*This level of semi-automation is selected by default for tenants that were created before August 16, 2020 with Microsoft Defender for Endpoint, with no device groups defined.*|
|**Semi - require approval for core folders remediation**
(also a type of *semi-automation*)|With this level of semi-automation, approval is required for any remediation actions needed on files or executables that are in core folders. Core folders include operating system directories, such as the **Windows** (`\windows\*`).
Remediation actions can be taken automatically on files or executables that are in other (noncore) folders.
Pending actions for files or executables in core folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.
Actions that were taken on files or executables in other folders can be viewed in the [Action Center](auto-investigation-action-center.md), on the **History** tab.|
|**Semi - require approval for non-temp folders remediation**
(also a type of *semi-automation*)|With this level of semi-automation, approval is required for any remediation actions needed on files or executables that aren't* in temporary folders.
Temporary folders can include the following examples:
Remediation actions can be taken automatically on files or executables that are in temporary folders.
Pending actions for files or executables that aren't in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.
Actions that were taken on files or executables in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **History** tab.|
-|**No automated response**
(also referred to as *no automation*)|With no automation, automated investigation doesn't run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation. However, other threat protection features, such as [protection from potentially unwanted applications](/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus), can be in effect, depending on how your antivirus and next-generation protection features are configured.
***Using the *no automation* option is not recommended**, because it reduces the security posture of your organization's devices. [Consider setting up your automation level to full automation (or at least semi-automation)](machine-groups.md).|
+|**No automated response**
(also referred to as *no automation*)|With no automation, automated investigation doesn't run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation. However, other threat protection features, such as [protection from potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md), can be in effect, depending on how your antivirus and next-generation protection features are configured.
***Using the *no automation* option is not recommended**, because it reduces the security posture of your organization's devices. [Consider setting up your automation level to full automation (or at least semi-automation)](machine-groups.md).|
## Important points about automation levels
@@ -63,4 +66,3 @@ Automated investigation and remediation (AIR) capabilities in Microsoft Defender
- [Configure automated investigation and remediation capabilities in Defender for Endpoint](configure-automated-investigations-remediation.md)
- [Visit the Action Center](auto-investigation-action-center.md#the-unified-action-center)
-
diff --git a/defender-endpoint/basic-permissions.md b/defender-endpoint/basic-permissions.md
index 8ac1cb9ba5f..d3c3e6e6ce5 100644
--- a/defender-endpoint/basic-permissions.md
+++ b/defender-endpoint/basic-permissions.md
@@ -1,92 +1,81 @@
---
-title: Use basic permissions to access the portal
-description: Learn how to use basic permissions to access the Microsoft Defender for Endpoint portal.
+title: Assign Microsoft Defender for Endpoint basic permissions
+description: Learn how existing Microsoft Defender for Endpoint customers can assign full or read-only portal access by using Microsoft Graph PowerShell.
ms.service: defender-endpoint
ms.subservice: onboard
ms.author: painbar
author: paulinbar
ms.localizationpriority: medium
ms.custom:
- - msecd-doc-authoring-1014
+ - msecd-doc-authoring-1015
- has-azure-ad-ps-ref
- - azure-ad-ref-level-one-done
-ms.collection:
+ - azure-ad-ref-level-one-done
+ms.collection:
- m365-security
- tier2
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 08/13/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-
ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to assign basic Defender for Endpoint portal permissions so that users have the access required for their responsibilities.
---
-# Use basic permissions to access the portal
-
-
-This article explains how to set up basic permissions management in the Microsoft Defender portal, including how to assign full access or read-only access using Microsoft Graph PowerShell. If you want to use basic permissions management for the Microsoft Defender portal, keep in mind that permissions are set to either full access or read only. For granular control over permissions, [use role-based access control](rbac.md).
-
-## Assign user access using Microsoft Graph PowerShell
-You can assign users with one of the following levels of permissions:
+# Assign basic permissions for Microsoft Defender for Endpoint portal access
-- Full access (Read and Write)
-- Read-only access
+Basic permissions management gives existing Microsoft Defender for Endpoint customers two portal access levels: full access or read-only access. Use Microsoft Graph PowerShell to assign the Security Administrator role for full access or the Security Reader role for read-only access. For more granular permissions, [use role-based access control](rbac.md).
-### Before you begin
+> [!IMPORTANT]
+> Starting February 16, 2025, new Defender for Endpoint customers can use only Microsoft Defender unified role-based access control (RBAC). Existing customers can continue to use their current permission model. For more information, see [Microsoft Defender unified RBAC](/defender-xdr/manage-rbac).
-Complete the following prerequisites before you assign user access:
+
-- Install Microsoft Graph PowerShell. For more information, see, [How to install Microsoft Graph PowerShell](/powershell/microsoftgraph/installation).
+## Prerequisites
- > [!NOTE]
- > You need to run the PowerShell cmdlets in an elevated command-line.
+Complete these prerequisites before you assign user access:
-- Connect to your Microsoft Entra ID. For more information, see [Connect-MgGraph](/powershell/microsoftgraph/authentication-commands).
+- Confirm that your organization still uses basic permissions management. If your organization switched to RBAC, you can't switch back to basic permissions.
+- Install [Microsoft Graph PowerShell](/powershell/microsoftgraph/installation).
+- Use an account assigned the Privileged Role Administrator role or a custom role with the required role-management permissions. Privileged Role Administrator is the least-privileged Microsoft Entra built-in role supported for this operation.
+- Connect to Microsoft Graph by using **Connect-MgGraph** with the delegated `RoleManagement.ReadWrite.Directory` and `User.ReadBasic.All` permissions. For authentication options, see [Microsoft Graph PowerShell authentication commands](/powershell/microsoftgraph/authentication-commands).
- - **Full access**: Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package. Assigning full access rights requires adding the users to a role, such as Security Administrator, using Microsoft Entra built-in roles.
+You don't need to run PowerShell as a local Windows administrator to assign Microsoft Entra roles through Microsoft Graph.
- - **Read-only access**: Users with read-only access can log in, view all alerts, and related information.
+## Understand the basic access levels
- They will not be able to change alert states, submit files for deep analysis or perform any state changing operations.
+Basic permissions management provides these access levels:
- Assigning read-only access rights requires adding the users to the "Security Reader" Microsoft Entra built-in role.
+- **Full access**: Users can sign in, view system information, resolve alerts, submit files for deep analysis, and download the onboarding package. Assign the Microsoft Entra Security Administrator role to grant full access.
+- **Read-only access**: Users can sign in and view alerts and related information. They can't change alert states, submit files for deep analysis, or perform other state-changing operations. Assign the Microsoft Entra Security Reader role to grant read-only access.
-Use the following steps to assign security roles:
-
-- For **read and write** access, assign users to the security administrator role by using the following command:
+## Assign user access using Microsoft Graph PowerShell
- ```PowerShell
- $Role = Get-MgDirectoryRole -Filter "DisplayName eq 'Security Administrator'"
- $UserId = (Get-MgUser -UserId "secadmin@Contoso.onmicrosoft.com").Id
+Assign the appropriate Microsoft Entra role to each user who needs access to Defender for Endpoint.
- $DirObject = @{
- "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$UserId"
- }
+> [!NOTE]
+> The following examples use the `directoryRole` membership API. Microsoft recommends the unified role-assignment API for new automation. **Get-MgDirectoryRole** returns only activated directory roles. If the command doesn't return the requested role, [assign the Microsoft Entra role in the admin center](/entra/identity/role-based-access-control/manage-roles-portal) or use the [unified role-assignment API](/graph/api/rbacapplication-post-roleassignments).
- New-MgDirectoryRoleMemberByRef -DirectoryRoleId $Role.Id -BodyParameter $DirObject
- ```
+### Assign full access
-- For **read-only** access, assign users to the security reader role by using the following command:
+Replace `secadmin@contoso.onmicrosoft.com` with the user principal name of the account that needs full access, and then run the following command:
- ```PowerShell
- $Role = Get-MgDirectoryRole -Filter "DisplayName eq 'Security Reader'"
- $UserId = (Get-MgUser -UserId "reader@Contoso.onmicrosoft.com").Id
+```powershell
+New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole -Filter "DisplayName eq 'Security Administrator'").Id -OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$((Get-MgUser -UserId 'secadmin@contoso.onmicrosoft.com').Id)"
+```
- $DirObject = @{
- "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$UserId"
- }
+### Assign read-only access
- New-MgDirectoryRoleMemberByRef -DirectoryRoleId $Role.Id -BodyParameter $DirObject
- ```
+Replace `reader@contoso.onmicrosoft.com` with the user principal name of the account that needs read-only access, and then run the following command:
-For more information, see [Add or remove group members using Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal).
+```powershell
+New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole -Filter "DisplayName eq 'Security Reader'").Id -OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$((Get-MgUser -UserId 'reader@contoso.onmicrosoft.com').Id)"
+```
+
-## Related articles
+## Related content
- [Assign Microsoft Entra roles to users](/entra/identity/role-based-access-control/manage-roles-portal)
-- [Manage portal access using RBAC](rbac.md)
-
-
-
+- [Manage Defender for Endpoint portal access permissions](assign-portal-access.md)
+- [Manage portal access by using RBAC](rbac.md)
diff --git a/defender-endpoint/behavior-monitor.md b/defender-endpoint/behavior-monitor.md
index 637c630ade1..c90ffadf51e 100644
--- a/defender-endpoint/behavior-monitor.md
+++ b/defender-endpoint/behavior-monitor.md
@@ -1,100 +1,91 @@
---
title: Behavior monitoring in Microsoft Defender Antivirus
-description: Learn about Behavior monitoring in Microsoft Defender Antivirus and Defender for Endpoint.
+description: Learn how Microsoft Defender Antivirus behavior monitoring detects threats, how to configure and verify it, and how to troubleshoot performance.
author: chrisda
ms.author: chrisda
ms.reviewer: yongrhee
-ms.topic: article
+ms.topic: overview
ms.service: defender-endpoint
ms.subservice: ngp
ms.localizationpriority: medium
-ms.date: 04/29/2025
+ms.date: 08/13/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
- Microsoft Defender for Individuals
-
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1015
+#customer intent: As an administrator, I want to understand and manage behavior monitoring so that Microsoft Defender Antivirus can detect suspicious activity while maintaining device performance.
---
-# Behavior monitoring in Microsoft Defender Antivirus
-
-
-Behavior monitoring is a critical detection and protection functionality of Microsoft Defender Antivirus.
-
-Monitors process behavior to detect and analyze potential threats based on the behavior of applications, services, and files. Rather than relying solely on signature-based detection (which identifies known malware patterns), behavior monitoring focuses on observing how software behaves in real-time. Here's what it entails:
-
-1. Real-Time Threat Detection:
- - Continuously observe processes, file system activities, and interactions within the system.
- - Defender Antivirus can identify patterns associated with malware or other threats. For example, it looks for processes making unusual changes to existing files, modifying or creating automatic startup registry (ASEP) keys, and other alterations to the file system or structure.
-
-1. Dynamic Approach:
-
-- Unlike static, signature-based detection, behavior monitoring adapts to new and evolving threats.
-
-- Microsoft Defender Antivirus uses predefined patterns, and observes how software behaves during execution. For malware that doesn't fit any predefined pattern, Microsoft Defender Antivirus uses anomaly detection.
-
-- If a program shows suspicious behavior (for example, attempting to modify critical system files), Microsoft Defender Antivirus can take action to prevent further harm, and revert some previous malware actions.
-Behavior monitoring enhances Defender Antivirus's ability to proactively detect emerging threats by focusing on real-time actions and behaviors rather than relying solely on known signatures.
+# Behavior monitoring in Microsoft Defender Antivirus
-The following features depend on behavior monitoring.
+Behavior monitoring is a critical Microsoft Defender Antivirus detection and protection capability. It observes process, file, and service activity in real time and detects threats from suspicious behavior, including threats that don't match known malware signatures.
-**Anti-malware**:
+## How behavior monitoring works
-- Indicators, File hash, allow/block
+Behavior monitoring uses these approaches to identify and stop suspicious activity:
-**Network Protection**:
+- **Real-time threat detection**: Continuously observes processes, file system activity, and interactions on the device. For example, Microsoft Defender Antivirus can detect unusual file changes or attempts to create or modify autostart extensibility point (ASEP) registry keys.
+- **Dynamic analysis**: Uses known behavior patterns and anomaly detection to identify new and evolving threats while software runs.
+- **Response and remediation**: Takes action when a program behaves suspiciously, such as attempting to modify critical system files.
-- Indicators, IP address/URL, allow/block
-- Web Content Filtering, allow/block
+Behavior monitoring is required for the following features:
-> [!NOTE]
-> Behavior monitoring is protected by tamper protection.
+- **Antimalware**: File hash allow and block indicators.
+- **Network protection**: IP address and URL allow and block indicators, and web content filtering.
-To temporarily disable behavior monitoring in order to remove it out of the picture, you want to first enable Troubleshooting mode, disable Tamper Protection, and then disable behavior monitoring.
+> [!IMPORTANT]
+> Behavior monitoring is enabled by default and is protected by tamper protection. Keep behavior monitoring enabled except during a controlled, temporary troubleshooting test.
## Change the behavior monitoring policy
-The following table shows the different ways to configure behavior monitoring.
+Use one of the following management tools to configure behavior monitoring.
-| Management tool | Name | Links |
+|Management tool|Setting|Documentation|
|---|---|---|
-| Security Settings Management | Allow behavior monitoring | This article |
-| Intune | Allow behavior monitoring | [Windows Antivirus policy settings for Microsoft Defender Antivirus for Intune](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows#real-time-protection) |
-| CSP | AllowBehaviorMonitoring | [Defender Policy CSP](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows#real-time-protection) |
-| Configuration Manager Tenant Attach | Turn on behavior monitoring | [Windows Antivirus policy settings from Microsoft Defender Antivirus for tenant attached devices](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows-tenant-attach#real-time-protection) |
-| Group Policy | Turn on behavior monitoring | [Download Group Policy Settings Reference Spreadsheet for Windows 11 2023 Update (23H2)](https://www.microsoft.com/download/details.aspx?id=105668) |
-| PowerShell | Set-MpPreference -DisableBehaviorMonitoring | [Set-MpPreference](/powershell/module/defender/set-mppreference#-disablebehaviormonitoring) |
-| WMI | boolean DisableBehaviorMonitoring; | [MSFT\_MpPreference class](/previous-versions/windows/desktop/defender/msft-mppreference) |
+|Defender for Endpoint security settings management|Allow behavior monitoring|[Manage Microsoft Defender Antivirus through security settings management](/intune/intune-service/protect/mde-security-integration)|
+|Microsoft Intune|Allow behavior monitoring|[Microsoft Defender Antivirus policy settings for Windows](/intune/device-configuration/endpoint-security/ref-antivirus-defender-settings-windows#real-time-protection)|
+|Configuration service provider (CSP)|AllowBehaviorMonitoring|[Defender Policy CSP](/windows/client-management/mdm/policy-csp-defender#allowbehaviormonitoring)|
+|Configuration Manager tenant attach|Turn on behavior monitoring|[Microsoft Defender Antivirus policy settings for tenant-attached devices](/intune/device-configuration/endpoint-security/ref-antivirus-defender-settings-windows-tenant-attach#real-time-protection)|
+|Group Policy|Turn on behavior monitoring|[Configure Microsoft Defender Antivirus with Group Policy](use-group-policy-microsoft-defender-antivirus.md)|
+|PowerShell|**Set-MpPreference** _DisableBehaviorMonitoring_|[Set-MpPreference](/powershell/module/defender/set-mppreference#-disablebehaviormonitoring)|
+|Windows Management Instrumentation (WMI)|DisableBehaviorMonitoring|[MSFT\_MpPreference class](/previous-versions/windows/desktop/defender/msft-mppreference)|
If you use Microsoft Defender for Business, see [Review or edit your next-generation protection policies in Microsoft Defender for Business](/defender-business/mdb-next-generation-protection).
## Modify the behavior monitoring settings by using PowerShell
-Use the following command to modify the behavior monitoring settings:
+To enable behavior monitoring, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**):
+
+```powershell
+Set-MpPreference -DisableBehaviorMonitoring $false
+```
+
+To temporarily disable behavior monitoring for troubleshooting, run the following command in an elevated PowerShell session:
```powershell
-Set-MpPreference -DisableBehaviorMonitoring **Scan** > **Specify the maximum depth to scan archive files**|0|Not available|
-|Specify the maximum CPU load (as a percentage) during a scan. **Scan** > **Specify the maximum percentage of CPU utilization during a scan**|50|`-ScanAvgCPULoadFactor` **Scan** \> **Specify the maximum depth to scan archive files**|0|Not available|
+|Specify the maximum CPU load (as a percentage) during a scan. **Scan** \> **Specify the maximum percentage of CPU utilization during a scan**|50|`-ScanAvgCPULoadFactor` Beta Channel: Devices set to this channel are the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. Current Channel (Preview): Devices set to this channel are offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. Current Channel (Staged): Devices are offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). Current Channel (Broad): Devices are offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). Critical- Time Delay: Devices are offered updates with a 48-hour delay. Suggested for critical environments only. If you disable or don't configure this policy, the device stays up to date automatically during the gradual release cycle. Suitable for most devices.|Windows Components\Microsoft Defender Antivirus|
-|Select gradual Microsoft Defender monthly engine update rollout channel|Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. Beta Channel: Devices set to this channel are the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. Current Channel (Preview): Devices set to this channel are offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. Current Channel (Staged): Devices are offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). Current Channel (Broad): Devices are offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). Critical- Time Delay: Devices are offered updates with a 48-hour delay. Suggested for critical environments only. If you disable or don't configure this policy, the device stays up to date automatically during the gradual release cycle. Suitable for most devices.|Windows Components\Microsoft Defender Antivirus|
-|Select gradual Microsoft Defender daily security intelligence updates rollout channel|Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. Current Channel (Staged): Devices are offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). Current Channel (Broad): Devices are offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). If you disable or don't configure this policy, the device stays up to date automatically during the daily release cycle. Suitable for most devices.|Windows Components\Microsoft Defender Antivirus|
-|Disable gradual rollout of Microsoft Defender updates|Enable this policy to disable gradual rollout of Defender updates. Current Channel (Broad): Devices set to this channel are offered updates last during the gradual release cycle. Best for datacenter machines that only receive limited updates. Note: This setting applies to both monthly and daily Defender updates and overrides any previously configured channel selections for platform and engine updates. If you disable or don't configure this policy, the device remains in Current Channel (Default) unless specified otherwise in specific channels for platform and engine updates. Stay up to date automatically during the gradual release cycle. Suitable for most devices.|Windows Components\Microsoft Defender Antivirus\MpEngine|
+|Select the channel for Microsoft Defender monthly platform updates|Select when devices receive monthly platform updates. Available channels are Beta, Preview, Staged, Broad, Critical: Time Delay, and Not configured.|Windows Components\Microsoft Defender Antivirus|
+|Select the channel for Microsoft Defender monthly engine updates|Select when devices receive monthly engine updates. Available channels are Beta, Preview, Staged, Broad, Critical: Time Delay, and Not configured.|Windows Components\Microsoft Defender Antivirus|
+|Select the channel for Microsoft Defender daily security intelligence updates|Select Staged, Broad, or Not configured for security intelligence rollout cycles, which occur multiple times each day.|Windows Components\Microsoft Defender Antivirus|
+|Disable gradual rollout of Microsoft Defender updates|Disable gradual rollout for monthly and security intelligence updates. This setting overrides configured platform and engine update channels.|Windows Components\Microsoft Defender Antivirus\MpEngine|
+For monthly platform and engine updates, use the following channels:
+
+- **Beta Channel**: Receive prerelease updates first. Use this channel only for a limited number of devices in manual test environments. Devices in the Windows Insider Program are subscribed to this channel by default.
+- **Current Channel (Preview)**: Receive updates earliest during gradual release. Use this channel for preproduction or validation environments.
+- **Current Channel (Staged)**: Receive updates later during gradual release. Use this channel for a small, representative group of production devices.
+- **Current Channel (Broad)**: Receive updates after gradual release completes. Use this channel for a broad group of production devices.
+- **Critical: Time Delay**: Receive updates with a 48-hour delay. Use this channel only for critical environments.
+- **Not configured**: Allow Microsoft to assign devices to channels during gradual release. This setting is suitable for most devices.
+
+For security intelligence updates, select Staged, Broad, or Not configured. The Defender CSP currently documents Staged as equivalent to Broad. Don't rely on a timing difference between Staged and Broad without validating the behavior in your environment. For more rollout guidance, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md).
+
## Configure a gradual rollout by using Group Policy
> [!NOTE]
-> An updated Defender ADMX template is published together with the 21H2 release of Windows 10. A non-localized version is available for download at [Microsoft Defender update controls repository](https://github.com/microsoft/defender-updatecontrols) on GitHub.
+> Use the latest Windows administrative templates available for your environment. If the templates don't contain these settings, a temporary, English-only template is available from the [Microsoft Defender update controls repository](https://github.com/microsoft/defender-updatecontrols) on GitHub.
-You can use [Group Policy](/windows/win32/srvnodes/group-policy?redirectedfrom=MSDN) to configure and manage Microsoft Defender Antivirus on your endpoints. In general, you can use the following procedure to configure or change Microsoft Defender Antivirus group policy settings:
+You can use [Group Policy](/windows/win32/srvnodes/group-policy?redirectedfrom=MSDN) to configure and manage Microsoft Defender Antivirus on your endpoints. To configure an update channel:
-1. On your Group Policy management machine, open the **Group Policy Management Console**, right-click the **Group Policy Object** (GPO) you want to configure and select **Edit**.
+1. On your Group Policy management machine, open the **Group Policy Management Console**, right-click the **Group Policy Object** (GPO) you want to configure, and select **Edit**.
-1. Using the Group Policy Management Editor go to **Computer configuration**.
+1. In the Group Policy Management Editor, go to **Computer configuration**.
1. Select **Administrative templates**.
1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus**.
-1. Expand the section listed in the **Location** column of the preceding policy settings table (for example, **Windows Components\Microsoft Defender Antivirus**) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes.
+1. Expand the section in the **Location** column of the [Group Policy settings table](#group-policy-settings), double-click the setting, and configure the update channel.
-1. Deploy the updated GPO as you normally do. For guidance, see [Deploying Group Policy Objects](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx).
+1. Deploy the updated GPO as you normally do. For guidance, see [Group Policy](/windows/win32/srvnodes/group-policy).
+
## Configure a gradual rollout by using Microsoft Intune
-To create a custom policy in Intune, follow the instructions in [Add custom settings for Windows 10 devices in Microsoft Intune](/intune/intune-service/configuration/custom-settings-windows-10).
