "CONTOSO\\jane.doe"
$Group = "Administrators"

Add-LocalGroupMember -Group $Group -Member $User
Start-Sleep -Seconds (30 * 60)
Remove-LocalGroupMember -Group $Group -Member $User

Automate the trigger via a helpdesk action or self-service portal with approvals.

5.2 Attack Surface Reduction and exploit protection

Beyond AV, use the native OS mitigations:

  • Defender Exploit Guard (or third-party equivalent) with a standard org-wide profile
  • ASR rules (covered above) applied strictly to high-risk roles
  • Block Office macros from the internet and enforce Mark of the Web behavior

Example setting for blocking Office macros from the internet via GPO/Intune OMA-URI:

HKCU\Software\Microsoft\Office\16.0\Word\Security
"BlockContentExecutionFromInternet"=dword:00000001

6. Data Protection: DLP, Clipboard, and USB

You can have the best EDR and still leak half your important data via copy/paste and USB sticks. Data protection policies turn endpoints from “open pipes” into controlled flows.

6.1 Practical DLP coverage

In Microsoft 365 / Purview DLP (or equivalent), ensure at least:

  • Policies for financial data, customer data, and source code/IP
  • Coverage for endpoint + Exchange + SharePoint/OneDrive + Teams
  • Actions tuned by tier: alert-only for low risk, block + justify for high risk

Example: Endpoint DLP behavior you should enforce:

  • Block copying sensitive files to USB unless device is company-encrypted
  • Warn/require justification for uploading sensitive docs to unsanctioned domains
  • Audit or block printing of highly sensitive data

6.2 USB and peripheral controls

Full USB block is often unrealistic. Go for controlled use instead:

  • Allow keyboards/mice, block unknown HID where possible
  • Allow only encrypted corporate USB drives (via BitLocker To Go or secure hardware tokens)
  • Apply stricter policies to Tier 2 and PAWs (full block except authorised tokens)

Example (concept) Intune device control profile for Defender for Endpoint:

Device control policy:
  - Allow: USB keyboards/mice, printers
  - Block: USB storage except if VID/PID in allowlist
  - Audit: CD/DVD, Bluetooth mass storage

7. Monitoring, Response, and “Prove It Works”

Hardening without feedback is blind. You need evidence that the controls are deployed, effective, and not silently bypassed.

7.1 Core telemetry you should have from every endpoint

  • EDR alerts streamed into a SIEM/XDR platform (Defender XDR, Sentinel, Splunk, etc.)
  • Device compliance and config drift from Intune/MDM
  • Sign-in risk and Conditional Access insights from Entra ID
  • Key DLP events (USB copy, web upload, clipboard blocks)

Example KQL to find endpoints with repeated ASR blocks (Defender XDR / Sentinel):

DeviceEvents
| where ActionType == "AsrRuleFileBlocked"
| summarize BlockCount = count() by DeviceName, RuleId
| where BlockCount > 20
| order by BlockCount desc

Use this to spot apps that need exceptions or users that need training.

7.2 Make endpoint hardening part of incident response

For every real incident involving an endpoint, ask:

  • Which hardening control would have stopped this earlier?
  • Did the device comply with the baseline? If not, why?
  • Did we see early warning signals in logs and ignore them?

Feed the answers back into your baseline, not into a one-off “special” policy.

One Concrete Next Step: Run a Hardening Gap Check This Week

Pick 10 random devices across your org: different departments, roles, and locations. For each, answer these questions:

  • Is it enrolled and compliant in Intune/your MDM?
  • Is disk encryption on, with recovery key escrowed?
  • Is EDR active and reporting to your SIEM/XDR?
  • Does the user have local admin? If yes, why?
  • Are OS & browser versions within your defined minimums?

The gaps you find on those 10 are usually a good mirror for your real posture. Use this checklist to prioritise: fix the basics first, then layer on ASR, WDAC, DLP, and PAWs where they matter most.