--- title: Intune – Migrate your Windows Defender Firewall GPO’s rules for use with Intune/Endpoint Configuration Manager - cubesys description: As you know, you can manage and configure your Windows Defender Firewall with Intune/Endpoint Configuration Manager, including rules.But what about if you already had configured GPO’s (Group Policy Objects) to manage and configure Windows Defender Firewall? Until now you had to manually replicate these rules into Intune/Endpoint Configuration Manager.Well, good… --- [Latest News & Blogs - cubesys ](https://www.cubesys.com.au/blog) # [Intune – Migrate your Windows Defender Firewall GPO’s rules for use with Intune/Endpoint Configuration Manager - cubesys](https://www.cubesys.com.au/blog/intune-migrate-your-windows-defender-firewall-gpos-rules-for-use-with-intune-endpoint-configuration-manager) Written by [cubesys](https://www.cubesys.com.au/blog/author/cubesys) | Jul 19, 2020 2:00:00 PM As you know, you can manage and configure your Windows Defender Firewall with Intune/Endpoint Configuration Manager, including rules. But what about if you already had configured GPO’s (Group Policy Objects) to manage and configure Windows Defender Firewall? Until now you had to manually replicate these rules into Intune/Endpoint Configuration Manager. Well, good new, you can now migrate your Windows Defender Firewall GPO’s for use with Intune. First thing you need to download the migration tool (in fact a PowerShell script) available here [https://aka.ms/EndpointSecurityFWRuleMigrationTool](https://aka.ms/EndpointSecurityFWRuleMigrationTool) Once downloaded, extract the PowerShell script (Export-FirewallRules.ps1). The PowerShell script accepts the following switches: - **IncludeLocalRules**: will include all locally created/default Windows firewall rules in the export - **IncludedDisabledRules**: will include all enabled and disabled Windows firewall rules in the export **NOTE** enabling these switches may result in many included rules By default only **enabled** Firewall rules created by GPO will be exported; the use of the above switched allow you to overwrite the default behaviour. You will need to have appropriate permissions in Intune/Endpoint Configuration Manager to export the firewall rules, either: - Endpoint Security Manager - Intune Service Administrator - Global Administrator - or a custom role with **Delete, Read, Assign, Create, and Update** permissions ## Limitations There are few limitations because of lack of corresponding MDM support for some settings, such as: - IPSec related settings (not supported by MDM) - Interface Identifier (LUID) which is not manageable - Inbound NAT as not exposed by GPO or MDM - OS Versioning as not exposed by GPO or MDM - Local User Owner SID as not applicable with MDM ## Usage of the migration tool/script Once you are ready, you can run the migration tool/script using a PowerShell prompt (with the Run As Administrator option) with the corresponding switch if you want to overwrite the default behaviour. If you don’t run it with the Run As Administrator you will get the below error message > Error:  Must run elevated: run as administrator When running the script, it will install automatically the following PowerShell modules from the PowerShell Gallery: - Intune Powershell SDK - ImportExcel Module Then you will be asked to authenticate against your Intune tenant and then an Intune device configuration profile; it is **required** that the profile **does not already exist**. If it already exist, you will get this error message asking your to use a different name > The Profile name you provided already exists. Please enter a unique profile name: **NOTE** if there is **more than 250 rules** additional profiles will be created with an automatic numbering (like **-1**, **-2**…) You can send telemetry details to Microsoft if an error occurs (default is set to **Yes**) During the export process you will see a progress bar telling you how many rules are being processed and how many rules have been discovered for migration Once completed the migration tool will output the rules that were not automatically migrated and you can access the Intune/Endpoint Configuration Manager firewall profile from the Endpoint Configuration Manager portal ([https://endpoint.microsoft.com/](https://endpoint.microsoft.com/)) under the **Endpoint securityFirewall** blade to then deploy the profile(s) to your devices **NOTE** you can find the log file in **C:WINDOWSsystem32logs** to identify which rules have **been** or **not** been migrated in Excel format     [View full post](https://www.cubesys.com.au/blog/intune-migrate-your-windows-defender-firewall-gpos-rules-for-use-with-intune-endpoint-configuration-manager) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "cubesys" }, "dateModified" : "2025-02-21T15:52:45.198Z", "datePublished" : "2020-07-19T14:00:00Z", "headline" : "Intune – Migrate your Windows Defender Firewall GPO’s rules for use with Intune/Endpoint Configuration Manager", "image" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "mainEntityOfPage" : "https://www.cubesys.com.au/blog/intune-migrate-your-windows-defender-firewall-gpos-rules-for-use-with-intune-endpoint-configuration-manager", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "name" : "Latest News" } } ```