+Create a Windows [Settings Catalog policy in Microsoft Intune](/intune/device-configuration/settings-catalog/). In the **Defender** category, configure one or more of the following settings:
+
+- **Platform Updates Channel**
+- **Engine Updates Channel**
+- **Security Intelligence Updates Channel**
+- **Disable Gradual Release**
+
+If you need to use a custom Open Mobile Alliance Uniform Resource Identifier (OMA-URI) policy, follow the instructions in [Add custom settings for Windows 10 devices in Microsoft Intune](/intune/intune-service/configuration/custom-settings-windows-10) and use the following values:
+
+|Setting|OMA-URI|Allowed values|
+|---|---|---|
+|Platform updates channel|`./Device/Vendor/MSFT/Defender/Configuration/PlatformUpdatesChannel`|`0` Not configured, `2` Beta, `3` Preview, `4` Staged, `5` Broad, `6` Critical: Time Delay|
+|Engine updates channel|`./Device/Vendor/MSFT/Defender/Configuration/EngineUpdatesChannel`|`0` Not configured, `2` Beta, `3` Preview, `4` Staged, `5` Broad, `6` Critical: Time Delay|
+|Security intelligence updates channel|`./Device/Vendor/MSFT/Defender/Configuration/SecurityIntelligenceUpdatesChannel`|`0` Not configured, `4` Staged, `5` Broad|
+|Disable gradual release|`./Device/Vendor/MSFT/Defender/Configuration/DisableGradualRelease`|`0` False, `1` True|
-For more information on the Defender CSP used for the gradual rollout process, see [Defender CSP](/windows/client-management/mdm/defender-csp).
+For more information about the OMA-URI settings and values, see [Defender CSP](/windows/client-management/mdm/defender-csp).
+
## Configure a gradual rollout by using PowerShell
-Use the `Set-MpPreference` cmdlet to configure roll out of the gradual updates.
+Use the **Set-MpPreference** cmdlet to configure Defender Antivirus update and protection preferences.
Use the following parameters:
+- _PlatformUpdatesChannel_ (`Beta`, `Preview`, `Staged`, `Broad`, `Delayed`, or `NotConfigured`)
+- _EngineUpdatesChannel_ (`Beta`, `Preview`, `Staged`, `Broad`, `Delayed`, or `NotConfigured`)
+- _DefinitionUpdatesChannel_ (`Staged`, `Broad`, or `NotConfigured`)
+- _DisableGradualRelease_ (`$true` or `$false`)
+
+For example, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**) to configure platform updates to arrive from the Beta Channel:
+
```powershell
-Set-MpPreference
--PlatformUpdatesChannel Beta|Preview|Staged|Broad|Delayed|NotConfigured
--EngineUpdatesChannel Beta|Preview|Staged|Broad|Delayed|NotConfigured
--DisableGradualRelease 1|0
--DefinitionUpdatesChannel Staged|Broad|NotConfigured
+Set-MpPreference -PlatformUpdatesChannel Beta
```
-Example:
-Use `Set-MpPreference -PlatformUpdatesChannel Beta` to configure platform updates to arrive from the Beta Channel.
-
-For more information on the parameters and how to configure them, see [Set-MpPreference](/powershell/module/defender/set-mppreference) (Microsoft Defender Antivirus).
+For more information about these parameters, see [Set-MpPreference](/powershell/module/defender/set-mppreference).
+
## Verify gradual rollout configuration in the registry
-These settings can be confirmed in the registry under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`:
+To verify the effective PowerShell configuration, run `Get-MpPreference | Select-Object PlatformUpdatesChannel, EngineUpdatesChannel, DefinitionUpdatesChannel, DisableGradualRelease`.
+
+Policy-backed update channel settings can appear under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`:
- `EngineRing`
- `PlatformRing`
- `SignaturesRing`
+The `DisableGradualRelease` value appears under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine`.
+
> [!NOTE]
> You can also use a management tool such as Microsoft Configuration Manager to run PowerShell scripts. See [Create and run PowerShell scripts from the Configuration Manager console](/intune/configmgr/apps/deploy-use/create-deploy-scripts).
> [!TIP]
-> If you're looking for Antivirus related information for other platforms, see:
+> For antivirus information for other platforms, see:
+
> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md)
> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md)
> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/intune/intune-service/protect/antivirus-microsoft-defender-settings-macos)
@@ -118,6 +150,3 @@ These settings can be confirmed in the registry under `HKEY_LOCAL_MACHINE\SOFTWA
> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
> - [Configure Defender for Endpoint on Android features](android-configure.md)
> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)
-
-
-
diff --git a/defender-endpoint/configure-vulnerability-email-notifications.md b/defender-endpoint/configure-vulnerability-email-notifications.md
index 85f41e7cde2..3fc599eed70 100644
--- a/defender-endpoint/configure-vulnerability-email-notifications.md
+++ b/defender-endpoint/configure-vulnerability-email-notifications.md
@@ -9,18 +9,18 @@ ms.collection:
- m365-security
- tier2
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
# Configure vulnerability email notifications in Microsoft Defender for Endpoint
-Configure Microsoft Defender for Endpoint to send email notifications to specified recipients for new vulnerability events. This feature enables you to identify a group of individuals who will immediately be informed and can act on the notifications based on the vulnerability event that triggered the rule. Information about vulnerability events comes from [Microsoft Defender Vulnerability Management](/defender-vulnerability-management/defender-vulnerability-management).
+Configure Microsoft Defender for Endpoint to send email notifications to specified recipients for new vulnerability events. This feature lets you identify a group of people who are informed right away and can act based on the event that triggered the notification rule. Vulnerability event data comes from [Microsoft Defender Vulnerability Management](/defender-vulnerability-management/defender-vulnerability-management).
If you're using [Defender for Business](/defender-business/mdb-overview), you can set up vulnerability notifications for specific users only (not roles or groups).
@@ -28,11 +28,11 @@ If you're using [Defender for Business](/defender-business/mdb-overview), you ca
> - Only users with `Manage security settings` permissions can configure email notifications. If you've chosen to use basic permissions management, users with an appropriate role, such as Security Administrator, can configure email notifications. [User roles and permission options](user-roles.md)
> - Device group creation is supported in Defender for Endpoint Plan 1 and Plan 2.
-The notification rules allow you to set the vulnerability events that trigger notifications, and add or remove email notification recipients. New recipients get notified about vulnerabilities after the recipients are added.
+Email notification rules allow you to set the vulnerability events that trigger notifications, and add or remove email notification recipients. New recipients get notified about vulnerabilities after the recipients are added.
-If you're using role-based access control (RBAC), recipients only receive notifications based on the device groups that were configured in the corresponding notification rule. Users with the proper permission can only create, edit, or delete notifications that are limited to their device group management scope. Only users assigned to an administrator role, such as Security Administrator, can manage notification rules that are configured for all device groups.
+If you're using role-based access control (RBAC), recipients only get notifications for device groups set in the matching notification rule. Users with the right permission can only create, edit, or delete notifications within their device group scope. Only users with an admin role, such as Security Administrator, can manage rules for all device groups.
-The email notification includes basic information about the vulnerability event. There are also links to filtered views in the Defender Vulnerability Management [Security recommendations](api/ti-indicator.md) and [Weaknesses](/defender-vulnerability-management/tvm-weaknesses) pages in the Microsoft Defender portal so you can further investigate. For example, you could get a list of all exposed devices or get additional details about the vulnerability.
+The email notification includes basic information about the vulnerability event. The notification also includes links to filtered views in the Microsoft Defender portal: the [Security recommendations](api/ti-indicator.md) page and the [Weaknesses](/defender-vulnerability-management/tvm-weaknesses) page, so you can investigate further. For example, you could get a list of all exposed devices or get additional details about the vulnerability.
> [!IMPORTANT]
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
@@ -40,7 +40,7 @@ The email notification includes basic information about the vulnerability event.
## Create vulnerability email notification rules
-Create a notification rule to send an email when there are certain exploit or vulnerability events, such as a new public exploit. For each rule, multiple event types can be selected.
+Create a rule to send an email when certain exploit or vulnerability events occur, such as a new public exploit. You can select multiple event types for each rule.
1. Sign in to the [Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2077139) using an account with the Security Administrator role assigned.
@@ -74,16 +74,20 @@ Create a notification rule to send an email when there are certain exploit or vu
## Edit a vulnerability email notification rule
+Make sure you have permission to edit the rule before you begin.
+
1. From the list of notification rules, select the rule you want to edit.
-1. Select the **Edit rule** button next to the pencil icon in the flyout. Make sure you have permission to edit or delete the rule.
+1. Select the **Edit rule** button next to the pencil icon in the flyout.
## Delete a vulnerability email notification rule
+Make sure you have permission to delete the rule before you begin.
+
1. From the list of notification rules, select the rule you want to delete.
-1. Select the **Delete** button next to the trash can icon in the flyout. Make sure you have permission to edit or delete the rule.
+1. Select the **Delete** button next to the trash can icon in the flyout.
## Troubleshoot email notifications for alerts
diff --git a/defender-endpoint/configure-wdac-script-enforcement-mde.md b/defender-endpoint/configure-wdac-script-enforcement-mde.md
index 97caaaf9748..7844f61882c 100644
--- a/defender-endpoint/configure-wdac-script-enforcement-mde.md
+++ b/defender-endpoint/configure-wdac-script-enforcement-mde.md
@@ -11,8 +11,8 @@ ms.collection:
- m365-security
- tier2
- mde-asr
-ms.custom: msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: msecd-doc-authoring-1016
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1 and Plan 2
- Microsoft Defender XDR
@@ -22,11 +22,13 @@ ai-usage: ai-assisted
# Allow Microsoft Defender for Endpoint scripts with WDAC script enforcement
-This article explains how to configure allow rules in Windows Defender Application Control (WDAC), also known as [App Control for Business](/windows/security/application-security/application-control/app-control-for-business/appcontrol), to let built-in Microsoft Defender for Endpoint PowerShell scripts run in **FullLanguage** mode. Without the appropriate WDAC allow rules, MDE features that rely on PowerShell scripts don't work as expected.
+This article explains how to configure allow rules in Windows Defender Application Control (WDAC), also known as [App Control for Business](/windows/security/application-security/application-control/app-control-for-business/appcontrol), to let built-in Microsoft Defender for Endpoint PowerShell scripts run in **FullLanguage** mode. Without the appropriate WDAC allow rules, MDE features that rely on PowerShell scripts don't work as expected. Before you start, review the [prerequisites and planning considerations](#before-you-begin).
## Supported platforms and requirements
+This configuration requires the following platforms and components:
+
- Windows 10 or later
- Windows Server 2019 or later
- Devices onboarded to Microsoft Defender for Endpoint with WDAC script enforcement enabled
@@ -381,6 +383,9 @@ To finish the certificate-based rule setup:
## Create path-based allow rules (use only when necessary)
+> [!WARNING]
+> Broad path-based allow rules can weaken your security posture. Avoid user-writable locations and wide wildcards.
+
Path-based allow rules trust all content in a specific folder. Use path-based rules only when certificate-based rules aren't feasible, such as for unsigned line-of-business scripts that you fully control.
### Step 1: Choose the minimal folder path
diff --git a/defender-endpoint/controlled-folder-access-configure.md b/defender-endpoint/controlled-folder-access-configure.md
new file mode 100644
index 00000000000..29ebe147934
--- /dev/null
+++ b/defender-endpoint/controlled-folder-access-configure.md
@@ -0,0 +1,339 @@
+---
+title: Configure controlled folder access
+description: Enable controlled folder access to protect your important files and folders from malicious apps and threats such as ransomware.
+ms.service: defender-endpoint
+ms.localizationpriority: medium
+author: chrisda
+ms.author: chrisda
+ms.reviewer: sugamar; moeghasemi
+ms.subservice: asr
+ms.topic: how-to
+ms.collection:
+- m365-security
+- tier3
+- mde-asr
+ms.date: 08/31/2026
+ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to enable controlled folder access on devices so that I can protect important files and folders from ransomware and other malicious apps.
+appliesto:
+- Microsoft Defender for Endpoint Plan 1
+- Microsoft Defender for Endpoint Plan 2
+- Microsoft Defender Antivirus
+---
+
+# Configure controlled folder access (CFA)
+
+[Controlled folder access](controlled-folder-access-overview.md) (CFA) helps protect your valuable data from malicious apps and threats, such as ransomware, by preventing untrusted apps from changing files in protected folders. You can enable and configure CFA by using any of the methods in this article.
+
+For best results, use an enterprise-level management solution such as Microsoft Intune or Microsoft Configuration Manager to manage CFA.
+
+## Prerequisites
+
+CFA is available in the following operating systems:
+
+- Windows 10 or later.
+- Windows Server 2019 or later.
+- Windows Server 2016 and Windows Server 2012 R2 as part of the [modern, unified Microsoft Defender for Endpoint solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
+
+
+
+## Configure CFA in Intune using endpoint security policies
+
+[!INCLUDE [Intune is recommended but is a separate product](includes/intune-recommended-separate-product.md)]
+
+To configure CFA in Microsoft Intune, use an endpoint security **Attack surface reduction** policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).
+
+When you create the policy, use these specific settings:
+
+- **Policy type**: Select **Manage** \> **Attack surface reduction** on the **Endpoint security \| Overview** page.
+- **Platform**: Select **Windows**.
+- **Profile**: Select **Attack Surface Reduction Rules**.
+
+When you create or modify the policy, after you configure the [attack surface reduction (ASR) rules settings](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies), use these specific CFA settings on the **Configuration settings** tab:
+
+- **Enable controlled folder access**: Select an available [mode value](controlled-folder-access-overview.md#modes-for-cfa). After you assess the effect of CFA in **Audit Mode**, you can set it to **Enabled**.
+
+- **Controlled folder access protected folders**: To add more folders that get CFA protection, use either of the following methods:
+ - Select :::image type="icon" source="media/defender-portal-icon-create.png" border="false"::: **Add**. In the box that appears, enter the path to include. For example:
+ - `C:\Data\Reports`
+ - `C:\Data\Finance`
+
+ - Select :::image type="icon" source="media/intune-icon-import.png" border="false"::: **Import** to import a CSV file that contains the paths to include. The CSV file uses the following format:
+
+ ```text
+ ControlledFolderAccessProtectedFolders
+ "C:\folder1"
+ "C:\folder2"
+ ...
+ ```
+
+ > [!TIP]
+ > Double quotation marks around the values are optional, and are ignored (aren't used in the values) if you include them. Don't use single quotation marks around the values.
+
+- **Controlled folder access allowed applications**: To specify apps that are allowed to make changes to files in protected folders, use the same :::image type="icon" source="media/defender-portal-icon-create.png" border="false"::: **Add** or :::image type="icon" source="media/intune-icon-import.png" border="false"::: **Import** methods described for **Controlled folder access protected folders**, specifying the path and file name of each app.
+
+ The CSV file uses the following format:
+
+ ```text
+ ControlledFolderAccessAllowedApplications
+ "C:\Apps\app1.exe"
+ "%ProgramFiles%\Fabrikam\DriveManager\*\DriveService.exe"
+ ...
+ ```
+
+ The path of each app can include environment variables and wildcards, as described in [Allow apps to modify files in protected folders](controlled-folder-access-overview.md#allow-apps-to-modify-files-in-protected-folders).
+
+For more information about attack surface reduction profiles in Microsoft Intune, see [Manage attack surface reduction settings with Microsoft Intune](/intune/intune-service/protect/endpoint-security-asr-policy#attack-surface-reduction-profiles).
+
+## Configure CFA in the Microsoft Defender portal
+
+If your organization [manages endpoint security policies in the Microsoft Defender portal](endpoint-security-policies-configure.md), you can configure CFA with the same endpoint security policies that Intune uses.
+
+For detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).
+
+When you create the policy on the **Endpoint security policies** page in the Defender portal at `file2.log`|`file123.log`|
-### Path type (file / directory)
+
+### Scan exclusion path type (file or directory)
-Indicate if the *path* property refers to a file or directory.
+In an antivirus scan exclusion entry, use *isDirectory* to indicate whether the *path* value refers to a file or a directory.
|Section|Value|
|---|---|
@@ -217,9 +218,10 @@ Indicate if the *path* property refers to a file or directory.
|**Possible values**|false (default) true|
|**Comments**|Applicable only if *$type* is *excludedPath*|
-### File extension excluded from the scan
+
+### Scan exclusion: file extension
-Specify content excluded from being scanned by file extension.
+In an antivirus scan exclusion entry, use *extension* to exclude files by file extension.
|Section|Value|
|---|---|
@@ -229,9 +231,10 @@ Specify content excluded from being scanned by file extension.
|**Possible values**|valid file extensions|
|**Comments**|Applicable only if *$type* is *excludedFileExtension*|
-### Process excluded from the scan
+
+### Scan exclusion: process name or path
-Specify a process for which all file activity is excluded from scanning. The process can be specified either by its name (for example, `cat`) or full path (for example, `/bin/cat`).
+In an antivirus scan exclusion entry, use *name* to exclude a process and all files opened by that process from scanning. The process can be specified either by its name (for example, `cat`) or full path (for example, `/bin/cat`).
|Section|Value|
|---|---|
@@ -272,7 +275,7 @@ Specify how certain threat types are handled by Microsoft Defender for Endpoint
|**Domain**|`com.microsoft.wdav`|
|**Key**|threatTypeSettings|
|**Data type**|Dictionary (nested preference)|
-|**Comments**|See the following sections for a description of the dictionary contents.|
+|**Comments**|Each entry in the array contains a `key` (threat type, such as `potentially_unwanted_application` or `archive_bomb`) and a `value` (action to take: `audit`, `block`, or `off`).|
##### Threat type
@@ -514,7 +517,7 @@ Specify a tag name and its value.
|**Domain**|`com.microsoft.wdav`|
|**Key**|tags|
|**Data type**|Dictionary (nested preference)|
-|**Comments**|See the following sections for a description of the dictionary contents.|
+|**Comments**|Each entry in the array contains a `key` (tag type, such as `GROUP`) and a `value` (the tag string assigned to the device).|
##### Type of tag
@@ -641,9 +644,9 @@ Used in combination with other parameters to identify the process.
## Recommended configuration profile
-To get started, we recommend the following configuration for your enterprise to take advantage of all protection features that Microsoft Defender for Endpoint provides.
+The recommended configuration profile enables all protection features in Microsoft Defender for Endpoint. Both the JAMF property list and the Intune XML profile in the following subsections apply these settings.
-The following configuration profile (or, if there's JAMF, a property list that could be uploaded into the custom settings configuration profile) will:
+This configuration profile (or, for JAMF, a property list uploaded into custom settings) will:
- Enable real-time protection (RTP)
- Specify how the following threat types are handled:
@@ -792,11 +795,11 @@ Use the following XML for the recommended Intune profile:
## Full configuration profile example
-The following templates contain entries for all settings described in this document and can be used for more advanced scenarios where you want more control over Microsoft Defender for Endpoint on macOS.
+The following JAMF and Intune templates include all available Microsoft Defender for Endpoint on macOS settings. Use these templates for advanced scenarios where you need full control over every preference.
### Property list for JAMF full configuration profile
-The following property list shows the full JAMF configuration profile with all available settings:
+The following complete plist shows a Defender for Endpoint configuration profile for JAMF with all available settings, including antivirus engine, cloud service, EDR, tamper protection, and user interface preferences:
```XML
@@ -949,7 +952,7 @@ The following property list shows the full JAMF configuration profile with all a
### Intune full profile
-The following XML shows the full Intune configuration profile with all available settings:
+The following mobile configuration payload wraps all available Defender for Endpoint macOS settings into a deployable Intune profile. It includes antivirus engine, cloud service, EDR, tamper protection, and user interface preferences:
```XML
@@ -1145,12 +1148,14 @@ The following XML shows the full Intune configuration profile with all available
## Property list validation
-The property list must be a valid *.plist* file. This can be checked by executing:
+The property list must be a valid *.plist* file. Validate the plist syntax before uploading or deploying the profile by running the following command:
```bash
plutil -lint com.microsoft.wdav.plist
```
+If the plist is valid, you see output similar to the following:
+
```console
com.microsoft.wdav.plist: OK
```
@@ -1159,16 +1164,21 @@ If the file is well-formed, the above command outputs `OK` and returns an exit c
## Configuration profile deployment
-Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune.
+Once you've built the configuration profile for your enterprise, you can deploy it through your management console. See [JAMF deployment](#jamf-deployment) and [Intune deployment](#intune-deployment) for step-by-step instructions.
### JAMF deployment
+> [!CAUTION]
+> You must use `com.microsoft.wdav` as the preference domain. If the domain is incorrect, Microsoft Defender for Endpoint won't recognize the preferences.
+
From the JAMF console, open **Computers** \> **Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. Create an entry with `com.microsoft.wdav` as the preference domain and upload the *.plist* produced earlier.
+### Intune deployment
+
> [!CAUTION]
-> You must enter the correct preference domain (`com.microsoft.wdav`); otherwise, the preferences won't be recognized by Microsoft Defender for Endpoint.
+> You must use `com.microsoft.wdav` as the custom configuration profile name. If the name is incorrect, Microsoft Defender for Endpoint won't recognize the preferences.
-### Intune deployment
+Use the following steps to deploy the configuration profile with Intune:
1. Open **Devices** \> **Configuration Profiles**. Select **Create Profile**.
@@ -1184,9 +1194,6 @@ From the JAMF console, open **Computers** \> **Configuration Profiles**, navigat
1. Select **Manage** \> **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
-> [!CAUTION]
-> You must enter the correct custom configuration profile name; otherwise, these preferences won't be recognized by Microsoft Defender for Endpoint.
-
## Related content
diff --git a/defender-endpoint/mac-schedule-scan.md b/defender-endpoint/mac-schedule-scan.md
index 30b40646028..2753aeee082 100644
--- a/defender-endpoint/mac-schedule-scan.md
+++ b/defender-endpoint/mac-schedule-scan.md
@@ -6,7 +6,7 @@ author: paulinbar
ms.author: painbar
ms.reviewer: joshbregman
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/02/2026
ms.collection:
- m365-security
- tier3
@@ -16,7 +16,7 @@ ms.subservice: macos
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -64,13 +64,13 @@ Your scheduled scan runs at the date, time, and frequency you defined in your `p
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
-Use the plist schema shown here to configure a daily quick scan and a weekly full scan with the scheduled scan parameters described in the preceding table.
+Use the plist schema shown here to configure a daily quick scan and a weekly full scan with the scheduled scan parameters described in the [scheduled scan parameter table](#schedule-scans-by-deploying-a-plist-in-microsoft-defender-for-endpoint-on-macos) in this article.
-Open a text editor and use the Intune mobileconfig and JamF plist examples in this section as a guide for your own scheduled scan file.
+Open a text editor and use the [Intune mobileconfig](#for-intune) and [JamF plist](#for-jamf-and-other-third-party-mdms) examples that follow as a guide for your own scheduled scan file.
#### For Intune
-Use the following mobileconfig plist sample to deploy this scheduled scan configuration through Intune.
+The following mobileconfig plist sample defines a complete Intune configuration profile that enables scheduled scanning with a daily quick scan and a weekly full scan.
