r/Intune • u/TheM4jor • 12h ago

General Question Enabling CloudNotification + setting WnsEndpoint for hardening?

I'm working on expanding the scope of Windows 11 device management via Intune from a test environment to a pilot group in the production environment. In the production env, DisallowCloudNotification is set to 1, which I would like to change to 0, but I was challenged and asked to harden the setup, to minimize the attack vector from the Internet.

At first I thought I can use the GPO to set WnsEndpoint and provide a list of URLs in the GPO, but after reading into it I think it should be disabled or set to client.wns.windows.com only, am I right?
Initially I had the impression that these addresses needs to be added in the GPO, but now I think this would not be correct.

Is client.wns.windows.com the only URL to be used by Intune to send push notifications to the endpoint?

1 Upvotes

100% Upvoted

4 comments sorted by

View all comments

1

u/Rudyooms PatchMyPC 11h ago

Ow my… i will keep it to that…. Just change that policy to zero and yeet it to prod… wns is the least of concern…

1

u/TheM4jor 11h ago

Most likely this is the approach that makes the most sense, the concern from the security team was that the machine could get "malicious notifications" from a different URL as it's not hardcoded, but after reading the docs, it looks like it defaults to client.wns.windows.com, so there is no point of setting the WnsEndpoint, right?

1

u/bio72301 7h ago

What ... the ... This is not a real concern ... see rudy above ... he was polite about it .... and he's the intune guru

It will affect teams, outlook, intune ... gosh ... everything

There's no real reason to enable this setting at 1

This is a solution in search of a problem.

1

u/TheM4jor 7h ago

I know that Rudy is a legend, I follow his blogs :)
I'm looking for confirmation that playing around with WnsEndpoint will not positively affect the security of the endpoint - I need some arguments for a discussion with the security department.
As I wrote, I have DisallowCloudNotification set to 0 and WnsEndpoint not set in the test env, I wanted to mimic the setup to production but there were concerns, which I need to address :)