topic Re: Cortex Endpoint Isolation - Allowing Microsoft Intune in Cortex XDR Discussions

Cortex Endpoint Isolation - Allowing Microsoft Intune

rkaltenbach — Thu, 21 Apr 2022 17:21:56 GMT

Anyone have tips on figuring out how to allow exceptions to successfully communication over the internet while an endpoint is in isolation? I would like Microsoft Intune to be able to continue to reach the device while the device is in isolation for the purpose of lock-down policy enforcement and location tracking. While I understand the isolation feature is designed for mitigation of a security compromised device, I would like to explorer using this feature as a method to ensure a user doesn't attempt to data dump their laptop upon an abrupt termination.

Any insight would be greatly appreciated! Thanks all!

Re: Cortex Endpoint Isolation - Allowing Microsoft Intune

KanwarSingh01 — Thu, 21 Apr 2022 23:29:53 GMT

@rkaltenbach You can achieve this by using the agent profile under Prevention settings for policy management:

Policy Management > Prevention > Profile > Agent Profile > Response Actions

Supporting Documentation: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/customizable-agent-settings/add-agent-settings-profile

Thanks.

Re: Cortex Endpoint Isolation - Allowing Microsoft Intune

rkaltenbach — Fri, 22 Apr 2022 15:10:09 GMT

Yes, I'm aware of where the exceptions go... Curious as to what the community has put there. Intune seems to rely on services, which are not executables. I believe this is my biggest hang-up here. I'm also not finding any good logging as to what the endpoint is trying to use to access the internet while in isolation.

Re: Cortex Endpoint Isolation - Allowing Microsoft Intune

SEKKDK — Mon, 10 Nov 2025 10:11:42 GMT

Looking into this as well, did you find a good solution to this?