``` XML
@@ -152,7 +152,7 @@ Use the following mobileconfig plist sample to deploy this scheduled scan config
#### For JamF and other third-party MDMs
-Use the following plist sample for JamF and other third-party MDM solutions.
+The following plist sample configures the same daily quick scan and weekly full scan settings for JamF and other third-party MDM solutions. Save this content as `com.microsoft.wdav.plist`.
``` XML
@@ -203,11 +203,11 @@ In the results, you should be able to see [managed].
In this hourly, daily, and weekly scheduled scan example, an hourly quick scan runs every 6 hours, a daily quick scan is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan runs on Wednesdays at 880 minutes after midnight (2:40 p.m.).
-Open a text editor and use the Intune mobileconfig and JamF plist examples in this section as a guide for your own scheduled scan file.
+Open a text editor and use the [Intune mobileconfig](#for-intune-1) and [JamF plist](#for-jamf-and-other-third-party-mdms-1) examples that follow as a guide for your own scheduled scan file.
#### For Intune:
-Use the following mobileconfig plist sample to deploy this scheduled scan configuration through Intune.
+The following mobileconfig plist sample packages the hourly, daily, and weekly Defender scheduled scan settings into a complete Intune configuration profile. Use this sample to deploy the scheduled scan configuration through Intune.
```XML
@@ -291,7 +291,7 @@ Use the following mobileconfig plist sample to deploy this scheduled scan config
#### For JamF and other third-party MDMs
-Use the following plist sample for JamF and other third-party MDM solutions.
+The following plist sample configures the same hourly, daily, and weekly scheduled scan settings for JamF and other third-party MDM solutions. Save this content as `com.microsoft.wdav.plist`.
```XML
@@ -334,7 +334,7 @@ Use the following plist sample for JamF and other third-party MDM solutions.
### Upload the plist file to Jamf Pro
-To upload the scheduled scan plist configuration to Jamf Pro, complete the following steps:
+Use these steps to upload either of the JamF plist examples from [Example 1](#example-1-schedule-a-daily-quick-scan-and-weekly-full-scan-using-a-plist) or [Example 2](#example-2-schedule-an-hourly-quick-scan-a-daily-quick-scan-and-weekly-full-scan-using-a-plist) to Jamf Pro:
1. Go to **Computers > Configuration Profiles.**
@@ -357,7 +357,9 @@ To upload the scheduled scan plist configuration to Jamf Pro, complete the follo
### Configure scheduled scans using the mdatp CLI
-To enable scheduled scan feature:
+The Microsoft Defender for Endpoint command-line tool (`mdatp`) provides commands to configure scheduled scans directly from the terminal.
+
+To enable the scheduled scan feature:
|Version|Command|
|---|---|
@@ -387,7 +389,7 @@ To schedule weekly scans:
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
-For other configuration options:
+You can also configure definition updates and low-priority threading for scheduled scans:
- To check for definitions update before scheduled scans:
@@ -399,9 +401,7 @@ For other configuration options:
### Check that the scheduled scan ran
-Use the following command:
-
-`mdatp scan list`
+To list completed scheduled scans and their results, run `mdatp scan list`:
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic4.png" alt-text="Screenshot of schedule ran.":::`\
-> Starting Monday, October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates and platform updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
+> Starting Monday, October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates and platform updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/servicing/os/windows/2020/09/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates. The following update source locations and sample scenarios describe when to use each source:
@@ -84,7 +87,7 @@ Each source has typical scenarios that depend on how your network is configured,
|Microsoft Update|You want your endpoints to connect directly to Microsoft Update. This option is useful for endpoints that irregularly connect to your enterprise network, or if you don't use Windows Server Update Service to manage your updates.|
|UNC Share|You have devices that aren't connected to the Internet (such as virtual machines, or VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-microsoft-defender-antivirus.md) for how file shares are used in virtual desktop infrastructure (VDI) environments. Platform updates can also be deployed using this method. |
|Microsoft Configuration Manager|You're using Microsoft Configuration Manager to update your endpoints.|
-|Security intelligence updates and platform updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|[Make sure devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence and platform updates are delivered through Windows Update. As of October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively.
- If file is likely to contain PII, the user gets a request to allow file sample submission.
- This option is the default configuration on Windows, macOS, and Linux. |
| **Always Prompt** | - If configured, the user is always prompted for consent before file submission
- This setting isn't available in macOS and Linux cloud protection |
| **Send all samples automatically** | - If configured, all samples are sent automatically
- If you would like sample submission to include macros embedded in Word docs, you must choose **Send all samples automatically**
- "Send all samples automatically" is the equivalent to the "Enable" setting in macOS policy |
| **Do not send** | - Prevents "block at first sight" based on file sample analysis
- "Don't send" is the equivalent to the "Disabled" setting in macOS policy and "None" setting in Linux policy.
- Metadata is sent for detections even when sample submission is disabled |
-
+
1. After files are submitted to cloud protection, the submitted files can be **scanned**, **detonated**, and processed through **big data analysis** **machine-learning** models to reach a verdict. Turning off cloud-delivered protection limits analysis to only what the client can provide through local machine-learning models, and similar functions.
-
+
> [!IMPORTANT]
-> [Block at first sight (BAFS)](configure-block-at-first-sight-microsoft-defender-antivirus.md) provides detonation and analysis to determine whether a file or process is safe. BAFS can delay the opening of a file momentarily until a verdict is reached. If you disable sample submission, BAFS is also disabled, and file analysis is limited to metadata only. We recommend keeping sample submission and BAFS enabled. To learn more, see [What is "block at first sight"?](configure-block-at-first-sight-microsoft-defender-antivirus.md#what-is-block-at-first-sight)
+> [Block at first sight (BAFS)](configure-block-at-first-sight-microsoft-defender-antivirus.md) provides detonation and analysis to determine whether a file or process is safe. BAFS can delay the opening of a file momentarily until a verdict is reached. If you disable sample submission, BAFS is also disabled, and file analysis is limited to metadata only. We recommend keeping sample submission and BAFS enabled. To learn more, see [What is "block at first sight"?](configure-block-at-first-sight-microsoft-defender-antivirus.md)
## Cloud protection levels
@@ -83,8 +83,8 @@ Cloud protection is enabled by default at Microsoft Defender Antivirus. We recom
In addition to configuring your cloud protection level, you can configure your sample submission settings. You can choose from several options:
- **Send safe samples automatically** (the default behavior)
-- **Send all samples automatically**
-- **Do not send samples**
+- **Send all samples automatically**
+- **Do not send samples**
> [!TIP]
> Using the `Send all samples automatically` option provides for better security, because phishing attacks are used for a high amount of [initial access attacks](https://attack.mitre.org/tactics/TA0001/).
@@ -104,7 +104,7 @@ The following table lists examples of metadata sent for analysis by cloud protec
## Samples are treated as customer data
-If you're wondering what happens with sample submissions, Defender for Endpoint treats all file samples as customer data. Microsoft honors both the geographical and data retention choices your organization selected when onboarding to Defender for Endpoint.
+If you're wondering what happens with sample submissions, Defender for Endpoint treats all file samples as customer data. Microsoft honors both the geographical and data retention choices your organization selected when onboarding to Defender for Endpoint.
In addition, Defender for Endpoint received multiple compliance certifications, demonstrating continued adherence to a sophisticated set of compliance controls:
@@ -115,7 +115,7 @@ In addition, Defender for Endpoint received multiple compliance certifications,
For more information, see the following resources:
-- [Azure Compliance Offerings](/azure/storage/common/storage-compliance-offerings)
+- [Azure Compliance Offerings](/azure/storage/common/storage-compliance-offerings)
- [Service Trust Portal](https://servicetrust.microsoft.com)
- [Microsoft Defender for Endpoint data storage and privacy](data-storage-privacy.md)
@@ -124,11 +124,10 @@ For more information, see the following resources:
There are two more scenarios where Defender for Endpoint might request a file sample that isn't related to the cloud protection at Microsoft Defender Antivirus. These scenarios are described in the following table:
| Scenario | Description |
-|:---|:---|
+|---|---|
|Manual file sample collection in the Microsoft Defender portal | When onboarding devices to Defender for Endpoint, you can configure settings for [endpoint detection and response (EDR)](overview-endpoint-detection-response.md). For example, there's a setting to enable sample collections from the device, which can easily be confused with the sample submission settings described in this article.
The EDR setting controls file sample collection from devices when requested through the Microsoft Defender portal, and is subject to the roles and permissions already established. This setting can allow or block file collection from the endpoint for features such as deep analysis in the Microsoft Defender portal. If this setting isn't configured, the default is to enable sample collection.
Learn about Defender for Endpoint configuration settings, see [Onboard Windows and Mac client devices to Microsoft Defender for Endpoint](onboard-client.md) |
| Automated investigation and response content analysis | When [automated investigations](automated-investigations.md) are running on devices (when configured to run automatically in response to an alert or manually run), files that are identified as suspicious can be collected from the endpoints for further inspection. If necessary, the file content analysis feature for automated investigations can be disabled in the Microsoft Defender portal.
The file extension names can also be modified to add or remove extensions for other file types that are automatically submitted during an automated investigation.
To learn more, see [Manage automation file uploads](manage-automation-file-uploads.md). |
-
## See also
- [Next-generation protection overview](next-generation-protection.md)
@@ -136,6 +135,3 @@ There are two more scenarios where Defender for Endpoint might request a file sa
- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md)
- [Microsoft Defender for Endpoint - Mobile Threat Defense](mtd.md)
- [Configure remediation for Microsoft Defender Antivirus detections](configure-remediation-microsoft-defender-antivirus.md)
-
-
-
diff --git a/defender-endpoint/collect-diagnostic-data.md b/defender-endpoint/collect-diagnostic-data.md
index 6ab6494e18e..07ec4a5b6f6 100644
--- a/defender-endpoint/collect-diagnostic-data.md
+++ b/defender-endpoint/collect-diagnostic-data.md
@@ -5,8 +5,8 @@ ms.service: defender-endpoint
ms.localizationpriority: medium
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: pahuijbr, yongrhee
ms.subservice: ngp
ms.topic: how-to
@@ -27,12 +27,14 @@ ai-usage: ai-assisted
This article describes how to collect diagnostic data to send to Microsoft support and engineering teams when they help troubleshoot issues with Microsoft Defender Antivirus.
> [!NOTE]
-> As part of the investigation or response process, you can collect an investigation package from a device. Here's how: [Collect investigation package from devices](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices).
+> As part of the investigation or response process, you can collect an investigation package from a device. Here's how: [Collect investigation package from devices](respond-machine-alerts.md#collect-investigation-package-from-devices).
>
> For performance-specific issues related to Microsoft Defender Antivirus, see: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).
+## Collect diagnostic data using MpCmdRun
+
On at least two devices that are experiencing the same issue, use the following procedures to generate the diagnostic log files:
1. In an elevated Command Prompt (a Command Prompt window you opened by selecting **Run as administrator**), do one of the following steps:
@@ -68,7 +70,7 @@ On at least two devices that are experiencing the same issue, use the following
- `
**Note**: NT AUTHORITY\LocalService must have write access to the specified path (for example, `C:\Windows\Temp\MpCmdRun`).|
-|`-CheckExclusion -Path
(if not configured)|PowerShell `Set-MpPreference` parameter
or WMI property for `MSFT_MpPreference` class|
|---|---|---|
-|Email scanning
**Scan** > **Turn on e-mail scanning**
See [Email scanning limitations](#email-scanning-limitations) (in this article)|Disabled|`-DisableEmailScanning`|
+|Email scanning
**Scan** \> **Turn on e-mail scanning**
See [Email scanning limitations](#email-scanning-limitations) (in this article)|Disabled|`-DisableEmailScanning`|
| Script scanning | Enabled | This policy setting allows you to configure script scanning. If you enable or don't configure this setting, script scanning is enabled.
See [Defender/AllowScriptScanning](/windows/client-management/mdm/policy-csp-defender) |
-|Scan [reparse points](/windows/win32/fileio/reparse-points)
**Scan** > **Turn on reparse point scanning**|Disabled|Not available
See [Reparse points](/windows/win32/fileio/reparse-points)|
-|Scan mapped network drives
**Scan** > **Run full scan on mapped network drives**|Disabled|`-DisableScanningMappedNetworkDrivesForFullScan`|
-|Scan archive files (such as .zip or .rar files).
**Scan** > **Scan archive files**|Enabled|`-DisableArchiveScanning`
The [extensions exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md) takes precedence over this setting.|
-|Scan files on the network
**Scan** > **Scan network files**|Disabled|`-DisableScanningNetworkFiles`|
-|Scan packed executables
**Scan** > **Scan packed executables**|Enabled|Not available
Scan packed executables were removed from the following templates:
- Administrative Templates (.admx) for Windows 11 2023 Update (23H2)
- Administrative Templates (.admx) for Windows 11 2022 Update (22H2) - v3.0
- Administrative Templates (.admx) for Windows 11 2022 Update (22H2)
- Administrative Templates (.admx) for Windows 11 October 2021 Update (21H2)|
-|Scan removable drives during full scans only
**Scan** > **Scan removable drives**|Disabled|`-DisableRemovableDriveScanning`|
-|Specify the level of subfolders within an archive folder to scan
The maximum CPU load isn't a hard limit, but is guidance for the scanning engine to not exceed the maximum on average. Manual scans ignore this setting and run without any CPU limits.|
-|Specify the maximum size (in kilobytes) of archive files that should be scanned.
**Scan** > **Specify the maximum size of archive files to be scanned**|No limit|Not available
The default value of 0 applies no limit|
-|Configure low CPU priority for scheduled scans
**Scan** > **Configure low CPU priority for scheduled scans**|Disabled|Not available|
-|Configure scanning of network files
**Scan** > **Configure scanning of network files**|Disabled|-DisableScanningNetworkFiles|
-|CPU throttling type
**Scan** > **CPU throttling type**|Disabled|-ThrottleForScheduledScanOnly |
-|Scan excluded files and directories during quick scan
**Scan** > **Scan excluded files and directories during quick scan**|Disabled|Not available|
+|Scan [reparse points](/windows/win32/fileio/reparse-points)
**Scan** \> **Turn on reparse point scanning**|Disabled|Not available
See [Reparse points](/windows/win32/fileio/reparse-points)|
+|Scan mapped network drives
**Scan** \> **Run full scan on mapped network drives**|Disabled|`-DisableScanningMappedNetworkDrivesForFullScan`|
+|Scan archive files (such as .zip or .rar files).
**Scan** \> **Scan archive files**|Enabled|`-DisableArchiveScanning`
The [extensions exclusion list](microsoft-defender-antivirus-exclusions-overview.md) takes precedence over this setting.|
+|Scan files on the network
**Scan** \> **Scan network files**|Disabled|`-DisableScanningNetworkFiles`|
+|Scan packed executables
**Scan** \> **Scan packed executables**|Enabled|Not available
Scan packed executables were removed from the following templates:
- Administrative Templates (.admx) for Windows 11 2023 Update (23H2)
- Administrative Templates (.admx) for Windows 11 2022 Update (22H2) - v3.0
- Administrative Templates (.admx) for Windows 11 2022 Update (22H2)
- Administrative Templates (.admx) for Windows 11 October 2021 Update (21H2)|
+|Scan removable drives during full scans only
**Scan** \> **Scan removable drives**|Disabled|`-DisableRemovableDriveScanning`|
+|Specify the level of subfolders within an archive folder to scan
The maximum CPU load isn't a hard limit, but is guidance for the scanning engine to not exceed the maximum on average. Manual scans ignore this setting and run without any CPU limits.|
+|Specify the maximum size (in kilobytes) of archive files that should be scanned.
**Scan** \> **Specify the maximum size of archive files to be scanned**|No limit|Not available
The default value of 0 applies no limit|
+|Configure low CPU priority for scheduled scans
**Scan** \> **Configure low CPU priority for scheduled scans**|Disabled|Not available|
+|Configure scanning of network files
**Scan** \> **Configure scanning of network files**|Disabled|-DisableScanningNetworkFiles|
+|CPU throttling type
**Scan** \> **CPU throttling type**|Disabled|-ThrottleForScheduledScanOnly |
+|Scan excluded files and directories during quick scan
**Scan** \> **Scan excluded files and directories during quick scan**|Disabled|Not available|
> [!NOTE]
> If real-time protection is turned on, files are scanned before they're accessed and executed. The scanning scope includes all files, such as files on mounted removable media, like USB drives. If the device performing the scan has real-time protection or on-access protection turned on, the scan also includes network shares.
@@ -115,5 +136,3 @@ If Microsoft Defender Antivirus detects a threat inside an email message, the fo
## Scanning mapped network drives
On all supported operating systems, only the network drives that are mapped at system level are scanned. User-level mapped network drives aren't scanned. User-level mapped network drives are those that a user maps in their session manually and using their own credentials.
-
-
diff --git a/defender-endpoint/configure-ai-agent-runtime-protection.md b/defender-endpoint/configure-ai-agent-runtime-protection.md
index e076c6b72a1..10a2c908483 100644
--- a/defender-endpoint/configure-ai-agent-runtime-protection.md
+++ b/defender-endpoint/configure-ai-agent-runtime-protection.md
@@ -1,20 +1,23 @@
---
-title: Set up AI agent runtime protection with Microsoft Defender for Endpoint
-description: Learn how to configure Microsoft Defender to protect local AI agents from prompt injection attacks on Windows endpoints.
+title: Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview)
+description: Learn how to configure Microsoft Defender for Endpoint AI agent runtime protection to detect, audit, and block prompt injection on Windows devices.
author: lwainstein
ms.author: lwainstein
ms.service: defender-endpoint
ms.topic: how-to
-ms.date: 05/27/2026
+ms.date: 08/13/2026
ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1015
#customer intent: As a security administrator, I want to configure runtime protection for local AI agents on my organization's endpoints so that I can detect and block prompt injection attacks in real time.
---
-# Set up AI agent runtime protection with Microsoft Defender for Endpoint
+# Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview)
+
+[!INCLUDE [Prerelease information](../includes/prerelease.md)]
Local AI agents run with the user's privileges on the endpoints they operate on, where they can read files, invoke tools, and run commands. Malicious instructions hidden in the content an agent reads can hijack the agent through prompt injection. AI agent runtime protection helps you detect prompt injection at the device level and block or audit the agent's action before it acts on those instructions.
-This article explains how to enable runtime protection, deploy it across your organization, and investigate detections.
+This article explains how to enable runtime protection in Microsoft Defender for Endpoint, deploy it throughout your organization, and investigate detections.
For an overview of how runtime protection works, see [AI agent runtime protection with Microsoft Defender for Endpoint](ai-agent-runtime-protection-overview.md).
@@ -23,107 +26,123 @@ For an overview of how runtime protection works, see [AI agent runtime protectio
Before you configure runtime protection, review the following requirements:
- Your organization has a Microsoft Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7 license.
-- Your devices are onboarded to [Microsoft Defender for Endpoint](/defender-endpoint/onboard-configure).
-- Your devices are running a supported version of Windows, and Microsoft Defender Antivirus is updated with current monthly platform and engine updates.
-
- > [!NOTE]
- > Runtime protection is currently available only on devices configured to receive `Beta` platform and engine updates.
-- Your devices are running Microsoft Defender Antivirus in active mode.
-- Your devices have one or more [supported local AI agents](ai-agent-runtime-protection-overview.md#supported-agents) installed.
-- The local AI agent you want to protect natively supports a hooks framework. See [Supported agents](ai-agent-runtime-protection-overview.md#supported-agents) for the full list.
+- Your devices are [onboarded to Defender for Endpoint](onboard-configure.md), and Microsoft Defender Antivirus is running in active mode with real-time protection enabled.
+- Your devices are running a supported version of Windows, and Microsoft Defender Antivirus has the latest platform, engine, and security intelligence updates.
+- Your devices have one or more [supported local AI agents](ai-agent-runtime-protection-overview.md#supported-agents) installed for the runtime protection approach you plan to enable.
+- To deploy the settings with Microsoft Intune, your account has an Intune role with permission to create, update, and assign device configurations, such as [Policy and Profile Manager](/intune/fundamentals/role-based-access-control/ref-built-in-roles#policy-and-profile-manager).
+- To review alerts, your account has a supported Microsoft Entra role, such as Security Reader, Security Operator, or Security Administrator, or a Microsoft Defender custom role with permission to read security data. For more information, see [Required permissions to investigate alerts](/defender-xdr/investigate-alerts#required-permissions-to-investigate-alerts).
## Recommended deployment approach
Microsoft recommends the following phased rollout:
1. **Test**: [Enable runtime protection](#enable-runtime-protection) in audit mode on a small set of devices where supported agents are actively used.
-1. **Review**: Monitor alerts in the Microsoft Defender portal for 1-2 weeks. If there are false positives, [submit them to Microsoft for analysis](defender-endpoint-false-positives-negatives.md#part-4-submit-a-file-for-analysis).
-1. **Deploy**: [Roll out across your organization](#deploy-settings-across-your-organization-with-intune) in audit mode to additional device groups.
+1. **Review**: Monitor alerts in the Microsoft Defender portal for one to two weeks. [Classify inaccurate alerts as false positives](/defender-xdr/investigate-alerts#manage-alert-status-and-classification). If a detection involves a file incorrectly identified as malicious, [submit the file to Microsoft for analysis](defender-endpoint-false-positives-negatives.md#part-4-submit-a-file-for-analysis).
+1. **Deploy**: [Deploy throughout your organization](#deploy-settings-across-your-organization-with-intune) in audit mode to more device groups.
1. **Enforce**: After validating that alerts are accurate and actionable, switch to block mode on device groups where you want active enforcement.
## Enable runtime protection
-To enable runtime protection on a single device for testing or validation:
-
-1. Open an elevated PowerShell session.
-1. Configure the device to receive preview updates.
-
- ```powershell
- Set-MpPreference -PlatformUpdatesChannel Beta
- Set-MpPreference -EngineUpdatesChannel Beta
-
- Update-MpSignature
- Update-MpSignature
- Update-MpSignature
- ```
-
-1. Run `Update-MpSignature` three times. This step is required for preview validation.
-1. Verify that `AntivirusSignatureVersion` is `1.451.224.0` or later.
-
+To enable runtime protection on a single device:
+
+1. Open an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**).
+
+1. Verify that `AntivirusSignatureVersion` is `1.451.224.0` or later:
+
```powershell
Get-MpComputerStatus | Select-Object AntivirusSignatureVersion
```
-1. Enable runtime protection.
-
- ```powershell
- Set-MpPreference -AiAgentProtection
A full scan with Defender for Endpoint on Linux can take several hours or even days to complete. The duration depends on the volume and type of data being scanned and the availability of CPU resources. |
|**Custom scan**| A custom scan runs on files and folders specified with the `--path` parameter.
By default, custom scans in Defender for Endpoint on Linux ignore files and folders specified in the antivirus exclusions. However, you can override this behavior by using the `--ignore-exclusions` flag, to ensure the excluded files and folders are scanned during a custom scan. |
@@ -71,6 +71,8 @@ The following articles describe how to schedule antivirus scans using crontab or
## Run on-demand scans via the Defender portal
+Before you begin, ensure you have at least **Alerts (manage)** permission in the Defender portal.
