When to use additional security policies

[Dean Gross]

Are there any rules of thumb or guidelines about when an organization should create additional security policies in Endpoint manager after the Baselines have been implemented. i.e. what are the scenarios in which the baselines are not sufficient and additional configuration is recommended?

[#2]

Hello Dean Gross,

Security Baselines are sufficient in most cases but there might be some considerations when you look at the individual settings.
Think of Attack Surface Reduction (ASR) for instance, which blocks certain behaviors that might be normal for business applications to apply like downloading a file through a script.
It all comes down to deciding what functionalities could stop your normal processes from running.

I would advice you to take a look here and see what every individual part of Defender for Endpoint does to decide whether you should create your own policies:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft...