Unable to edit ASR rules created in Intune - (Block use of copied or impersonated system tools, Block rebooting machine in Safe Mode)

The two ASR rules

• Block use of copied or impersonated system tools
• Block rebooting machine in Safe Mode are fully supported in Intune, but there are some caveats that explain why they might not be editable in the Intune UI and how to manage them instead.

Key points from the documented behavior:

1. Rule support in Intune

• Both rules are listed as supported for Intune:
  • Block rebooting machine in Safe Mode → Intune: Y
  • Block use of copied or impersonated system tools → Intune: Y
• However, there is a known backend issue for at least one ASR rule where it “might not be available in the Intune ASR policy configuration,” even though the rule itself is available through other configuration methods or in existing Intune ASR policies created before the issue.

2. Why an existing rule may be “not editable” in Intune

• If the rule was added when it was still exposed in the Intune ASR policy UI, and later the backend issue removed or hid it from the catalog, the existing policy can continue to apply the rule but the setting may no longer be surfaced for editing in the current Intune UI.
• In that case, the rule is still enforced on devices, but the specific toggle for that rule may not appear or may be locked in the Intune portal.

3. How to manage these rules when the Intune UI does not allow editing When the Intune ASR policy UI cannot be used to edit these rules, the documented alternatives are:

A. Use PowerShell on devices

• Configure ASR rules locally with PowerShell using the rule GUIDs:
  • Block rebooting machine in Safe Mode GUID: 33ddedf1-c6e0-47cb-833e-de6133960387
  • Block use of copied or impersonated system tools GUID: c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb
• Command pattern (run elevated):

    Add-MpPreference -AttackSurfaceReductionRules_Ids <RuleGuid> -AttackSurfaceReductionRules_Actions <Mode>
  

  where <Mode> is one of:
  • 0 or Disabled
  • 1 or Enabled (Block)
  • 2 or AuditMode
  • 5 or NotConfigured
  • 6 or Warn
• Note: If Intune is managing ASR rules, its settings will overwrite conflicting local PowerShell settings on startup.

B. Use MDM CSP / custom OMA-URI in Intune

• These rules are exposed via the Defender Policy CSP and the Intune setting catalog:
  • BlockRebootingMachineInSafeMode
  • BlockUseOfCopiedOrImpersonatedSystemTools
• Allowed values: off, block, audit, warn.
• If the built-in ASR policy blade does not show the rules, create a custom profile using the Defender CSP OMA-URIs (for example, via ./Device/Vendor/MSFT/Policy/Config/Defender/...) or use the setting catalog entries BlockRebootingMachineInSafeMode and BlockUseOfCopiedOrImpersonatedSystemTools to set them.

C. Use Group Policy (for on-prem / hybrid)

• All ASR rules are supported when configured locally via Group Policy.
• If Intune is also managing ASR rules, Intune settings take precedence and can overwrite Group Policy or PowerShell settings.

4. Verifying what is actually applied on devices

• On an affected device, run:

    $p = Get-MpPreference;0..([math]::Min($p.AttackSurfaceReductionRules_Ids.Count,$p.AttackSurfaceReductionRules_Actions.Count)-1) | % {[pscustomobject]@{Id=$p.AttackSurfaceReductionRules_Ids[$_];Action=$p.AttackSurfaceReductionRules_Actions[$_]}} | Format-Table -AutoSize
  

• Confirm that the GUIDs for the two rules are present and check their Action values to see whether they are in Block, Audit, etc.

5. Practical workaround pattern

• If the existing Intune ASR policy will not let these rules be edited:
  1. Create a new ASR configuration using either:
     • Intune setting catalog entries for BlockRebootingMachineInSafeMode and BlockUseOfCopiedOrImpersonatedSystemTools, or
     • A custom profile using the Defender Policy CSP.
  2. Assign the new profile to the same device/user scope.
  3. Once confirmed applied (via Get-MpPreference), retire or unassign the old ASR policy that contains the uneditable rules.

This approach keeps management centralized in Intune while working around the backend limitation that prevents direct editing of those specific rules in the original ASR policy UI.

References:

• Attack surface reduction (ASR) rules reference
• Configure attack surface reduction (ASR) rules and exclusions
• Troubleshoot attack surface reduction (ASR) rules
• Supported Microsoft Intune resources for Tenant Configuration Management