+
To trigger an antivirus scan on a device from the Defender portal:
1. Go to the Microsoft Defender portal (https://security.microsoft.com) and sign-in.
@@ -87,21 +89,21 @@ To trigger an antivirus scan on a device from the Defender portal:
## Performance optimizations
-Running antivirus scans on your device is crucial for maintaining security, but it's important to balance this with the impact on device performance. Naturally, running a full scan on a device with extensive and complex content results in higher system resource usage and longer completion times.
+Antivirus scans are crucial for security, but they can affect device performance. A full scan on a device with large or complex content uses more system resources and takes longer to finish.
-Various antivirus settings and configurations can influence both performance and protection levels. To enhance the performance of Microsoft Defender for Endpoint on Linux during antivirus scans, consider adjusting the following settings and switches:
+You can adjust settings to balance performance and protection. To improve scan performance in Microsoft Defender for Endpoint on Linux, consider changing the following settings:
|Flag|Description|
|--|--|
-|**Scan after definitions update**|This setting determines whether to start a process scan after new security intelligence updates are downloaded on the device. When enabled, it initiates an antivirus scan on the device's active processes.|
-|**Scan archives (on-demand antivirus scans only)**|This setting specifies whether to scan archives (such as *.zip*, *.rar*, *.7z*, etc.) during on-demand antivirus scans. |
-|**Maximum on-demand scan threads**|This setting controls how many threads are used for on-demand scans, impacting both CPU usage and the scan's duration.|
+|**Scan after definitions update**|Controls whether a process scan runs after new security updates download to the device. When enabled, it scans active processes.|
+|**Scan archives (on-demand antivirus scans only)**|Controls whether to scan archive files (such as *.zip*, *.rar*, *.7z*) during on-demand scans. |
+|**Maximum on-demand scan threads**|Sets how many threads run on-demand scans. More threads use more CPU but finish faster.|
For detailed instructions on configuring scan-after-definition-update, archive scanning, and maximum on-demand scan threads using CLI or managed JSON, see [Configure security settings in Microsoft Defender for Endpoint on Linux](./linux-preferences.md#antivirus-engine-preferences).
## Best practices
-Starting from version 101.23062.0001, Defender for Endpoint on Linux operates in passive mode by default, meaning real-time protection (RTP) is turned off. In this mode, it's recommended to use scheduled scans as needed to ensure the system is periodically protected.
+Starting from version 101.23062.0001, Defender for Endpoint on Linux operates in passive mode by default, meaning real-time protection (RTP) is turned off. In passive mode, it's recommended to use scheduled scans as needed to ensure the system is periodically protected.
After installing Defender for Endpoint on Linux, it's a good practice to run a full scan (or a quick scan) to help identify and remediate any existing threats on the system.
diff --git a/defender-endpoint/configure-automated-investigations-remediation.md b/defender-endpoint/configure-automated-investigations-remediation.md
index dd47ea52dbc..b0971da2658 100644
--- a/defender-endpoint/configure-automated-investigations-remediation.md
+++ b/defender-endpoint/configure-automated-investigations-remediation.md
@@ -12,25 +12,30 @@ ms.collection:
- mde-edr
ms.topic: how-to
ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
+
# Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint
-If your organization is using [Defender for Endpoint](/windows/security/threat-protection/) (or [Defender for Business](/defender-business/mdb-overview)), [automated investigation and remediation capabilities](automated-investigations.md) can save your security operations team time and effort. As outlined in [Enhance your SOC with Microsoft Defender for Endpoint automatic investigation and remediation](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Automated investigation and remediation](automated-investigations.md).
+If your organization is using [Defender for Endpoint](microsoft-defender-endpoint.md) (or [Defender for Business](/defender-business/mdb-overview)), [automated investigation and remediation capabilities](automated-investigations.md) can save your security operations team time and effort. As outlined in [Enhance your SOC with Microsoft Defender for Endpoint automatic investigation and remediation](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. For more information, see [Automated investigation and remediation](automated-investigations.md).
+
+[!INCLUDE [AIR deprecation note](includes/air-deprecation-note.md)]
-If you're using Defender for Endpoint, you can specify an automation level so that when a threat is detected on a device, the entity can be remediated automatically or only upon approval by your security team. You can configure automated investigation and remediation with device groups.
+If you're using Defender for Endpoint, you can specify an automation level so that when a threat is detected on a device, the detected threat can be remediated automatically or only upon approval by your security team. You can configure automated investigation and remediation with device groups.
> [!NOTE]
> In Defender for Business, automated investigation is configured automatically. See [Review settings for advanced features in Defender for Business](/defender-business/mdb-configure-security-settings#review-settings-for-advanced-features).
## Set up device groups
+To create device groups and configure automation levels in the Microsoft Defender portal, follow these steps:
+
1. In the [Microsoft Defender portal](https://security.microsoft.com), on the **Settings** page, under **Permissions**, select **Device groups**.
1. Select **+ Add device group**.
@@ -56,4 +61,3 @@ If you're using Defender for Endpoint, you can specify an automation level so th
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
- [Automation levels in automated investigation and remediation](automation-levels.md)
-
diff --git a/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md b/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md
index 86a12f0fd5f..6d6b2216510 100644
--- a/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md
+++ b/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus.md
@@ -1,36 +1,60 @@
---
-title: Enable block at first sight to detect malware in seconds
-description: Turn on the block at first sight feature to detect and block malware within seconds.
+title: Configure block at first sight in Microsoft Defender Antivirus
+description: Configure block at first sight in Microsoft Defender Antivirus by using supported management tools, including Microsoft Configuration Manager.
ms.service: defender-endpoint
ms.localizationpriority: high
author: chrisda
ms.author: chrisda
ms.reviewer: marcmcc
ms.custom:
- - msecd-doc-authoring-1014
+ - msecd-doc-authoring-1015
- nextgen
- sfi-image-nochange
-ms.date: 06/16/2026
+ms.date: 08/31/2026
ms.subservice: ngp
ms.topic: how-to
-ms.collection:
+ms.collection:
- m365-security
- tier2
- mde-ngp
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-
ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to configure block at first sight so that Microsoft Defender Antivirus can block new malware within seconds.
---
-# Turn on block at first sight
+# Configure block at first sight in Microsoft Defender Antivirus
+
+
+
+Block at first sight is a threat protection feature of [next-generation protection](next-generation-protection.md). It detects new malware and blocks it within seconds. The feature is enabled when all of the following statements are true:
+
+- [Cloud protection](cloud-protection-microsoft-defender-antivirus.md) (also called _cloud-delivered protection_ in Windows Security) is turned on.
+- [Sample submission](cloud-protection-microsoft-antivirus-sample-submission.md) is set to send samples automatically.
+- Microsoft Defender Antivirus [is up to date](microsoft-defender-antivirus-updates.md) on devices.
+
+In most enterprise organizations, these settings are already configured with Microsoft Defender Antivirus deployments. For more information, see [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md).
-This article describes an antivirus/antimalware feature known as "block at first sight", and describes how to enable block at first sight for your organization. Before you begin, review the [Prerequisites](#prerequisites) section for required settings and supported operating systems.
+When Microsoft Defender Antivirus finds a suspicious file it hasn't seen before, it sends a query to the cloud protection backend. The cloud backend checks the file using heuristics, machine learning, and automated analysis. It then decides if the file is malicious or safe. Microsoft Defender Antivirus uses multiple detection and prevention methods to deliver accurate, real-time protection.
+
+:::image type="content" source="media/microsoft-defender-atp-next-generation-protection-engines.png" alt-text="Diagram of Microsoft Defender Antivirus protection engines." lightbox="media/microsoft-defender-atp-next-generation-protection-engines.png":::
+
+Keep the following details in mind when using block at first sight:
+
+- Block at first sight can block executable files and nonportable executable files (such as JS, VBS, or macros) on Windows or Windows Server devices that run the [latest Defender antimalware platform](microsoft-defender-antivirus-updates.md).
+- Block at first sight only uses the cloud protection backend for executable files and nonportable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the `.exe` file is checked via the cloud backend to determine if the file is a previously undetected file.
+- If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs more analysis to reach a determination. The cloud then either allows the file to run or blocks the file in all future encounters, depending on whether the cloud determines the file to be malicious or not a threat.
+- In many cases, this cloud-based analysis and blocking process can reduce the response time for new malware from hours to seconds.
+- You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. You can also [customize the message displayed on users' desktops](/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL.
> [!TIP]
-> This article is intended for enterprise admins and IT Pros who manage security settings for organizations. If you aren't an enterprise admin or IT Pro but you have questions about block at first sight, see the [Not an enterprise admin or IT Pro?](#not-an-enterprise-admin-or-it-pro) section.
+> To learn more, see [(Blog) Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
+>
+> This article is intended for enterprise administrators and IT professionals who manage security settings for organizations. If you don't manage security settings for an organization, see [Configure block at first sight in the Windows Security app](#configure-block-at-first-sight-in-the-windows-security-app).
+> [!CAUTION]
+> Turning off block at first sight lowers the protection state of your devices and your network. We don't recommend disabling block at first sight permanently.
## Prerequisites
@@ -40,160 +64,180 @@ Block at first sight is supported on the following operating systems:
- Windows
+## Configure block at first sight using Microsoft Intune
-## What is "block at first sight"?
-
-Block at first sight is a threat protection feature of next-generation protection that detects new malware and blocks it within seconds. Block at first sight is enabled when certain security settings are enabled:
+[!INCLUDE [intune-recommended-separate-product](includes/intune-recommended-separate-product.md)]
-- [Cloud protection](cloud-protection-microsoft-defender-antivirus.md) (also called *cloud-delivered protection* in Windows Security) is turned on;
-- [Sample submission](cloud-protection-microsoft-antivirus-sample-submission.md) is configured for samples to be sent automatically; and
-- [Microsoft Defender Antivirus is up to date](microsoft-defender-antivirus-updates.md) on devices.
+To configure block at first sight in Microsoft Intune, use an endpoint security **Antivirus** policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).
-In most enterprise organizations, the settings needed to enable block at first sight are configured with Microsoft Defender Antivirus deployments. See [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md).
+When you create the policy, use these specific settings:
-## How it works
+- **Policy type**: Select **Manage** \> **Antivirus** on the **Endpoint security \| Overview** page.
+- **Platform**: Select **Windows**.
+- **Profile**: Select **Microsoft Defender Antivirus**.
-When Microsoft Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or not a threat.
-
-Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, intelligent, and real-time protection.
-
-:::image type="content" source="media/microsoft-defender-atp-next-generation-protection-engines.png" alt-text="The list of Microsoft Defender Antivirus engines" lightbox="media/microsoft-defender-atp-next-generation-protection-engines.png":::
-
-> [!TIP]
-> To learn more, see [(Blog) Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/).
+### Turn on block at first sight with Microsoft Intune
-## A few things to know about block at first sight
+When you create or modify the policy, use these specific settings on the **Configuration settings** tab:
-Keep the following details in mind when using block at first sight:
+- **Allow cloud protection**: Select **Allowed. Turns on Cloud Protection (Default)**.
+- **Submit samples consent**: Select one of the following values:
+ - **Send safe samples automatically. (Default)**
+ - **Send all samples automatically**
-- Block at first sight can block nonportable executable files (such as JS, VBS, or macros) and executable files, running the [latest Defender antimalware platform](microsoft-defender-antivirus-updates.md) on Windows or Windows Server.
+For more information about the available settings, see [Antivirus policy for endpoint security in Intune](/intune/device-configuration/endpoint-security/antivirus).
-- Block at first sight only uses the cloud protection backend for executable files and nonportable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the `.exe` file is checked via the cloud backend to determine if the file is a previously undetected file.
+### Turn off block at first sight with Microsoft Intune
-- If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs more analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or not a threat.
+To turn off block at first sight, set **Allow cloud protection** to **Not allowed. Turns off Cloud Protection**.
-- In many cases, this cloud-based analysis and blocking process can reduce the response time for new malware from hours to seconds.
+## Configure block at first sight in the Microsoft Defender portal
-- You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL.
+If your organization [manages endpoint security policies in the Microsoft Defender portal](endpoint-security-policies-configure.md), use a Microsoft Defender Antivirus policy to configure block at first sight.
-## Turn on block at first sight with Microsoft Intune
+For detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).
-Use the following steps to enable block at first sight with Microsoft Intune:
+When you create the policy on the **Endpoint security policies** page in the Defender portal at
`folder` |
-| Scan type | `ScanType` | `quick`
`full` |
-| Scan trigger | `ScanTrigger` | `OnDemand`
`OnAccess`
`BM` (Behavior monitoring)|
-| Process | `Process` | `
+> The EDR Cyber data service (OneDsCollector) *must* be configured separately if you are using the IP method (the EDR Cyber data service is only consolidated at the URL level).You must also maintain connectivity with other required services including SmartScreen, CRL, Windows Update, and other services.
In order to stay up to date on IP ranges, it's recommended to refer to the following Azure service tags for Microsoft Defender for Endpoint services. The latest IP ranges are found in the service tag. For more information, see [Azure IP ranges](https://azureipranges.azurewebsites.net/).
@@ -144,7 +144,7 @@ In order to stay up to date on IP ranges, it's recommended to refer to the follo
| `MicrosoftDefenderForEndpoint` | Cloud-delivered protection, malware sample submission storage, Auto-IR sample storage, Defender for Endpoint command and control. |
| `OneDsCollector` | Defender for Endpoint cyber and diagnostic data
Note: The traffic under this service tag isn't limited to Defender for Endpoint and can include diagnostic data traffic for other Microsoft services. |
-For latest service tags list, refer to the [Azure service tags](/azure/virtual-network/service-tags-overview) documentation.
+For the latest list of Azure service tags, including the Defender for Endpoint-related tags listed in the preceding table, refer to the [Azure service tags](/azure/virtual-network/service-tags-overview) documentation.
> [!IMPORTANT]
> In compliance with Defender for Endpoint security and compliance standards, your data will be processed and stored in accordance with your tenant's physical location. Based on client location, traffic may flow through any of these IP regions (which correspond to Azure datacenter regions). For more information, see [Data storage and privacy](data-storage-privacy.md).
@@ -165,7 +165,7 @@ To test streamlined connectivity for devices not yet onboarded to Defender for E
- Run `mdeclientanalyzer.cmd -g
2. Under **Policies** select **Create** \> **New Policy**.
3. In the **Create a profile** slide out, select **Windows 10 and later** as **Platform** and **Templates** as **Profile Type**.
4. Under **Template Name**, select the **Custom** template and select **Create**.
5. Enter a value for **Name** and select **Next**.
6. Under **Configuration settings**, select **Add** and use the following OMA-URI settings:
- Name: Provide a name
- OMA-URI: `./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding`
- Date type: String
- Value: Copy and paste the value from the content of the `WindowsDefenderATP_valid_until_YYYY-MM-DD` offboarding file.
7. Make the appropriate group assignments, applicability rules, and on the **Review + create** step, select **Create**. |
- | EDR policy | 1. In the navigation pane, select **Endpoint security** \> **Manage** \> **Endpoint detection and response**.
2. Under **Endpoint detection and response (EDR) policies**, select **Create policy**.
3. In the **Create a profile** slide out, select **Windows** as **Platform** and **Endpoint detection and response** and select **Create**.
5. Enter a value for **Name** and select **Next**.
6. Under **Configuration settings**, select **Offboard** for the setting **Microsoft Defender for Endpoint client configuration package type**.
7. Copy the value from the content of the `WindowsDefenderATP_valid_until_YYYY-MM-DD` offboarding file and paste it in the **Offboarding (Device)** setting. Then select **Next**.
8. Specify any scope tags if needed, make the appropriate group assignments and on the **Review + create** step, select **Create**. |
+ - **EDR policy**: To create an **Endpoint detection and response** policy, see Deploy endpoint detection and response policy with Intune (opens in a new tab in the Intune documentation). When creating the policy, use these specific settings:
+ - **Platform**: Select **Windows**.
+ - **Profile**: Select **Endpoint detection and response**.
+ - **Configuration settings** tab:
+ - **Microsoft Defender for Endpoint client configuration package type**: Select **Offboard**.
+ - In the **Offboarding (Device)** setting that appears, paste the value from the content of the `WindowsDefenderATP_valid_until_YYYY-MM-DD` offboarding file.
- For more information on Microsoft Intune policy settings, see [Windows 10 policy settings in Microsoft Intune](/intune/intune-service/configuration/custom-settings-windows-10).
-
-> [!NOTE]
+> [!IMPORTANT]
> The **Health Status for offboarded devices** policy uses read-only properties and can't be remediated.
+>
+> Offboarding stops the device from sending new detection, vulnerability, and security data to Defender for Endpoint. Historical data remains in the Defender portal until the configured retention period expires. The device profile, without data, remains in the device inventory for up to 180 days. For more information, see [Offboard devices](offboard-machines.md).
-> [!IMPORTANT]
-> Offboarding causes the device to stop sending sensor data to Defender for Endpoint, but data from the device, including references to any alerts it has, is retained for up to 6 months.
+
-## Related articles
+## Related content
- [Onboard Windows devices using Group Policy](configure-endpoints-gp.md)
- [Onboard Windows devices using Microsoft Configuration Manager](configure-endpoints-sccm.md)
diff --git a/defender-endpoint/configure-endpoints-sccm.md b/defender-endpoint/configure-endpoints-sccm.md
index 865a64ee2d4..86fc87a8019 100644
--- a/defender-endpoint/configure-endpoints-sccm.md
+++ b/defender-endpoint/configure-endpoints-sccm.md
@@ -203,13 +203,13 @@ After you install the Endpoint Protection client on your reference computer, ver
## Configure network protection
-Prior to enabling network protection in audit or block mode, ensure that you've installed the antimalware platform update, which can be obtained from the [support page](https://support.microsoft.com/help/4560203/windows-defender-anti-malware-platform-binaries-are-missing).
+Prior to enabling network protection in audit or block mode, ensure that you've installed the antimalware platform update, which can be obtained from the [support page](/troubleshoot/windows-client/networking/network-connectivity-lost).
## Configure controlled folder access
Enable the feature in audit mode for at least 30 days. After this period, review detections and create a list of applications that are allowed to write to protected directories.
-For more information, see [Evaluate controlled folder access](evaluate-controlled-folder-access.md).
+For more information, see [Monitor controlled folder access (CFA) activity](controlled-folder-access-monitor.md).
## Run a detection test to verify onboarding
diff --git a/defender-endpoint/configure-environment.md b/defender-endpoint/configure-environment.md
index dea6b787cd3..a1680877762 100644
--- a/defender-endpoint/configure-environment.md
+++ b/defender-endpoint/configure-environment.md
@@ -11,19 +11,21 @@ ms.collection:
- tier1
ms.topic: how-to
ms.subservice: onboard
-ms.date: 06/17/2026
+ms.date: 07/28/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Step 1: Configure your network environment for connectivity to the Defender for Endpoint service
[!INCLUDE [Prerelease information](../includes/prerelease.md)]
-Before you onboard devices to Defender for Endpoint, make sure your network is configured to connect to the service, by allowing outbound connection and bypassings HTTPS inspection for the service URLs. The first step of the device onboarding process involves adding URLs to the allowed domains list if your proxy server or firewall rules prevent access to Defender for Endpoint. This article also includes information about proxy and firewall requirements for older versions of Windows client and Windows Server.
+Before you onboard devices to Defender for Endpoint, make sure your network is configured to connect to the service by allowing outbound connections and bypassing HTTPS inspection for the service URLs. The first step of the device onboarding process involves adding URLs to the allowed domains list if your proxy server or firewall rules prevent access to Defender for Endpoint. This article also includes information about proxy and firewall requirements for older versions of Windows client and Windows Server.
+
+[!INCLUDE [Streamlined connectivity SSL inspection requirement](./includes/streamlined-connectivity-no-ssl-inspection.md)]
> [!NOTE]
>
@@ -44,7 +46,7 @@ The URL lists in the following table specify the services and their associated U
> [!IMPORTANT]
>
-> - Connections are made from the context of the operating system or the Defender client services and as such, proxies shouldn't require authentication for these destinations or perform inspection (HTTPS scanning / SSL inspection) that breaks the secure channel.
+> - Connections are made from the context of the operating system or the Defender client services, so proxies shouldn't require authentication for these destinations. For streamlined connectivity, configure your proxy and network security policies to bypass inspection for `*.endpoint.security.microsoft.com` traffic. Don't inspect (HTTPS scanning / SSL inspection), intercept, or man-in-the-middle (MITM) proxy this traffic.
> - Microsoft doesn't provide a proxy server. These URLs are accessible via the proxy server that you configure.
> - In compliance with Defender for Endpoint security and compliance standards, your data is processed in accordance with your tenant's physical location. Based on client location, traffic may flow through any of the associated IP regions (which correspond to Azure datacenter regions). For more information, see [Data storage and privacy](data-storage-privacy.md).
@@ -66,7 +68,7 @@ To determine the exact destinations in use for your subscription within the Log
## For devices without Internet access / without a proxy
-For devices with no direct internet connection, the use of a proxy solution is the recommended approach. In specific cases, you can use firewall or gateway devices that allow access to IP ranges. For more information, see: [Streamlined device connectivity](configure-device-connectivity.md).
+For devices with no direct internet connection, the use of a proxy solution is the recommended approach. For networks that only permit IP-based allowlists instead of domain-based rules, you can use firewall or gateway devices that allow access to IP ranges. For more information, see: [Streamlined device connectivity](configure-device-connectivity.md).
> [!IMPORTANT]
>
@@ -77,4 +79,4 @@ For devices with no direct internet connection, the use of a proxy solution is t
## Next steps
-[STEP 2: Configure your devices to connect to the Defender for Endpoint service using a proxy](configure-proxy-internet.md).
+[Configure your devices to connect to the Defender for Endpoint service using a proxy](configure-proxy-internet.md).
diff --git a/defender-endpoint/configure-exclusions-microsoft-defender-antivirus.md b/defender-endpoint/configure-exclusions-microsoft-defender-antivirus.md
deleted file mode 100644
index 161691dfb28..00000000000
--- a/defender-endpoint/configure-exclusions-microsoft-defender-antivirus.md
+++ /dev/null
@@ -1,188 +0,0 @@
----
-title: Configure custom exclusions for Microsoft Defender Antivirus
-description: You can exclude files (including files modified by specified processes) and folders from Microsoft Defender Antivirus scans.
-ms.service: defender-endpoint
-ms.localizationpriority: medium
-ms.date: 06/16/2026
-author: chrisda
-ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.reviewer: ksarens
-ms.subservice: ngp
-ms.audience: ITPro
-ms.topic: how-to
-ms.collection:
-- m365-security
-- tier2
-- mde-ngp
-appliesto:
- - Microsoft Defender for Endpoint Plan 1
- - Microsoft Defender for Endpoint Plan 2
-ai-usage: ai-assisted
----
-
-# Configure custom exclusions for Microsoft Defender Antivirus
-
-In general, you shouldn't need to define exclusions for Microsoft Defender Antivirus. However, you can exclude files, folders, processes, and process-opened files from Microsoft Defender Antivirus scans. File, folder, process, and process-opened-file exclusions are known as _custom exclusions_. This article describes how to use Microsoft Intune to define custom exclusions for Microsoft Defender Antivirus in Microsoft Windows.
-
-Custom exclusions apply to [scheduled scans](schedule-antivirus-scans.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Exclusions for process-opened files apply only to real-time protection.
-
-> [!TIP]
->
-> - For a detailed overview of suppressions, submissions, and exclusions across Microsoft Defender Antivirus and Defender for Endpoint, see [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md).
-> - If you use another method to distribute exclusions to Microsoft Defender Antivirus on Windows devices (for example, Microsoft Configuration Manager or Group Policy), or you want more information about custom exclusions, see these articles:
-> - [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md)
-> - [Configure exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
-> - The following methods are available to protect exclusions configured on devices:
-> - [Tamper protection for antivirus exclusions](manage-tamper-protection-intune.md#tamper-protection-for-antivirus-exclusions).
-> - [HideExclusionsFromLocalAdmins](/windows/client-management/mdm/defender-csp#configurationhideexclusionsfromlocaladmins):
-> - Doesn't remove existing exclusions from the device.
-> - Exclusions aren't visible in [Get-MpPreference](/powershell/module/defender/get-mppreference) or Registry Editor.
-> - [HideExclusionsFromLocalUsers](/windows/client-management/mdm/defender-csp#configurationhideexclusionsfromlocalusers): Implicitly enabled if HideExclusionsFromLocalAdmins is enabled.
-> - Excluded files can still generate anti-virus alerts in the Microsoft Defender portal. For example, excluded files can trigger behavioral or heuristic detections.
-
-## Prerequisites
-
-### Supported operating systems
-
-- Windows
-
-### Important points about exclusions
-
--
- > [!CAUTION]
- > Use exclusions sparingly. Exclusions are technically a protection gap that lowers Microsoft Defender Antivirus protection. Consider all options when you define exclusions. For more information, see [Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md).
-
-- Exclusions can directly affect whether Microsoft Defender Antivirus can block, remediate, or inspect events related to excluded files, folders, or processes.
- - Custom exclusion can affect features that depend on the antivirus engine. For example:
- - Malware protection.
- - [File IOCs](indicator-file.md).
- - [Certificate IOCs](indicator-certificates.md).
- - Process exclusions on any platform prevent [network protection](network-protection.md) and [attack surface reduction (ASR) rules](attack-surface-reduction-rules-overview.md) from inspecting traffic or enforcing rules for excluded processes.
-
-- Periodically review and audit exclusions. Recheck and re-enforce mitigations as part of your review process. To avoid confusion, your security team should preserve context around why a certain exclusion was required.
-
-- Use exclusions only for specific issues (for example, performance or app compatibility). Don't exclude something just because you think it might be a problem in the future.
-
-
-
-
-
-## Create Microsoft Defender antivirus exclusion policies in Intune
-
-To create a new AV policy in Microsoft Intune using the Microsoft Defender Antivirus Exclusions profile, do the following steps:
-
-1. In the Microsoft Intune admin center at
Valid syntax: `.test` and `test`|Extension exclusions|
-|Any file or folder under a specific folder|All files and folders under the `c:\test\sample` folder|File and folder exclusions|
-|A specific file in a specific folder|The file `c:\sample\sample.test` only|File and folder exclusions|
-|A specific process|The executable file `c:\test\process.exe`|File and folder exclusions|
-
-## Characteristics of exclusion lists
-
-Exclusion lists have the following characteristics:
-
-- Folder exclusions apply to all files and folders in that folder, unless the subfolder is a reparse point. You need to exclude reparse point subfolders separately.
-- File extensions exclusions apply to any file with that extension if a path or folder isn't also specified.
-
-## Important notes about exclusions based on file extensions and folder locations
-
-Keep the following considerations in mind when you define exclusions by file extension or folder location:
-
-- Wildcards (for example, `*`) alter how exclusion rules are interpreted. for important information about how wildcards work, see the [Use wildcards in the file name and folder path or extension exclusion lists](#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) section in this article.
-
-- Don't exclude mapped network drives. Specify the actual network path.
-
-- Reparse point folders are created after the Microsoft Defender Antivirus service starts. Restart Windows for new reparse points to be recognized as valid exclusion targets.
-
-- Exclusions apply to [scheduled scans](schedule-antivirus-scans.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md), but not across all Defender for Endpoint capabilities. To define exclusions across Defender for Endpoint, use [custom indicators](indicators-overview.md).
-
-- By default, local changes to exclusions by admins (including changes made with PowerShell and Windows Management Instrumentation or WMI) are merged with exclusions deployed by Group Policy, Configuration Manager, or Microsoft Intune. Exclusions by Group Policy take precedence when there are conflicts. Exclusion changes made with Group Policy are visible in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
-
- To allow local changes to override managed deployment settings, see [Configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-microsoft-defender-antivirus.md#merge-lists).
-
-## Configure the list of exclusions based on folder name or file extension
-
-You can use the following methods to define exclusions for Microsoft Defender Antivirus.
-
-### Use Intune to configure file name, folder, or file extension exclusions
-
-For more information, see the following article:
-
-- [Create a Microsoft Defender Antivirus exclusions policy in Microsoft Intune](configure-exclusions-microsoft-defender-antivirus.md#create-microsoft-defender-antivirus-exclusion-policies-in-intune)
-
-### Use Configuration Manager to configure file name, folder, or file extension exclusions
-
-For more information, see [How to create and deploy antimalware policies: Exclusion settings](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings).
-
-### Use Group Policy to configure folder or file extension exclusions
-
-> [!NOTE]
-> If the exclusion specifies a fully qualified path to a file, then only that file in that location is excluded. If the exclusion specifies a folder, then all files and subfolders in that folder are excluded.
-
-1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure, and then select **Edit**.
-
-1. In the **Group Policy Management Editor** go to **Computer configuration**, and select **Administrative templates**.
-
-1. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Exclusions**.
-
-1. Open the **Path Exclusions** setting for editing, and add your exclusions.
-
- 1. Set the option to **Enabled**.
-
- 1. Under the **Options** section, select **Show**.
-
- 1. Specify each folder on its own line under the **Value name** column.
-
- 1. If you're specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension.
-
- 1. Enter **0** in the **Value** column.
-
- 1. Choose **OK**.
-
- 1. Open the **Extension Exclusions** setting for editing and add your exclusions.
-
- 1. Set the option to **Enabled**.
-
- 1. Under the **Options** section, select **Show**.
-
- 1. Enter each file extension on its own line under the **Value name** column.
-
- 1. Enter **0** in the **Value** column.
- 1. Choose **OK**.
-
-
-
-### Use PowerShell cmdlets to configure file name, folder, or file extension exclusions
-
-Use the following cmdlets in the [Defender module](/powershell/module/defender/) to manage exclusions:
-
-- [Set-MpPreference](/powershell/module/defender/set-mppreference): Create or replace the list of exclusions.
-
- > [!IMPORTANT]
- > If you already created a list of exclusions using the **Set-MpPreference** or **Add-MpPreference** cmdlets, the next use of **Set-MpPreference** _overwrites_ the existing list of exclusions with the entries you specify.
-
-- [Add-MpPreference](/powershell/module/defender/add-mppreference): Add entries to the existing list of exclusions.
-- [Remove-MpPreference](/powershell/module/defender/remove-mppreference): Remove entries from the existing list of exclusions.
-
-Use the following parameters on those cmdlets:
-
-- _ExclusionExtension_: Exclude files with the specified file extension. Use the following syntax: `"Extension1","Extension2"..."ExtensionN"`.
-- _ExclusionPath_:
- - Exclude the specified file in the specified path.
-
- or
-
- - Exclude all files in the specified folder (including files in subfolders).
-
- Use the following syntax: `"Entry1","Entry2",..."EntryN"`.
-
-For example, the following command adds the `.test` file extension to the exclusion list so Microsoft Defender Antivirus skips files with that extension during scans:
-
-```PowerShell
-Add-MpPreference -ExclusionExtension ".test"
-```
-
-For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md).
-
-### Use Windows Management Instrumentation (WMI) to configure file name, folder, or file extension exclusions
-
-Use the **Set**, **Add**, and **Remove** methods of the [MSFT_MpPreference class](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) for the following properties:
-
-- `ExclusionExtension`
-- `ExclusionPath`
-
-The **Set**, **Add**, and **Remove** methods in the MSFT_MpPreference class are analogous to the **Set-MpPreference**, **Add-MpPreference**, and **Remove-MpPreference** cmdlets in the Defender module in PowerShell.
-
-For more information, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal).
-
-
-
-### Use the Windows Security app to configure file name, folder, or file extension exclusions
-
-For more information, see [Add exclusions in the Windows Security app](microsoft-defender-security-center-antivirus.md).
-
-
-
-## Use wildcards in the file name and folder path or extension exclusion lists
-
-You can use the asterisk `*`, question mark `?`, or environment variables (for example, `%ALLUSERSPROFILE%`) as wildcards for file name or folder path exclusions. You can mix and match `*`, `?`, and environment variables in a single exclusion.
-
-How Microsoft Defender Antivirus interprets wildcards is different from their usual usage in other apps and languages:
-
-- The Microsoft Defender Antivirus service runs in the system context using the LocalSystem account. The service gets information from **system** environment variables, not **user** environment variables. Use only the following types of environment variables as wildcards:
- - System environment variables.
- - Environment variables that apply to processes running as the NT AUTHORITY\SYSTEM account.
-- You can use a maximum of six wildcards per entry.
-- You can't use a wildcard in place of a drive letter.
-- An asterisk `*` in a folder exclusion indicates a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names.
-
-The following table describes how the wildcards can be used and provides some examples.
-
-|Wildcard|Examples|
-|---|---|
-|`*` (asterisk)
**File name and file extension inclusions**: Replaces any number of characters, and only applies to files in the last folder defined in the entry.
**Folder exclusions**: Replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wildcard folders and named folders, all subfolders are also included.|`C:\MyData\*.txt` includes `C:\MyData\notes.txt`.
`C:\somepath\*\Data` includes any file in `C:\somepath\Archives\Data` and its subfolders, and in `C:\somepath\Authorized\Data` and its subfolders.
`C:\Serv\*\*\Backup` includes any file in `C:\Serv\Primary\Denied\Backup` and its subfolders, and in `C:\Serv\Secondary\Allowed\Backup` and its subfolders.|
-|`?` (question mark)
**File name and file extension inclusions**: Replaces a single character, and only applies to files in the last folder specified in the entry.
**Folder exclusions**: Replaces a single character in a folder name. After matching the number of wildcard folders and named folders, all subfolders are also included.|`C:\MyData\my?.zip` includes `C:\MyData\my1.zip`.
`C:\somepath\?\Data` includes any file in `C:\somepath\P\Data` and its subfolders.
`C:\somepath\test0?\Data` includes any file in `C:\somepath\test01\Data` and its subfolders.|
-|Environment variables
The specified variable is populated as a path when the exclusion is evaluated.|`%ALLUSERSPROFILE%\CustomLogFiles` includes `C:\ProgramData\CustomLogFiles\Folder1\file1.txt`.|
-|Mix and Match
You can combine environment variables, `*`, and `?` in a single exclusion entry.|`%PROGRAMFILES%\Contoso*\v?\bin\contoso.exe` include `C:\Program Files\Contoso Labs\v1\bin\contoso.exe`.|
-
-> [!IMPORTANT]
-> If you mix a file exclusion with a folder exclusion, the rules stop at the file exclusion match in the matched folder, and don't look for file matches in subfolders.
->
-> For example, `c:\data\*\marked\date*` excludes all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked`, but not in subfolders of those folders.
-
-
-
-### System environment variables
-
-The following table lists system account environment variables and their corresponding default locations. Some of these locations are different from the corresponding user account environment variables.
-
-|System environment variable|Redirects to this location|
-|---|---|
-|`%APPDATA%`|`C:\Windows\system32\config\systemprofile\Appdata\Roaming`|
-|`%APPDATA%\Microsoft\Internet Explorer\Quick Launch`|`C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch`|
-|`%APPDATA%\Microsoft\Windows\Start Menu`|`C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu`|
-|`%APPDATA%\Microsoft\Windows\Start Menu\Programs`|`C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs`|
-|`%LOCALAPPDATA%`|`C:\WINDOWS\system32\config\systemprofile\AppData\Local`|
-|`%ProgramData%`|`C:\ProgramData`|
-|`%ProgramFiles%`|`C:\Program Files`|
-|`%ProgramFiles%\Common Files`|`C:\Program Files\Common Files`|
-|`%ProgramFiles%\Windows Sidebar\Gadgets`|`C:\Program Files\Windows Sidebar\Gadgets`|
-|`%ProgramFiles%\Common Files`|`C:\Program Files\Common Files`|
-|`%ProgramFiles(x86)%`|`C:\Program Files (x86)`|
-|`%ProgramFiles(x86)%\Common Files`|`C:\Program Files (x86)\Common Files`|
-|`%SystemDrive%`|`C:`|
-|`%SystemDrive%\Program Files`|`C:\Program Files`|
-|`%SystemDrive%\Program Files (x86)`|`C:\Program Files (x86)`|
-|`%SystemDrive%\Users`|`C:\Users`|
-|`%SystemDrive%\Users\Public`|`C:\Users\Public`|
-|`%SystemRoot%`|`C:\Windows`|
-|`%windir%`|`C:\Windows`|
-|`%windir%\Fonts`|`C:\Windows\Fonts`|
-|`%windir%\Resources`|`C:\Windows\Resources`|
-|`%windir%\resources\0409`|`C:\Windows\resources\0409`|
-|`%windir%\system32`|`C:\Windows\System32`|
-|`%ALLUSERSPROFILE%`|`C:\ProgramData`|
-|`%ALLUSERSPROFILE%\Application Data`|`C:\ProgramData\Application Data`|
-|`%ALLUSERSPROFILE%\Documents`|`C:\ProgramData\Documents`|
-|`%ALLUSERSPROFILE%\Documents\My Music\Sample Music`|`C:\ProgramData\Documents\My Music\Sample Music`|
-|`%ALLUSERSPROFILE%\Documents\My Music`|`C:\ProgramData\Documents\My Music`|
-|`%ALLUSERSPROFILE%\Documents\My Pictures`|`C:\ProgramData\Documents\My Pictures`|
-|`%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures`|`C:\ProgramData\Documents\My Pictures\Sample Pictures`|
-|`%ALLUSERSPROFILE%\Documents\My Videos`|`C:\ProgramData\Documents\My Videos`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore`|`C:\ProgramData\Microsoft\Windows\DeviceMetadataStore`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer`|`C:\ProgramData\Microsoft\Windows\GameExplorer`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones`|`C:\ProgramData\Microsoft\Windows\Ringtones`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu`|`C:\ProgramData\Microsoft\Windows\Start Menu`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs`|`C:\ProgramData\Microsoft\Windows\Start Menu\Programs`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools`|`C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp`|`C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp`|
-|`%ALLUSERSPROFILE%\Microsoft\Windows\Templates`|`C:\ProgramData\Microsoft\Windows\Templates`|
-|`%ALLUSERSPROFILE%\Start Menu`|`C:\ProgramData\Start Menu`|
-|`%ALLUSERSPROFILE%\Start Menu\Programs`| `C:\ProgramData\Start Menu\Programs`|
-|`%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools`|`C:\ProgramData\Start Menu\Programs\Administrative Tools`|
-|`%ALLUSERSPROFILE%\Templates`|`C:\ProgramData\Templates`|
-|`%LOCALAPPDATA%\Microsoft\Windows\ConnectedSearch\Templates`|`C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\ConnectedSearch\Templates`|
-|`%LOCALAPPDATA%\Microsoft\Windows\History`|`C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History`|
-|`%PUBLIC%`|`C:\Users\Public`|
-|`%PUBLIC%\AccountPictures`|`C:\Users\Public\AccountPictures`|
-|`%PUBLIC%\Desktop`|`C:\Users\Public\Desktop`|
-|`%PUBLIC%\Documents`|`C:\Users\Public\Documents`|
-|`%PUBLIC%\Downloads`|`C:\Users\Public\Downloads`|
-|`%PUBLIC%\Music\Sample Music`|`C:\Users\Public\Music\Sample Music`|
-|`%PUBLIC%\Music\Sample Playlists`|`C:\Users\Public\Music\Sample Playlists`|
-|`%PUBLIC%\Pictures\Sample Pictures`|`C:\Users\Public\Pictures\Sample Pictures`|
-|`%PUBLIC%\RecordedTV.library-ms`|`C:\Users\Public\RecordedTV.library-ms`|
-|`%PUBLIC%\Videos`|`C:\Users\Public\Videos`|
-|`%PUBLIC%\Videos\Sample Videos`|`C:\Users\Public\Videos\Sample Videos`|
-|`%USERPROFILE%`|`C:\Windows\system32\config\systemprofile`|
-|`%USERPROFILE%\AppData\Local`|`C:\Windows\system32\config\systemprofile\AppData\Local`|
-|`%USERPROFILE%\AppData\LocalLow`|`C:\Windows\system32\config\systemprofile\AppData\LocalLow`|
-|`%USERPROFILE%\AppData\Roaming`|`C:\Windows\system32\config\systemprofile\AppData\Roaming`|
-
-## Review the list of exclusions
-
-> [!IMPORTANT]
-> Exclusion list changes you make with Group Policy **appear** in the lists of [Windows Security app](microsoft-defender-security-center-antivirus.md).
-> Exclusion list changes you make in the Windows Security app **don't appear** in the Group Policy lists.
-
-You can retrieve the items in the exclusion list by using one of the following methods:
-
-- [Microsoft Intune](/intune/intune-service/fundamentals/deployment-guide-intune-setup)
-- [Microsoft Configuration Manager](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies)
-- [MpCmdRun](command-line-arguments-microsoft-defender-antivirus.md)
-- [PowerShell](/powershell/module/defender)
-- [Windows Security app](microsoft-defender-security-center-antivirus.md)
-
-
-
-### Verify whether a specified path is excluded using MpCmdRun
-
-You can use the [MpCmdRun.exe command-line tool](./command-line-arguments-microsoft-defender-antivirus.md) in Microsoft Defender Antivirus version 4.18.2111-5.0 or later (December 2021) to verify whether specific folder paths or file and folder paths are excluded from scanning by running the following commands in an elevated command prompt (a Command Prompt window you opened by selecting **Run as administrator**):
-
-> [!TIP]
-> The first command changes the directory to the latest version of \
|
-|Any file opened by any process under a specific folder|`c:\test\sample\*` excludes files opened by:
|
-|Any file opened by a specific process in a specific folder|`c:\test\process.exe` exclude files opened by `c:\test\process.exe` only.|
-
-When you add a process to the process exclusion list, Microsoft Defender Antivirus doesn't scan files opened by that process, no matter where the files are located. The process itself, however, is scanned unless it's added to the [file exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md).
-
-The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). They don't apply to scheduled or on-demand scans.
-
-Changes made with Group Policy to the exclusion lists **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md). However, changes made in the Windows Security app **will not show** in the Group Policy lists.
-
-You can add, remove, and review the lists for exclusions in Group Policy, Microsoft Configuration Manager, Microsoft Intune, and with the Windows Security app, and you can use wildcards to further customize the lists.
-
-You can also use PowerShell cmdlets and WMI to configure the exclusion lists, including reviewing your lists.
-
-By default, local changes made to the lists (by users with administrator privileges; changes made with PowerShell and WMI) are merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists take precedence if there are conflicts.
-
-You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-microsoft-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings.
-
-> [!NOTE]
-> **Network Protection** and [attack surface reduction (ASR) rules](attack-surface-reduction-rules-overview.md) are directly affected by process exclusions on all platforms. A process exclusion on any OS (Windows, macOS, or Linux) means Network Protection or ASR rules can't inspect traffic or enforce rules for that specific process.
-
-### Image name vs full path for process exclusions
-
-Two different types of process exclusions might be set. A process might be excluded by image name, or by full path. The image name is simply the file name of the process, without the path.
-
-For example, given the process `MyProcess.exe` running from `C:\MyFolder\` the full path to this process would be `C:\MyFolder\MyProcess.exe` and the image name is `MyProcess.exe`.
-
-Image name exclusions are much more broad - an exclusion on `MyProcess.exe` excludes any processes with this image name, regardless of the path they're run from. So for example, if the process `MyProcess.exe` is excluded by image name, it will also be excluded if it's run from `C:\MyOtherFolder`, from removable media, et cetera. As such it's recommended that whenever possible, the full path is used.
-
-### Use wildcards in the process exclusion list
-
-The use of wildcards in the process exclusion list is different from their use in other exclusion lists. When the process exclusion is defined as an image name only, wildcard usage isn't allowed. However when a full path is used, wildcards are supported and the wildcard behavior follows the rules described in the "Use wildcards in the file name and folder path or extension exclusion lists" section of [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists)
-
-The use of environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the process exclusion list is also supported. Details and a full list of supported environment variables are described in the "System environment variables" section of [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables).
-
-The following table describes how the wildcards can be used in the process exclusion list, when a path is supplied:
-
-|Wildcard|Example use|Example matches|
-|---|---|---|
-|`*` (asterisk)
Replaces any number of characters.|`C:\MyFolder\*`|Any file opened by `C:\MyFolder\MyProcess.exe` or `C:\MyFolder\AnotherProcess.exe`|
-||`C:\*\*\MyProcess.exe`|Any file opened by `C:\MyFolder1\MyFolder2\MyProcess.exe` or `C:\MyFolder3\MyFolder4\MyProcess.exe`|
-||`C:\*\MyFolder\My*.exe`|Any file opened by `C:\MyOtherFolder\MyFolder\MyProcess.exe` or `C:\AnotherFolder\MyFolder\MyOtherProcess.exe`|
-|'?' (question mark)
Replaces one character.|`C:\MyFolder\MyProcess??.exe`|Any file opened by `C:\MyFolder\MyProcess42.exe` or `C:\MyFolder\MyProcessAA.exe` or `C:\MyFolder\MyProcessF5.exe`|
-|Environment Variables|`%ALLUSERSPROFILE%\MyFolder\MyProcess.exe`|Any file opened by `C:\ProgramData\MyFolder\MyProcess.exe`|
-
-### Contextual Process Exclusions
-
-A process exclusion might also be defined via a [Contextual exclusion](configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md) allowing, for example, a specific file to be excluded only if it's opened by a specific process.
-
-## Configure the list of exclusions for files opened by specified processes
-
-Use one of the following methods to configure exclusions for files opened by specified processes.
-
-### Use Microsoft Intune to exclude files that have been opened by specified processes from scans
-
-For more information, see [Configure device restriction settings in Microsoft Intune](/intune/intune-service/configuration/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/intune-service/configuration/device-restrictions-windows-10#microsoft-defender-antivirus).
-
-### Use Microsoft Configuration Manager to exclude files that have been opened by specified processes from scans
-
-See [How to create and deploy anti-malware policies: Exclusion settings](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring Microsoft Configuration Manager (current branch).
-
-### Use Group Policy to exclude files that have been opened by specified processes from scans
-
-Perform the following steps to configure process-based exclusions by using Group Policy:
-
-1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). Right-click the Group Policy Object you want to configure and select **Edit**.
-
-1. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
-
-1. Expand the tree to **Windows components \> Microsoft Defender Antivirus \> Exclusions**.
-
-1. Double-click **Process Exclusions** and add the exclusions:
- 1. Set the option to **Enabled**.
- 1. Under the **Options** section, select **Show...**.
- 1. Enter each process on its own line under the **Value name** column. See the example table for the different types of process exclusions. Enter **0** in the **Value** column for all processes.
-
-1. Select **OK**.
-
-### Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans
-
-Using PowerShell to add or remove exclusions for files that are opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](/powershell/module/defender/).
-
-Use the following syntax to add a process exclusion so that files opened by the specified process are excluded from Microsoft Defender Antivirus scans:
-
-```PowerShell
-
2. On the **Basics** step, type a name and description for your policy, and then choose **Next**.
3. On the **Configuration settings** step, expand **Defender**, select the settings you want to use for your policy, and then choose **Next**. To get help with your settings, refer to [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx).
4. On the **Scope tags** step, choose **Select scope tags** to open the *Select tags* pane to assign scope tags to the profile, and then select **Next** to continue.
5. On the **Assignments** page, select the groups to receive this profile, and then select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/intune/intune-service/configuration/device-profile-assign).
6. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. |
- | Create a new policy for macOS devices | 1. In the **Create a profile** step, in the **Platform** list, select **macOS**. For **Profile**, select **Antivirus**. Then choose **Create**.
2. On the **Basics** step, type a name and description for your policy, and then choose **Next**.
3. On the **Configuration settings** step, select the settings you want to use for your policy, and then choose **Next**. To get help with your settings, refer to [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md).
4. On the **Scope tags** step, choose **Select scope tags** to open the *Select tags* pane to assign scope tags to the profile, and then select **Next** to continue.
5. On the **Assignments** page, select the groups to receive this profile, and then select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/intune/intune-service/configuration/device-profile-assign).
6. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list when you select the policy type for the profile you created. |
- | Edit an existing policy for Windows devices | 1. Select an antivirus policy for Windows devices.
2. Next to **Configuration settings**, choose **Edit**.
3. Expand **Defender**, and then edit settings for your policy. To get help with your settings, refer to [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx).
4. select **Review + save**, and then select **Save**. |
- | Edit an existing policy for macOS devices | 1. Select an antivirus policy for macOS devices.
2. Select **Properties**, and then, next to **Configuration settings**, choose **Edit**.
3. Under **Microsoft Defender for Endpoint**, edit settings for your policy. To get help with your settings, refer to [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md).
4. select **Review + save**, and then select **Save**. |
+- **Select platform**: Select **Windows**.
+- **Select template**: Select **Microsoft Defender Antivirus**.
-## Are you using Group Policy?
+When you create or modify the policy, use these specific settings on the **Configuration settings** tab:
-> [!IMPORTANT]
-> We recommend using [Microsoft Intune](/intune/intune-service/fundamentals/what-is-intune) to manage Microsoft Defender Antivirus settings for your organization. With Intune, you can control where tamper protection is enabled (or disabled) through policies. You can also protect Microsoft Defender Antivirus exclusions. For more information, see [Protect Microsoft Defender Antivirus exclusions from tampering](prevent-changes-to-security-settings-with-tamper-protection.md#protect-microsoft-defender-antivirus-exclusions).
+- In the **Defender** section, configure the following settings:
+ - **Allow Real-Time Monitoring**: Select **Allowed**.
+ - **Allow On Access Protection**: Select **Allowed**.
+ - **Real Time Scan Direction**: Select **Monitor all files (bi-directional)**.
+ - **Allow behavior monitoring**: Select **Allowed**.
-You can use Group Policy to manage some Microsoft Defender Antivirus settings. If [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled in your organization, any changes made to [tamper-protected settings](prevent-changes-to-security-settings-with-tamper-protection.md#what-happens-when-tamper-protection-is-turned-on) are ignored. You can't turn off tamper protection by using Group Policy.
+The Microsoft Defender Antivirus template doesn't include a separate setting for heuristics. Heuristics are part of real-time protection.
-If you must make changes to a device and those changes are blocked by tamper protection, we recommend using [troubleshooting mode](enable-troubleshooting-mode.md) to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state.
-
-You can use **Local Group Policy Editor** to enable and configure Microsoft Defender Antivirus always-on protection settings.
+## Configure always-on protection settings in Microsoft Configuration Manager
-### Enable and configure always-on protection using Group Policy
+For instructions to create and deploy an antimalware policy, see [Endpoint Protection antimalware policies in Configuration Manager](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies).
-Use the following steps to enable and configure always-on protection using Local Group Policy Editor:
+In the **Real-time protection** settings of the antimalware policy, configure the following settings:
-1. Open **Local Group Policy Editor**, as follows:
+- **Enable real-time protection**: Select **Yes**.
+- **Monitor file and program activity on your computer**: Select **Yes**.
+- **Scan system files**: Select **Scan incoming and outgoing files**.
+- **Enable behavior monitoring**: Select **Yes**.
- 1. In your Windows 10 or Windows 11 taskbar search box, type **gpedit**.
+
- 1. Under **Best match**, select **Edit group policy** to launch **Local Group Policy Editor**.
-
- :::image type="content" source="media/gpedit-search.png" alt-text="The GPEdit taskbar search result in the Control panel" lightbox="media/gpedit-search.png":::
+## Configure always-on protection settings in Group Policy
-1. In the left pane of **Local Group Policy Editor**, expand the tree to **Computer Configuration** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus**.
+You can use Group Policy to manage some Microsoft Defender Antivirus settings. If [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled in your organization, any changes made to [tamper-protected settings](prevent-changes-to-security-settings-with-tamper-protection.md#what-happens-when-tamper-protection-is-turned-on) are ignored. You can't turn off tamper protection by using Group Policy.
-1. Configure the Microsoft Defender Antivirus antimalware service policy setting.
+To temporarily change tamper-protected settings for testing or diagnostics, use [troubleshooting mode](enable-troubleshooting-mode.md). After troubleshooting mode ends, the settings return to their configured values. To make permanent changes, use a management tool that supports changes to tamper-protected settings, such as Intune.
- In the **Microsoft Defender Antivirus** details pane on right, double-click **Allow antimalware service to start up with normal priority**, and set it to **Enabled**.
+The following procedure applies to Windows devices.
- Then select **OK**.
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
+1. In the GPMC console tree, expand **Group Policy Objects** in the forest and domain containing the Group Policy Object (GPO) you want to edit.
+1. Right-click the GPO, and then select **Edit**.
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
+1. In the details pane of **Microsoft Defender Antivirus**, the folders used to configure always-on protection are:
+ - **Real-time Protection**: [Configure real-time protection settings](#configure-real-time-protection-settings-in-group-policy).
+ - **Scan**: [Turn on heuristics](#turn-on-heuristics-in-group-policy).
-1. Configure the Microsoft Defender Antivirus real-time protection policy settings, as follows:
+ To open and configure a setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
- 1. In the **Microsoft Defender Antivirus** details pane, double-click **Real-time Protection**. Or, from the **Microsoft Defender Antivirus** tree on left pane, select **Real-time Protection**.
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
- 1. In the **Real-time Protection** details pane on right, double-click the policy setting as specified in [Real-time protection policy settings](#real-time-protection-policy-settings).
+Configure the settings as described in the following subsections.
- 1. Configure the setting as appropriate, and select **OK**.
+### Configure real-time protection settings in Group Policy
- 1. Repeat the previous steps for each setting in the table.
+If a setting described in this article isn't available in Group Policy Management Editor, update the Administrative Templates in your Group Policy Central Store. The Central Store isn't updated automatically. For instructions, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store).
-1. Configure the Microsoft Defender Antivirus scanning policy setting, as follows:
+Configure the following policies to turn on real-time and behavior monitoring:
- 1. From the **Microsoft Defender Antivirus** tree on left pane, select **Scan**.
-
- 1. In the **Scan** details pane on right, double-click **Turn on heuristics**, and set it to **Enabled**.
+|Policy|Value|
+|---|---|
+|Turn off real-time protection|Disabled|
+|Configure monitoring for incoming and outgoing file and program activity|Enabled, bi-directional (full on-access)|
+|Turn on behavior monitoring|Enabled|
+|Monitor file and program activity on your computer|Enabled|
- 1. Select **OK**.
+1. Go to **Microsoft Defender Antivirus** \> **Real-time Protection**.
+1. In the details pane of **Real-time Protection**, select a policy setting to view its description and supported options in the help pane. For a list of the settings and links to related guidance, see [Group Policy settings and resources](use-group-policy-microsoft-defender-antivirus.md#group-policy-settings-and-resources).
+1. Open each policy setting in the table, configure the specified value, and then select **OK**.
-1. Close **Local Group Policy Editor**.
+### Turn on heuristics in Group Policy
-### Real-time protection policy settings
+Enable the heuristics policy in the **Scan** folder:
-For the most current settings, get the latest ADMX files in the Group Policy Central Store. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) and download the latest files.
+1. Go to **Microsoft Defender Antivirus** \> **Scan**.
+1. In the details pane of **Scan**, open **Turn on heuristics**.
+1. Select **Enabled**, and then select **OK**.
### Disable real-time protection in Group Policy
> [!WARNING]
-> **Disabling real-time protection drastically reduces the protection on your endpoints and is not recommended**. In addition, if [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled, you cannot turn it off by using Group Policy. If you must make changes to a device and those changes are blocked by tamper protection, we recommend using [troubleshooting mode](enable-troubleshooting-mode.md) to temporarily disable tamper protection on the device. Note that after troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state.
+> Disabling real-time protection drastically reduces the protection on your endpoints and isn't recommended. If [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled, you can't turn off real-time protection by using Group Policy. To turn off real-time protection temporarily for testing or diagnostics, use [troubleshooting mode](enable-troubleshooting-mode.md). After troubleshooting mode ends, real-time protection returns to its configured value.
-1. Open **Local Group Policy Editor**.
+To disable real-time protection by using Group Policy:
- 1. In your Windows 10 or Windows 11 taskbar search box, type `gpedit`.
+1. Go to **Microsoft Defender Antivirus** \> **Real-time Protection**.
+1. In the details pane of **Real-time Protection**, open **Turn off real-time protection**.
+1. Select **Enabled**, and then select **OK**.
- 1. Under **Best match**, select **Edit group policy** to launch **Local Group Policy Editor**.
+## Configure always-on protection settings using PowerShell
-1. In the left pane of **Local Group Policy Editor**, expand the tree to **Computer Configuration** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus** \> **Real-time Protection**.
+Run the commands in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**).
-1. In the **Real-time Protection** details pane on right, double-click **Turn off real-time protection**.
+The following command turns on real-time monitoring and behavior monitoring, and configures Microsoft Defender Antivirus to scan incoming and outgoing files:
-1. In the **Turn off real-time protection** setting window, set the option to **Enabled**.
-
-1. select **OK**.
+```powershell
+Set-MpPreference -DisableRealtimeMonitoring $false -DisableBehaviorMonitoring $false -RealTimeScanDirection Both
+```
-1. Close **Local Group Policy Editor**.
+The following command displays the configured values:
-## See also
+```powershell
+Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring, RealTimeScanDirection
+```
-### Related content
+Verify that _DisableRealtimeMonitoring_ and _DisableBehaviorMonitoring_ are set to `False`, and _RealTimeScanDirection_ is set to `0`.
+
+For detailed syntax and parameter information, see [**Set-MpPreference**](/powershell/module/defender/set-mppreference) and [**Get-MpPreference**](/powershell/module/defender/get-mppreference).
+
+## Turn on real-time protection in the Windows Security app
+
+The [Windows Security app](microsoft-defender-security-center-antivirus.md) lets you turn on real-time protection on an individual device. It doesn't provide separate controls for all the always-on protection settings described in this article.
+
+To turn on real-time protection in the Windows Security app:
+
+1. Open the **Windows Security** app and select **Virus & threat protection**.
+1. On the **Virus & Threat protection** page, select **Manage settings** in the **Virus & threat protection settings** section.
+1. On the **Virus & threat protection settings** page, slide the **Real-time protection** toggle to :::image type="icon" source="media/toggle-on.png" border="false"::: **On**.
+
+If your organization manages real-time protection, the **Real-time protection** setting might be unavailable. If you turn off real-time protection, it turns on again automatically after a short delay.
+
+For more information, see [Microsoft Defender Antivirus in the Windows Security app](microsoft-defender-security-center-antivirus.md).
+
+## Related content
- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md)
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-windows.md)
@@ -142,6 +205,7 @@ For the most current settings, get the latest ADMX files in the Group Policy Cen
### Other platforms
If you're looking for antivirus-related information for other platforms, see:
+
- [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md)
- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md)
- [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/intune/intune-service/protect/antivirus-microsoft-defender-settings-macos)
@@ -149,6 +213,3 @@ If you're looking for antivirus-related information for other platforms, see:
- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
- [Configure Defender for Endpoint on Android features](android-configure.md)
- [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)
-
-
-
diff --git a/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md b/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md
index 86cf8e4d658..5b7fd70c2cc 100644
--- a/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md
+++ b/defender-endpoint/configure-remediation-microsoft-defender-antivirus.md
@@ -1,17 +1,17 @@
---
title: Configure remediation for Microsoft Defender Antivirus detections
-description: Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder
+description: Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder.
ms.service: defender-endpoint
ms.subservice: ngp
ms.localizationpriority: medium
author: chrisda
ms.author: chrisda
ms.topic: how-to
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1015
+ms.date: 08/31/2026
ai-usage: ai-assisted
ms.reviewer: yongrhee
-ms.collection:
+ms.collection:
- m365-security
- tier2
- mde-ngp
@@ -19,25 +19,19 @@ appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender Antivirus
+#customer intent: As a security administrator, I want to configure remediation actions and retention periods so that Microsoft Defender Antivirus handles detected threats according to my organization's requirements.
---
# Configure remediation for Microsoft Defender Antivirus detections
-When Microsoft Defender Antivirus runs a scan, it attempts to remediate or remove threats that are detected. Remediation actions can include removing a file, sending it to quarantine, or allowing it to remain. This article includes information and links to resources about specifying what actions should be taken when threats are detected on devices. You can choose from several methods, such as:
-
-- [Configure remediation for Microsoft Defender Antivirus detections](#configure-remediation-for-microsoft-defender-antivirus-detections)
- - [Configure remediation options using Intune](#configure-remediation-options-using-intune)
- - [Configure remediation options using Configuration Manager](#configure-remediation-options-using-configuration-manager)
- - [Configure remediation options using Group Policy](#configure-remediation-options-using-group-policy)
- - [Configure remediation options using PowerShell or WMI](#configure-remediation-options-using-powershell-or-wmi)
- - [See also](#see-also)
+When Microsoft Defender Antivirus runs a scan, it attempts to remediate or remove threats that are detected. Remediation actions can include removing a file, sending it to quarantine, or allowing it to remain. This article includes information and links to resources about specifying what actions should be taken when threats are detected on devices.
> [!IMPORTANT]
> Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed.
>
-> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). To avoid false-positive quarantines in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md).
+> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). To avoid false-positive quarantines in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](microsoft-defender-antivirus-exclusions-configure.md).
-Also see [About regular quick and full scans with Microsoft Defender Antivirus](schedule-antivirus-scans.md) for more remediation-related settings.
+For scan scheduling and related remediation settings, see [About regular quick and full scans with Microsoft Defender Antivirus](schedule-antivirus-scans.md).
## Prerequisites
@@ -47,12 +41,19 @@ Also see [About regular quick and full scans with Microsoft Defender Antivirus](
## Configure remediation options using Intune
-To configure remediation actions using a Microsoft Intune Endpoint Security **Antivirus policy** policy, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:
+[!INCLUDE [intune-recommended-separate-product](includes/intune-recommended-separate-product.md)]
+
+To configure remediation actions in Microsoft Intune, use an endpoint security **Antivirus** policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).
+
+When you create the policy, use these specific settings:
+
+- **Policy type**: Select **Manage** \> **Antivirus** on the **Endpoint security \| Overview** page.
+- **Platform**: Select **Windows**.
+- **Profile**: Select **Microsoft Defender Antivirus**.
+
+When you create or modify the policy, use these specific settings on the **Configuration settings** tab:
-- **Policy type**: Attack surface reduction
-- **Platform**: Windows
-- **Profile**: Microsoft Defender Antivirus
-- **Configuration settings**: In the **Threat security default action** section, configure the available settings:
+- In the **Threat security default action** section, configure the available settings:
- **Remediation action for High severity threats**
- **Remediation action for Severe threats**
- **Remediation action for Low severity threats**
@@ -79,42 +80,121 @@ To configure remediation actions using a Microsoft Intune Endpoint Security **An
For more information about antivirus policies in Intune, see [Antivirus policy for endpoint security in Intune](/intune/intune-service/protect/endpoint-security-antivirus-policy).
+## Configure remediation options in the Microsoft Defender portal
+
+If your organization [manages endpoint security policies in the Microsoft Defender portal](endpoint-security-policies-configure.md), use a Microsoft Defender Antivirus policy to configure remediation actions.
+
+For detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).
+
+When you create the policy on the **Endpoint security policies** page in the Defender portal at
Use this setting to specify how threats for each level are remediated. Valid values are:
**Warning**: The actions Ignore (`6`) and None (`11`) don't remediate detected threats. Ignore (`6`) suppresses ongoing detection events, while None (`11`) continues to generate alerts and Protection History entries. Don't configure either action when [tamper protection is enabled](prevent-changes-to-security-settings-with-tamper-protection.md). Use these actions only in specialized environments (for example, industrial control systems or critical infrastructure) where Automatic remediation isn't practical for operations, other procedures exist to respond to detected threats, or compensating security controls are deployed. Use standard remediation actions (Quarantine (`2`) or Remove (`3`)) in all other environments.|n/a|
+ |Threats|Specify threats upon which default action shouldn't be taken when detected.|Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored.|n/a|
-1. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus**.
+1. In the details pane of the selected location, open the setting. To open and configure a setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
-1. Using the following table, edit the policy as needed.
+1. In the setting window that opens, configure the setting, and then select **OK**.
- |Setting|Description|Default setting (if not configured)|
- |---|---|---|
- |Scan
Create a system restore point.|A system restore point is created each day before cleaning or scanning is attempted. |Disabled|
- |Scan
Turn on removal of items from scan history folder.|Specify how many days items should be kept in the scan history.|30 days|
- |Root
Turn off routine remediation.|Specify whether Microsoft Defender Antivirus automatically remediates threats, or whether to prompt the user.|Disabled. Threats are remediated automatically.|
- |Quarantine
Configure removal of items from Quarantine folder.|Specify how many days items should be kept in quarantine before being removed.|90 days|
- |Threats \> Specify threats upon which default action shouldn't be taken when detected.|Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored.|Not applicable|
- |Threats \> Specify threat alert levels at which default action shouldn't be taken when detected.|Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level:
Use this setting to specify how threats for each level are remediated. Valid values are:
**Warning**: The actions Ignore (`6`) and None (`11`) don't remediate detected threats. Ignore (`6`) suppresses ongoing detection events, while None (`11`) continues to generate alerts and Protection History entries. Don't configure either action when [tamper protection is enabled](prevent-changes-to-security-settings-with-tamper-protection.md). Use these actions only in specialized environments (for example, industrial control systems or critical infrastructure) where Automatic remediation isn't practical for operations, other procedures exist to respond to detected threats, or compensating security controls are deployed. Use standard remediation actions (Quarantine (`2`) or Remove (`3`)) in all other environments.|Not applicable|
+ Repeat this step as many times as necessary.
-1. Select **OK**.
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
-## Configure remediation options using PowerShell or WMI
+
-You can also use the [`Set-MpPreference` PowerShell cmdlet](/powershell/module/defender/set-mppreference) or [`MSFT_MpPreference` WMI class](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) to configure the threat default-action and remediation settings.
+## Configure remediation options using PowerShell
+
+Run the commands in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**).
+
+### Configure default actions by threat severity
+
+The following example quarantines low and moderate severity threats and removes high and severe threats:
+
+```powershell
+Set-MpPreference -LowThreatDefaultAction Quarantine -ModerateThreatDefaultAction Quarantine -HighThreatDefaultAction Remove -SevereThreatDefaultAction Remove
+```
+
+### Configure the default action for a specific threat
+
+Replace `
+**Value**: Enter one of the following [mode values](controlled-folder-access-overview.md#modes-for-cfa):
+
+- `0`: Disabled (default).
+- `1`: Enabled (block).
+- `2`: Audit Mode.
+- `3`: Block disk modification only.
+- `4`: Audit disk modification only.
+
+### Add folders to protected folders using the Policy CSP
+
+CFA protects [an unmodifiable list of common folders](controlled-folder-access-overview.md#default-folders-protected-by-cfa). To add more folders that get CFA protection, use the [ControlledFolderAccessProtectedFolders](/windows/client-management/mdm/policy-csp-defender#controlledfolderaccessprotectedfolders) CSP:
+
+**OMA-URI path**: `./Device/Vendor/MSFT/Policy/Config/Defender/ControlledFolderAccessProtectedFolders`
+**Value**: Enter one or more folder paths separated by the pipe (`|`) character.
+
+For example, `C:\Data\Reports|C:\Data\Finance`.
+
+### Allow apps to modify files in protected folders using the Policy CSP
+
+Use the [ControlledFolderAccessAllowedApplications](/windows/client-management/mdm/policy-csp-defender#controlledfolderaccessallowedapplications) CSP to allow more apps to make changes to files in protected folders.
+
+**OMA-URI path**: `./Device/Vendor/MSFT/Policy/Config/Defender/ControlledFolderAccessAllowedApplications`
+**Value**: Enter one or more app paths separated by the pipe (`|`) character. The path of each app can include environment variables and wildcards, as described in [Allow apps to modify files in protected folders](controlled-folder-access-overview.md#allow-apps-to-modify-files-in-protected-folders).
+
+For example, `C:\Apps\app1.exe|%ProgramFiles%\Fabrikam\DriveManager\*\DriveService.exe`
+
+
+
+## Configure CFA in Microsoft Configuration Manager
+
+In Microsoft Configuration Manager, you configure CFA in a Windows Defender Exploit Guard policy. For instructions, see the CFA information in [Create and deploy an Exploit Guard policy](/intune/configmgr/protect/deploy-use/create-deploy-exploit-guard-policy#bkmk_CFA).
+
+> [!NOTE]
+> For considerations when you add protected folders or allow apps (such as wildcard support and the requirement to restart allowed apps), see [Add other folders to CFA](controlled-folder-access-overview.md#add-other-folders-to-cfa) and [Allow apps to modify files in protected folders](controlled-folder-access-overview.md#allow-apps-to-modify-files-in-protected-folders).
+
+
+
+## Configure CFA in Group Policy
+
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
+
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
+
+1. Right-click the GPO, and then select **Edit**.
+
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Microsoft Defender Exploit Guard** \> **Controlled Folder Access**.
+
+1. In the details pane of **Controlled Folder Access**, the available settings are:
+ - [Configure allowed applications](#allow-apps-to-modify-files-in-protected-folders-in-group-policy)
+ - [Configure controlled folder access](#enable-cfa-in-group-policy)
+ - [Configure protected folders](#add-folders-to-protected-folders-in-group-policy)
+
+ To open and configure a CFA setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
+
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Microsoft Defender Exploit Guard** \> **Controlled Folder Access**.
+
+The available settings are described in the following subsections.
+
+> [!IMPORTANT]
+> Quotation marks, leading spaces, trailing spaces, and extra characters aren't supported in any of the CFA values in Group Policy.
+
+### Enable CFA in Group Policy
+
+1. In the details pane of **Controlled Folder Access**, open the **Configure controlled folder access** setting.
+
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Configure the guard my folders feature**: Select one of the following [mode values](controlled-folder-access-overview.md#modes-for-cfa):
+ - **Disable (Default)**
+ - **Block**
+ - **Audit Mode**
+ - **Block disk modification only**
+ - **Audit disk modification only**
+
+ :::image type="content" source="media/controlled-folder-access-group-policy-enable.png" alt-text="Screenshot shows the group policy option enabled and Audit Mode selected." lightbox="media/controlled-folder-access-group-policy-enable.png":::
+
+> [!IMPORTANT]
+> To fully enable CFA, you must set the Group Policy option to **Enabled** and select **Block** in the options drop-down menu.
+
+### Add folders to protected folders in Group Policy
+
+1. In the details pane of **Controlled Folder Access**, open the **Configure protected folders** setting.
+ 1. Select **Enabled**.
+ 1. **Enter the folders that should be guarded**: Select **Show...**.
+ 1. In the setting window that opens, configure the following options:
+ - **Value name**: Enter the path to include in CFA protection.
+ - **Value**: Enter the value `0`.
+
+ Repeat this step as many times as necessary. When you're finished, select **OK**.
+
+ For considerations when you add folders (such as support for network shares, mapped drives, and environment variables), see [Add other folders to CFA](controlled-folder-access-overview.md#add-other-folders-to-cfa).
+
+### Allow apps to modify files in protected folders in Group Policy
+
+1. In the details pane of **Controlled Folder Access**, open the **Configure allowed applications** setting.
+ 1. Select **Enabled**.
+ 1. **Enter the applications that should be trusted**: Select **Show...**.
+ 1. In the setting window that opens, configure the following options:
+ - **Value name**: Enter the path and file name of the application that's allowed to make changes to files in protected folders.
+ - **Value**: Enter the value `0`.
+
+ Repeat this step as many times as necessary. When you're finished, select **OK**.
+
+ For considerations when you allow apps (such as wildcard support and the requirement to restart allowed apps), see [Allow apps to modify files in protected folders](controlled-folder-access-overview.md#allow-apps-to-modify-files-in-protected-folders).
+
+
+
+## Enable and configure CFA in PowerShell
+
+On the target device, run the commands in this section from an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**).
+
+To turn on CFA and select the [protection mode](controlled-folder-access-overview.md#modes-for-cfa), use the following command:
+
+```powershell
+Set-MpPreference -EnableControlledFolderAccess
**Block**|1|Untrusted apps can't modify or delete files in protected folders or write to disk sectors.|
+|**Audit Mode**|2|Untrusted apps can modify or delete files in protected folders and write to disk sectors, but these attempts are recorded.
Use this mode to [assess the effect of CFA](controlled-folder-access-monitor.md#use-audit-mode-to-measure-the-effect-of-cfa) on your organization without blocking apps.|
+|**Block disk modification only**|3|Untrusted apps are blocked from writing to disk sectors, and these attempts are recorded. Untrusted apps can still modify or delete files in protected folders.|
+|**Audit disk modification only**|4|Attempts by untrusted apps to write to disk sectors are recorded. Attempts to modify or delete files in protected folders aren't recorded, and no apps are blocked.|
+
+For the Windows event IDs that each mode generates, see [CFA events in Windows Event Viewer](controlled-folder-access-monitor.md#cfa-events-in-windows-event-viewer).
+
+Microsoft recommends running CFA in **Audit Mode** first to assess its effect before you move to **Enabled** (block) mode. By [monitoring audit events](controlled-folder-access-monitor.md) and [allowing the apps your users need](controlled-folder-access-configure.md), you can enable CFA without reducing productivity.
+
+The **Block disk modification only** and **Audit disk modification only** modes act only on writes to the disk sectors that store the boot record. They don't affect files in protected folders. Consider one of these modes in the following scenarios:
+
+- You want to protect the boot record from bootkits and disk-wiper malware, but full protected-folder protection blocks too many of your line-of-business apps or requires too much tuning. Disk sector writes rarely come from legitimate apps, so this protection generates few false positives.
+- You already protect user files another way (for example, OneDrive Known Folder Move with versioning, or a separate backup or anti-ransomware control), so you only need the boot record protection that CFA adds.
+- You want to limit the performance effect of evaluating file writes, especially for [shared network folders](controlled-folder-access-monitor.md#use-audit-mode-to-measure-the-effect-of-cfa).
+- You want to roll out protection in stages. For example, you can turn on **Block disk modification only** in production right away while you run protected-folder protection in **Audit Mode** and build your list of allowed apps.
+
+Use **Audit disk modification only** first to confirm that no legitimate software (for example, disk-imaging, backup, encryption, or partitioning tools) writes to disk sectors before you switch to **Block disk modification only**.
+
+Not every configuration method for CFA supports every mode. The following table shows which modes each [deployment and configuration method](#deployment-and-configuration-methods-for-cfa) supports.
+
+|Mode|Intune|Configuration Manager|Policy CSP|Group Policy|PowerShell|Windows Security app|
+|---|:---:|:---:|:---:|:---:|:---:|:---:|
+|**Disabled**|Yes|Yes|Yes|Yes|Yes|Yes|
+|**Enabled** (Block)|Yes|Yes|Yes|Yes|Yes|Yes|
+|**Audit Mode**|Yes|Yes|Yes|Yes|Yes|No|
+|**Block disk modification only**|Yes|No|Yes|Yes|Yes|No|
+|**Audit disk modification only**|Yes|No|Yes|Yes|Yes|No|
+
+The Microsoft Defender portal uses the [same endpoint security policies as Intune](endpoint-security-policies-configure.md), so it supports the same modes shown in the **Intune** column.
+
+## Deployment and configuration methods for CFA
+
+Microsoft Defender for Endpoint supports CFA but doesn't include a built-in method to deploy the settings to devices. Instead, you use a separate deployment or management tool to create and distribute CFA settings.
+
+The following table summarizes the available methods. For detailed configuration instructions, see [Configure CFA](controlled-folder-access-configure.md).
+
+|Method|Description|
+|---|---|
+|[Microsoft Intune](controlled-folder-access-configure.md#configure-cfa-in-intune-using-endpoint-security-policies)|The recommended method. Configure and deploy CFA to devices by using endpoint security policies. Requires [Microsoft Intune](/intune/intune-service/fundamentals/licenses).|
+|[Microsoft Defender portal](controlled-folder-access-configure.md#configure-cfa-in-the-microsoft-defender-portal)|Configure CFA with endpoint security policies in the Microsoft Defender portal, using the same policies as Intune. Useful when you manage endpoint security policies from the Defender portal.|
+|[Any MDM solution using the Policy CSP](controlled-folder-access-configure.md#configure-cfa-in-any-mdm-solution-using-the-policy-csp)|Use the Windows [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider) with any mobile device management (MDM) solution.|
+|[Microsoft Configuration Manager](controlled-folder-access-configure.md#configure-cfa-in-microsoft-configuration-manager)|Configure CFA in a Windows Defender Exploit Guard policy.|
+|[Group Policy](controlled-folder-access-configure.md#configure-cfa-in-group-policy)|Use centralized Group Policy to configure and deploy CFA to domain-joined devices, or configure Group Policy locally on individual devices.|
+|[PowerShell](controlled-folder-access-configure.md#enable-and-configure-cfa-in-powershell)|Configure CFA locally on individual devices.|
+|[Windows Security app](controlled-folder-access-configure.md#configure-cfa-in-the-windows-security-app)|Configure CFA locally on an individual device.|
+
+
+
+## Default folders protected by CFA
+
+By default, CFA protects the following locations on Windows devices:
+
+- Hard drive boot sectors
+- The following folders for user accounts and system accounts (for example, `LocalService`, `NetworkService`, and `systemprofile`):
+ - `C:\Users\
**NOTE**: On older versions of Windows, you might see **Windows Defender Antivirus** instead of **Microsoft Defender Antivirus**.
-
-1. Double-click **Configured protected folders**, and then set the option to **Enabled**. Select **Show**, and specify each folder that you want to protect.
-
-1. Deploy your Group Policy Object as you usually do.
-
-### Use PowerShell to protect additional folders
-
-To add protected folders by using PowerShell, follow these steps:
-
-> [!IMPORTANT]
-> Use `Add-MpPreference` to append or add apps to the list and not `Set-MpPreference`. Using the `Set-MpPreference` cmdlet will overwrite the existing list.
-
-1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**.
-
-1. Type the following PowerShell cmdlet, replacing `
|
|`-e`|Calls into [Windows Performance Recorder](/windows-hardware/test/wpt/wpr-command-line-options) to collect Defender AV Client tracing (AM-Engine and AM-Service) for analysis of Antivirus cloud connectivity issues.|When troubleshooting Cloud Protection (MAPS) reporting failures.|MsMpEng.exe|
|`-a`|Calls into [Windows Performance Recorder](/windows-hardware/test/wpt/wpr-command-line-options) to collect a verbose performance trace specific to analysis of high CPU issues related to the antivirus process (MsMpEng.exe).|When troubleshooting high cpu utilization with Microsoft Defender Antivirus (Antimalware Service Executable or MsMpEng.exe) if you already used the Microsoft Defender Antivirus [Performance Analyzer](tune-performance-defender-antivirus.md) to narrow down the /path/process or /path or file extension contributing to the high cpu utilization. This scenario enables further investigate what the application or service is doing to contribute to the high cpu utilization.|MsMpEng.exe|
-|`-v`|Uses antivirus [MpCmdRun.exe command line utility](/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) with most verbose `-Trace` flags.|Anytime an advanced troubleshooting is needed. Such as when troubleshooting Cloud Protection (MAPS) reporting failures, Platform Update failures, Engine update failures, Security Intelligence Update failures, False negatives, etc. Can also be used with `-b`, `-c`, `-h`, or `-l`.|`MsMpEng.exe`|
-|`-t`|Starts verbose trace of all client-side components relevant to Endpoint DLP, which is useful for scenarios where [DLP actions](/microsoft-365/compliance/endpoint-dlp-learn-about#endpoint-activities-you-can-monitor-and-take-action-on) aren't happening as expected for files.|When running into issues where the Microsoft Endpoint Data Loss Prevention (DLP) actions expected aren't occurring.|`MpDlpService.exe`|
+|`-v`|Uses antivirus [MpCmdRun.exe command line utility](command-line-arguments-microsoft-defender-antivirus.md) with most verbose `-Trace` flags.|Anytime an advanced troubleshooting is needed. Such as when troubleshooting Cloud Protection (MAPS) reporting failures, Platform Update failures, Engine update failures, Security Intelligence Update failures, False negatives, etc. Can also be used with `-b`, `-c`, `-h`, or `-l`.|`MsMpEng.exe`|
+|`-t`|Starts verbose trace of all client-side components relevant to Endpoint DLP, which is useful for scenarios where [DLP actions](/purview/endpoint-dlp-learn-about#endpoint-activities-you-can-monitor-and-take-action-on) aren't happening as expected for files.|When running into issues where the Microsoft Endpoint Data Loss Prevention (DLP) actions expected aren't occurring.|`MpDlpService.exe`|
|`-q`|Calls into DLPDiagnose.ps1 script from the analyzer `Tools` directory that validates the basic configuration and requirements for Endpoint DLP.|Checks the basic configuration and requirements for Microsoft Endpoint DLP|`MpDlpService.exe`|
|`-d`|Collects a memory dump of `MsSenseS.exe` (the sensor process on Windows Server 2016 or older OS) and related processes. - \* This flag can be used with above mentioned flags. - \*\* Capturing a memory dump of [PPL protected processes](/windows-hardware/drivers/install/early-launch-antimalware) such as `MsSense.exe` or `MsMpEng.exe` isn't supported by the analyzer at this time.|On Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, or Windows Server 2016 running w/ the MMA agent and having performance (high cpu or high memory usage) or application compatibility issues.|`MsSenseS.exe`|
|`-z`|Configures registry keys on the machine to prepare it for full machine memory dump collection via [CrashOnCtrlScroll](/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard). This would be useful for analysis of computer freeze issues. \* Hold down the rightmost CTRL key, then press the SCROLL LOCK key twice.|Machine hanging or being unresponsive or slow. High memory usage (Memory leak): a) User mode: Private bytes b) Kernel mode: paged pool or nonpaged pool memory, handle leaks.|`MSSense.exe` or `MsMpEng.exe`|
diff --git a/defender-endpoint/defender-antivirus-compatibility-without-mde.md b/defender-endpoint/defender-antivirus-compatibility-without-mde.md
index ec801b53209..20bba5e688b 100644
--- a/defender-endpoint/defender-antivirus-compatibility-without-mde.md
+++ b/defender-endpoint/defender-antivirus-compatibility-without-mde.md
@@ -99,7 +99,7 @@ Uninstall-WindowsFeature Windows-Defender-Gui
- [How to create and deploy antimalware policies for Endpoint Protection in Configuration Manager](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies)
- [Use Group Policy settings to configure and manage Microsoft Defender Antivirus](use-group-policy-microsoft-defender-antivirus.md)
- [Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md)
-- [Exclusions overview](navigate-defender-endpoint-antivirus-exclusions.md)
+- [Exclusions overview](defender-endpoint-exclusions-overview.md)
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
- [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
- [Run the client analyzer on Windows](run-analyzer-windows.md)
diff --git a/defender-endpoint/defender-deployment-tool-windows.md b/defender-endpoint/defender-deployment-tool-windows.md
index ab81d96f499..080a2410ad2 100644
--- a/defender-endpoint/defender-deployment-tool-windows.md
+++ b/defender-endpoint/defender-deployment-tool-windows.md
@@ -12,7 +12,7 @@ ms.collection:
- m365-security
- tier3
ms.subservice: onboard
-ms.date: 06/15/2026
+ms.date: 07/28/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -71,16 +71,18 @@ There are prerequisites that pertain to all supported Windows and Windows Server
- While the tool checks for connectivity against your specific tenant before proceeding, other connectivity requirements, such as access to the consolidated *\*.endpoint.security.microsoft.com/*\*, apply to (additional) functionality you might want to use with the product. See [Configure your network environment to ensure connectivity with the Defender for Endpoint service](./configure-environment.md).
+[!INCLUDE [Streamlined connectivity SSL inspection requirement](./includes/streamlined-connectivity-no-ssl-inspection.md)]
+
### Additional prerequisites for Windows 7 SP1 and Windows Server 2008 R2 SP1
- Devices must be running an x64 version of Windows 7 SP1 or Windows Server 2008 R2 SP1. We recommend having the latest updates installed to avoid reboots and to significantly reduce required installation time.
-- For the Defender deployment tool to run on Windows 7 SP1 or Windows Server 2008 R2 SP1, at a minimum, the update KB4474419 for [SHA2 code signing](https://support.microsoft.com/topic/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus-64d1c82d-31ee-c273-3930-69a4cde8e64f) must be installed.
+- For the Defender deployment tool to run on Windows 7 SP1 or Windows Server 2008 R2 SP1, at a minimum, the update KB4474419 for [SHA2 code signing](https://support.microsoft.com/servicing/os/windows/2020/09/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus) must be installed.
- - Servicing stack update (SSU) ([KB4490628](https://support.microsoft.com/help/4490628)). If you use Windows Update, the required SSU is offered to you automatically.
+ - Servicing stack update (SSU) ([KB4490628](https://support.microsoft.com/topic/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1-march-12-2019-b4dc0cff-d4f2-a408-0cb1-cb8e918feeba)). If you use Windows Update, the required SSU is offered to you automatically.
- - SHA-2 update ([KB4474419](https://support.microsoft.com/help/4474419)) released September 10, 2019. If you use Windows Update, the required SHA-2 update is offered to you automatically.
+ - SHA-2 update ([KB4474419](https://support.microsoft.com/topic/sha-2-code-signing-support-update-for-windows-server-2008-r2-windows-7-and-windows-server-2008-september-23-2019-84a8aad5-d8d9-2d5c-6d78-34f9aa5f8339)) released September 10, 2019. If you use Windows Update, the required SHA-2 update is offered to you automatically.
- On Server 2008 R2 SP1 devices, .NET 3.5 or a higher version of the .NET framework must also be installed.
diff --git a/defender-endpoint/defender-endpoint-demonstration-app-reputation.md b/defender-endpoint/defender-endpoint-demonstration-app-reputation.md
index 901cb75ef1e..228842458fb 100644
--- a/defender-endpoint/defender-endpoint-demonstration-app-reputation.md
+++ b/defender-endpoint/defender-endpoint-demonstration-app-reputation.md
@@ -73,7 +73,7 @@ This download is known malware; SmartScreen should block this program from runni
## Learn more
-[Microsoft Defender SmartScreen Documentation](/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview)
+[Microsoft Defender SmartScreen Documentation](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)
## See also
diff --git a/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md b/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md
index f4b61c79637..b1554780a9e 100644
--- a/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md
+++ b/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md
@@ -12,8 +12,8 @@ ms.collection:
- demo
ms.topic: how-to
ms.subservice: asr
-ms.custom: msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: msecd-doc-authoring-1015
+ms.date: 08/12/2026
ai-usage: ai-assisted
appliesto:
- Microsoft Defender for Endpoint Plan 1
@@ -36,6 +36,8 @@ ASR rules target risky software behavior on Windows devices that attackers commo
## Prerequisites
+Before you begin, make sure your test device meets the following requirements:
+
- Windows 10, version 1709 (October 2017) or later.
- Microsoft Defender Antivirus enabled and in active mode.
@@ -81,8 +83,10 @@ For the full list of requirements, supported operating systems, and modes, see [
- Enables the [demonstration ASR rules](#asr-rules-in-this-demonstration) in **Enabled** (block) mode.
- Adds `c:\demo` to the CFA protected folders list (without affecting your other protected folders).
- > [!NOTE]
- > The setup and cleanup scripts adjust CFA because they're shared with the [CFA block app](defender-endpoint-demonstration-controlled-folder-access-test-tool.md) and [CFA ransomware](defender-endpoint-demonstration-controlled-folder-access.md) demonstrations. None of the ASR rule scenarios in this article use CFA. The setup script adds `c:\demo` to the CFA protected folders list but doesn't enable CFA, so the entry has no effect on this demonstration. The cleanup script disables CFA, so before you run the setup script, check your current [CFA mode](controlled-folders.md) and note the value so that you can [restore it during cleanup](#clean-up-the-demonstration):
+ > [!IMPORTANT]
+ > The setup script adds `c:\demo` to the Microsoft Defender Antivirus exclusion list. Don't run ASR test files from `c:\demo` or one of its subfolders when you're testing for an ASR block or detection. ASR rules that honor Microsoft Defender Antivirus exclusions, including **Use advanced protection against ransomware**, might not generate the expected block or detection. Before you run a test file, copy it to a folder that isn't excluded from Microsoft Defender Antivirus or ASR rules. For more information, see [File and folder exclusions for ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules).
+ >
+ > The setup and cleanup scripts adjust CFA because they're shared with the [CFA block app](defender-endpoint-demonstration-controlled-folder-access-block-app.md) and [CFA ransomware](defender-endpoint-demonstration-controlled-folder-access-ransomware.md) demonstrations. None of the ASR rule scenarios in this article use CFA. The setup script adds `c:\demo` to the CFA protected folders list but doesn't enable CFA, so the entry has no effect on this demonstration. The cleanup script disables CFA, so before you run the setup script, check your current [CFA mode](controlled-folder-access-overview.md#modes-for-cfa) and note the value so that you can restore it in the [Clean up the demonstration](#clean-up-the-demonstration) section:
>
> ```powershell
> Get-MpPreference | Format-List EnableControlledFolderAccess
@@ -92,7 +96,7 @@ For the full list of requirements, supported operating systems, and modes, see [
1. Create the folder `c:\demo`.
- 1. Add `c:\demo` to the Microsoft Defender Antivirus exclusion list so that real-time protection doesn't quarantine the test files before the ASR rules evaluate them. Run the following command in an elevated PowerShell window:
+ 1. Add `c:\demo` to the Microsoft Defender Antivirus exclusion list so that real-time protection doesn't quarantine the test files while you download and extract them. Run the following command in an elevated PowerShell window:
```powershell
Add-MpPreference -ExclusionPath C:\demo
@@ -110,7 +114,7 @@ For the full list of requirements, supported operating systems, and modes, see [
The ASR rule names and associated GUID values are listed in the [ASR rules in this demonstration](#asr-rules-in-this-demonstration) section.
-1. Download and extract the mode scripts from
folder](#automation-folder-exclusions)|[Automatic
server role](#automatic-server-role-exclusions)|
+|---|:---:|:---:|:---:|:---:|:---:|:---:|
+|**Enterprise management**|||||||
+|Microsoft Intune admin center|Yes|Yes|Yes|Yes|No|No|
+|Microsoft Defender portal|Yes|Yes|Yes|Yes|Yes|No|
+|Microsoft Configuration Manager|Yes|Yes|No|Yes|No|No|
+|Policy CSP|Yes|Yes|No|Yes|No|No|
+|GPO|Yes|Yes|Yes|Yes|No|Yes|
+|**Local configuration**|||||||
+|PowerShell|Yes|Yes|No|Yes|No|Yes|
+|WMI|Yes|No|No|No|No|Yes|
+|Windows Security app|Yes|No|No|Yes|No|No|
+
+The following sections show how to configure each exclusion type with each management tool.
+
+### Custom antivirus exclusions
+
+For more information about custom exclusions in Microsoft Defender Antivirus, see [Exclusions in Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-overview.md).
+
+The following list shows how to manage this exclusion type with each management tool:
+
+- **Enterprise management**:
+ - **Microsoft Intune admin center**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in Microsoft Intune](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-microsoft-intune).
+ - **Microsoft Defender portal**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in the Microsoft Defender portal](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-the-microsoft-defender-portal).
+ - **Microsoft Configuration Manager**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in Microsoft Configuration Manager](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-microsoft-configuration-manager).
+ - **Policy CSP**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in any MDM solution using the Policy CSP](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-any-mdm-solution-using-the-policy-csp).
+ - **GPO**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in Group Policy](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-group-policy).
+- **Local configuration**:
+ - **PowerShell**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in PowerShell](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-powershell).
+ - **WMI**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in WMI](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-wmi).
+ - **Windows Security app**: For instructions, see [Configure Microsoft Defender Antivirus exclusions in the Windows Security app](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-the-windows-security-app).
+
+> [!NOTE]
+> The Windows Security app doesn't support [contextual exclusions](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions).
+>
+> Exclusion changes you make in Group Policy appear in the Windows Security app, but changes you make in the Windows Security app don't appear in Group Policy.
+
+### Attack surface reduction rule global exclusions
+
+For more information about global attack surface reduction (ASR) rule exclusions, see [File and folder exclusions for ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules).
+
+The following list shows how to manage this exclusion type with each management tool:
+
+- **Enterprise management**:
+ - **Microsoft Intune admin center**: For instructions, see [Configure ASR rules and exclusions in Intune using endpoint security policies](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies).
+ - **Microsoft Defender portal**: For instructions, see [Configure ASR rules and exclusions in the Microsoft Defender portal](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-the-microsoft-defender-portal).
+ - **Microsoft Configuration Manager**: For instructions, see [Configure ASR rules and global ASR rule exclusions in Microsoft Configuration Manager](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-global-asr-rule-exclusions-in-microsoft-configuration-manager).
+ - **Policy CSP**: For instructions, see [Configure global ASR rule exclusions in any MDM solution using the Policy CSP](attack-surface-reduction-rules-configure.md#configure-global-asr-rule-exclusions-in-any-mdm-solution-using-the-policy-csp).
+ - **GPO**: For instructions, see [Configure global ASR rule exclusions in group policy](attack-surface-reduction-rules-configure.md#configure-global-asr-rule-exclusions-in-group-policy).
+- **Local configuration**:
+ - **PowerShell**: For instructions, see [Configure global ASR rule exclusions in PowerShell](attack-surface-reduction-rules-configure.md#configure-global-asr-rule-exclusions-in-powershell).
+ - **WMI**: Not supported.
+ - **Windows Security app**: Not supported.
+
+### Per-ASR rule exclusions
+
+For more information about per-ASR rule exclusions, see [File and folder exclusions for ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules).
+
+The following list shows how to manage this exclusion type with each management tool:
+
+- **Enterprise management**:
+ - **Microsoft Intune admin center**: For instructions, see [Configure ASR rules and exclusions in Intune using endpoint security policies](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies).
+ - **Microsoft Defender portal**: For instructions, see [Configure ASR rules and exclusions in the Microsoft Defender portal](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-the-microsoft-defender-portal).
+ - **Microsoft Configuration Manager**: Not supported.
+ - **Policy CSP**: Not supported.
+ - **GPO**: For instructions, see [Configure per-ASR rule exclusions in group policy](attack-surface-reduction-rules-configure.md#configure-per-asr-rule-exclusions-in-group-policy).
+- **Local configuration**:
+ - **PowerShell**: Not supported.
+ - **WMI**: Not supported.
+ - **Windows Security app**: Not supported.
+
+### Controlled folder access exclusions
+
+For more information about controlled folder access (CFA) exclusions, see [Allow apps to modify files in protected folders](controlled-folder-access-overview.md#allow-apps-to-modify-files-in-protected-folders).
+
+The following list shows how to manage this exclusion type with each management tool:
+
+- **Enterprise management**:
+ - **Microsoft Intune admin center**: For instructions, see [Configure CFA in Intune using endpoint security policies](controlled-folder-access-configure.md#configure-cfa-in-intune-using-endpoint-security-policies).
+ - **Microsoft Defender portal**: For instructions, see [Configure CFA in the Microsoft Defender portal](controlled-folder-access-configure.md#configure-cfa-in-the-microsoft-defender-portal).
+ - **Microsoft Configuration Manager**: For instructions, see [Configure CFA in Microsoft Configuration Manager](controlled-folder-access-configure.md#configure-cfa-in-microsoft-configuration-manager).
+ - **Policy CSP**: For instructions, see [Allow apps to modify files in protected folders using the Policy CSP](controlled-folder-access-configure.md#allow-apps-to-modify-files-in-protected-folders-using-the-policy-csp).
+ - **GPO**: For instructions, see [Allow apps to modify files in protected folders in Group Policy](controlled-folder-access-configure.md#allow-apps-to-modify-files-in-protected-folders-in-group-policy).
+- **Local configuration**:
+ - **PowerShell**: For instructions, see [Allow apps to modify files in protected folders in PowerShell](controlled-folder-access-configure.md#allow-apps-to-modify-files-in-protected-folders-in-powershell).
+ - **WMI**: Not supported.
+ - **Windows Security app**: For instructions, see [Allow apps to modify files in protected folders in the Windows Security app](controlled-folder-access-configure.md#allow-apps-to-modify-files-in-protected-folders-in-the-windows-security-app).
+
+### Automation folder exclusions
+
+An automated exclusion entry identifies the folder and (optionally) specific files within that folder to exclude from [automated investigation and remediation](automated-investigations.md). For more information, see [Automation folder exclusions](defender-endpoint-exclusions-overview.md#automation-folder-exclusions).
+
+The following list shows how to manage this exclusion type with each management tool:
+
+- **Enterprise management**:
+ - **Microsoft Intune admin center**: Not supported.
+ - **Microsoft Defender portal**: For instructions, see [Configure automation folder exclusions](automation-folder-exclusions-configure.md).
+ - **Microsoft Configuration Manager**: Not supported.
+ - **Policy CSP**: Not supported.
+ - **GPO**: Not supported.
+- **Local configuration**:
+ - **PowerShell**: Not supported.
+ - **WMI**: Not supported.
+ - **Windows Security app**: Not supported.
+
+### Automatic server role exclusions
+
+Automatic server role exclusions apply to Microsoft Defender Antivirus on Windows Server 2016 and later. For more information, see [Automatic server role exclusions](microsoft-defender-antivirus-exclusions-windows-server.md#automatic-server-role-exclusions).
+
+The following list shows how to manage this exclusion type with each management tool:
+
+- **Enterprise management**:
+ - **Microsoft Intune admin center**: Not supported.
+ - **Microsoft Defender portal**: Not supported.
+ - **Microsoft Configuration Manager**: Not supported.
+ - **Policy CSP**: Not supported.
+ - **GPO**: For instructions, see [Disable automatic exclusions in Group Policy](microsoft-defender-antivirus-exclusions-windows-server.md#disable-automatic-exclusions-in-group-policy).
+- **Local configuration**:
+ - **PowerShell**: For instructions, see [Disable automatic exclusions in PowerShell](microsoft-defender-antivirus-exclusions-windows-server.md#disable-automatic-exclusions-in-powershell).
+ - **WMI**: For instructions, see [Disable automatic exclusions in WMI](microsoft-defender-antivirus-exclusions-windows-server.md#disable-automatic-exclusions-in-wmi).
+ - **Windows Security app**: Not supported.
+
+**Learn more**:
+
+- [Use Microsoft Defender for Endpoint Security Settings Management to manage Microsoft Defender Antivirus](/intune/intune-service/protect/mde-security-integration)
+- [Create Microsoft Defender antivirus exclusion policies in Intune](microsoft-defender-antivirus-exclusions-configure.md#configure-microsoft-defender-antivirus-exclusions-in-microsoft-intune)
+- [Add automatic folder exclusions](automation-folder-exclusions-configure.md#add-an-automation-folder-exclusion)
+- [Defender CSP](/windows/client-management/mdm/defender-csp)
+- [Defender Policy CSP](/windows/client-management/mdm/policy-csp-defender)
+- [Use custom settings for Windows client devices in Intune](/intune/intune-service/configuration/custom-settings-windows-10)
+- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)
+
+## Manage exclusions for Linux
+
+You can exclude files, folders, processes, and process-opened files from Defender for Endpoint on Linux. For more information, see [Custom exclusions on Linux](defender-endpoint-exclusions-overview.md#custom-exclusions).
+
+For configuration instructions, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md).
+
+## Manage exclusions for macOS
+
+You can exclude files, folders, processes, and process-opened files from Defender for Endpoint on macOS. For more information, see [Custom exclusions on macOS](defender-endpoint-exclusions-overview.md#custom-exclusions).
+
+For configuration instructions, see [Configure and validate exclusions for Microsoft Defender for Endpoint on macOS](mac-exclusions.md).
+
+## See also
+
+- [Add exclusions to network protection](troubleshoot-np.md#add-exclusions)
+- [Important points about exclusions](microsoft-defender-antivirus-exclusions-overview.md#important-points-about-exclusions)
diff --git a/defender-endpoint/defender-endpoint-exclusions-overview.md b/defender-endpoint/defender-endpoint-exclusions-overview.md
new file mode 100644
index 00000000000..871c8ada53b
--- /dev/null
+++ b/defender-endpoint/defender-endpoint-exclusions-overview.md
@@ -0,0 +1,242 @@
+---
+title: Overview of exclusions and indicators in Microsoft Defender for Endpoint
+description: Learn when to use exclusions versus allow indicators in Microsoft Defender for Endpoint and Microsoft Defender Antivirus, and which alternatives to try before you create them.
+ms.service: defender-endpoint
+ms.subservice: ngp
+ms.localizationpriority: medium
+ms.topic: how-to
+author: chrisda
+ms.author: chrisda
+ms.custom: nextgen, msecd-doc-authoring-1015
+ms.date: 07/02/2026
+ms.reviewer: joshbregman
+ms.collection:
+- m365-security
+- tier2
+- mde-ngp
+ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to understand the difference between exclusions and allow indicators so that I can resolve false positives and performance issues without weakening protection.
+appliesto:
+ - Microsoft Defender Antivirus
+ - Microsoft Defender for Endpoint on macOS
+ - Microsoft Defender for Endpoint on Linux
+---
+
+# Overview of exclusions and indicators in Microsoft Defender for Endpoint
+
+[Microsoft Defender for Endpoint](microsoft-defender-endpoint.md) and [Defender for Business](/defender-business/mdb-overview) include a wide range of capabilities to prevent, detect, investigate, and respond to advanced cyberthreats. Microsoft preconfigures the product to perform well on the operating system where it's installed. In most cases, no other changes are needed.
+
+Despite preconfigured settings, sometimes unexpected behavior occurs. For example:
+
+- **False positives**: Files, folders, or processes that aren't threats are detected as malicious by Defender for Endpoint or Microsoft Defender Antivirus. These entities are blocked or sent to quarantine, even though they're not a threat.
+- **Performance issues**: Systems experience unexpected performance issues when running with Defender for Endpoint or Microsoft Defender Antivirus.
+- **Application compatibility issues**: Applications experience unexpected behavior when running with Defender for Endpoint or Microsoft Defender Antivirus.
+
+The following sections describe the types of exclusions available in Defender for Endpoint and Microsoft Defender Antivirus, along with when to use each one. For a summary of which management tools you can use to configure each exclusion type, see [Exclusions reference for Microsoft Defender for Endpoint](defender-endpoint-exclusions-configuration-reference.md).
+
+> [!NOTE]
+> Creating exclusions or indicators is one possible approach for addressing issues with Defender for Endpoint or Microsoft Defender Antivirus, but often there are [other steps you can take first](#alternatives-and-steps-to-consider-before-you-create-an-exclusion).
+
+## Types of exclusions
+
+There are several types of exclusions to consider. Some types of exclusions affect multiple capabilities in Defender for Endpoint, whereas other types are specific to Microsoft Defender Antivirus.
+
+For information about indicators, which are a related but separate mechanism for allowing or blocking specific files, IP addresses, URLs, and certificates, see [Overview of indicators in Microsoft Defender for Endpoint](indicators-overview.md).
+
+The following tables summarize the types of exclusions you can define, grouped by whether they're available on all platforms or on Windows only. Note the scope for each exclusion type.
+
+- **Cross-platform exclusions**: These exclusions are available on Windows, macOS, and Linux devices.
+
+ |Exclusion type|Scope|Use cases|
+ |---|---|---|
+ |[Custom exclusions](#custom-exclusions)|Antivirus
Attack surface reduction (ASR) rules
Network Protection|A file, folder, or process is identified as malicious, even though it's not a threat.
An application encounters unexpected performance or application compatibility issues when running with Defender for Endpoint.
In Windows, [some ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules) honor Microsoft Defender Antivirus file and folder (path) exclusions.|
+ |[File and certificate allow indicators](indicator-certificates.md)|Antivirus
ASR rules
Controlled folder access (CFA)|A file or process signed by a certificate is identified as malicious even though it's not.|
+ |[Domain/URL and IP address indicators](indicator-ip-domain.md)|Network Protection
SmartScreen
Web Content Filtering|SmartScreen reports a false positive.
You want to override a Web Content Filtering block on a specific site.|
+
+- **Windows-only exclusions**: These exclusions are available on Windows devices only.
+
+ |Exclusion type|Scope|Use cases|
+ |---|---|---|
+ |[Preconfigured antivirus exclusions](#preconfigured-antivirus-exclusions)|Antivirus|Microsoft Defender Antivirus automatically excludes some operating system files and Windows Server roles, so you don't have to define these exclusions yourself.|
+ |[ASR rule exclusions](#attack-surface-reduction-rule-exclusions)|ASR rules|An ASR rule causes unexpected behavior.|
+ |[Automation folder exclusions](#automation-folder-exclusions)|Automated investigation and response|Automated investigation and remediation takes an action on a file, extension, or directory that should be handled manually.|
+ |[CFA exclusions](#controlled-folder-access-exclusions)|CFA|CFA blocks an application from accessing a protected folder.|
+
+> [!NOTE]
+> Process exclusions directly affect [network protection](network-protection.md) on all platforms and ASR rules in Windows. A process exclusion on any operating system (Windows, macOS, or Linux) prevents network protection from inspecting traffic or enforcing rules for that specific process.
+
+
+
+### Preconfigured antivirus exclusions
+
+You don't have to define these exclusion types, but it's helpful to know what they are and how they work. Microsoft Defender Antivirus preconfigures the following exclusion types:
+
+
+
+- **Built-in Microsoft Defender Antivirus exclusions**:
+ - Microsoft Defender Antivirus includes built-in exclusions for operating system files on all supported client and server versions of Windows. The list is kept up to date as the threat landscape changes. For more information, see [Built-in exclusions](microsoft-defender-antivirus-exclusions-overview.md#built-in-exclusions).
+ - On supported versions of Windows Server, more built-in exclusions apply to server features such as Windows Internet Name Service (WINS) and File Replication Service (FRS). For more information, see [Built-in exclusions on Windows Server](microsoft-defender-antivirus-exclusions-windows-server.md#built-in-exclusions).
+
+
+
+- **Automatic Microsoft Defender Antivirus exclusions**: Automatic exclusions for server roles and features in Windows Server 2016 or later (for example, File Replication Service, Hyper-V, SYSVOL, Active Directory, and DNS Server). When you install a role, Microsoft Defender Antivirus includes automatic exclusions for the server role and any files that are added while installing the role.
+
+ These exclusions aren't scanned by [real-time protection](configure-protection-features-microsoft-defender-antivirus.md) but are still subject to [quick, full, or custom antivirus scans](schedule-antivirus-scans.md#comparing-the-quick-scan-full-scan-and-custom-scan).
+
+ For more information, see [Automatic server role exclusions](microsoft-defender-antivirus-exclusions-windows-server.md#automatic-server-role-exclusions).
+
+ Automatic exclusions apply only to built-in Windows Server roles. If you run other server workloads, such as Exchange Server, SharePoint Server, or SQL Server, you likely need to define custom antivirus exclusions for them. For more information, see the following articles:
+
+ - [Running Windows antivirus software on Exchange Server](/exchange/antispam-and-antimalware/windows-antivirus-software)
+ - [Folders to exclude from antivirus scans on SharePoint Server](https://support.microsoft.com/SharePoint/admin/certain-folders-may-have-to-be-excluded-from-antivirus-scanning-when-you-use-file-level-antivirus-so)
+ - [Configure antivirus software to work with SQL Server](/troubleshoot/sql/database-engine/security/antivirus-and-sql-server)
+
+ You can also refer to the software publisher's documentation.
+
+### Custom exclusions
+
+Microsoft Defender for Endpoint and Microsoft Defender Antivirus let you configure custom exclusions to optimize performance and avoid false positives. The custom exclusions you can define vary by operating system.
+
+- **macOS**: You can define exclusions that apply to antivirus scanning only (on-demand scans, real-time protection, and monitoring). These exclusions don't apply to endpoint detection and response (EDR), so excluded files can still trigger EDR alerts and other detections. The supported exclusion types include:
+ - **File extension exclusions**: Exclude all files with a specific extension.
+ - **File exclusions**: Exclude a specific file identified by its full path.
+ - **Folder exclusions**: Exclude all files under a specified folder recursively.
+ - **Process exclusions**: Exclude a specific process and all files opened by it.
+
+ For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on macOS](mac-exclusions.md).
+
+- **Linux**: You can configure exclusions as _antivirus exclusions_ (applied to real-time protection, on-demand scans, and behavior monitoring, while keeping EDR visibility) or as _global exclusions_ (applied at the sensor level, muting both antivirus detections and EDR alerts). The supported exclusion types include:
+ - **File extension exclusions**: Exclude all files with a specific extension (not available for global exclusions).
+ - **File exclusions**: Exclude a specific file identified by its full path.
+ - **Folder exclusions**: Exclude all files under a specified folder recursively.
+ - **Process exclusions**: Exclude a specific process (by full path or file name) and all files opened by it.
+
+ For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md).
+
+- **Windows**: You can configure Microsoft Defender Antivirus to exclude combinations of processes, files, folders (paths), and extensions from scheduled scans, on-demand scans, real-time protection, and potentially unwanted app (PUA) detections. These exclusions apply to antivirus scanning only. They don't apply to EDR, so excluded files can still trigger EDR alerts. To exclude files for all Defender for Endpoint capabilities, use [custom indicators](indicators-overview.md). The supported exclusion types include:
+ - **File and folder exclusions**: Exclude a specific file or everything in a folder. Also known as _path exclusions_.
+ - **File extension exclusions**: Exclude any file that has a specific extension, regardless of location.
+ - **Process exclusions**: Exclude all files that a specific process opens.
+ - **Contextual exclusions**: Narrow a path exclusion so that it applies only in a specific context, such as only when a specific process opens the file.
+
+ For more information, see [Exclusions in Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-overview.md).
+
+### Attack surface reduction rule exclusions
+
+[Attack surface reduction (ASR) rules](attack-surface-reduction-rules-overview.md) block risky software behavior, but some legitimate apps engage in this risky behavior (for example, launching executable files that download and run other files). Some ASR rules honor Microsoft Defender Antivirus exclusions. ASR rules also support global ASR rule exclusions and per-ASR rule exclusions.
+
+For more information, see [File and folder exclusions for ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules).
+
+### Automation folder exclusions
+
+Automation folder exclusions apply to [automated investigation and remediation](automated-investigations.md) in Microsoft Defender for Endpoint Plan 2, which examines alerts and takes immediate action to resolve detected breaches. When an alert triggers an automated investigation, the investigation reaches a verdict (Malicious, Suspicious, or No threats found) for each piece of evidence. Depending on the [automation level](automation-levels.md) and other security settings, remediation actions occur automatically or after your security operations team approves them.
+
+For more information, see [Manage automation folder exclusions](automation-folder-exclusions-configure.md).
+
+### Controlled folder access exclusions
+
+[Controlled folder access (CFA)](controlled-folder-access-overview.md) protects your data by blocking untrusted apps from changing files in [protected folders](controlled-folder-access-overview.md#default-folders-protected-by-cfa) on Windows devices. By default, CFA protects common system folders, and you can [add other folders](controlled-folder-access-overview.md#add-other-folders-to-cfa). If CFA blocks an app that you trust, you can define an exclusion to [allow the app to modify files in protected folders](controlled-folder-access-overview.md#allow-apps-to-modify-files-in-protected-folders).
+
+For more information, see [Configure controlled folder access](controlled-folder-access-configure.md).
+
+### Custom remediation actions
+
+When Microsoft Defender Antivirus detects a potential threat while running a scan, it attempts to remediate or remove the detected threat. You can define custom remediation actions to configure how Microsoft Defender Antivirus should address certain threats, whether a restore point should be created before remediating, and when threats should be removed.
+
+For more information, see [Configure remediation actions for Microsoft Defender Antivirus detections](configure-remediation-microsoft-defender-antivirus.md).
+
+## How exclusions and indicators are evaluated
+
+Most organizations have several types of exclusions and indicators to determine whether users should be able to access and use a file or process. On Windows devices, these exclusions and indicators are processed in a particular order so that [policy conflicts are handled systematically](indicator-file.md#policy-conflict-handling).
+
+Here's how it works. Evaluation stops at the first condition that applies:
+
+1. If the file isn't allowed by Windows Defender Application Control and AppLocker enforce mode policies, it's **blocked**.
+1. Otherwise, if the file is allowed by a Microsoft Defender Antivirus exclusion, it's **allowed**.
+1. Otherwise, if the file has a block or warn file indicator, it's **blocked or warned**.
+1. Otherwise, if the file is blocked by SmartScreen, it's **blocked**.
+1. Otherwise, if the file is allowed by an allow file indicator, it's **allowed**.
+1. Otherwise, if the file is blocked by attack surface reduction rules, controlled folder access, or antivirus protection, it's **blocked**.
+1. Otherwise, the file is **allowed**.
+
+### How policy conflicts are handled
+
+In cases where Defender for Endpoint indicators conflict, here's what to expect:
+
+- If there are conflicting file indicators, the indicator that uses the most secure hash is applied. For example, SHA256 takes precedence over SHA-1, which takes precedence over MD5.
+
+- If there are conflicting URL indicators, the more specific indicator is used.
+ - For [Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/), an indicator that uses the longest URL path is applied. For example, `www.contoso.com/admin/` takes precedence over `www.contoso.com`.
+ - [Network protection](network-protection.md) primarily enforces at the domain level, although it can block specific URL paths in some scenarios.
+
+- If there are similar indicators for a file or process that have different actions, the indicator that is scoped to a specific device group takes precedence over an indicator that targets all devices.
+
+
+
+### How automated investigation and remediation works
+
+[Automated investigation and remediation capabilities](automated-investigations.md) in Defender for Endpoint first determine a verdict for each piece of evidence, and then take an action depending on Defender for Endpoint indicators. As a result, a file or process could get a verdict of "good" (which means no threats were found) and still be blocked if there's an indicator with that action. Similarly, an entity could get a verdict of "bad" (which means it's determined to be malicious) and still be allowed if there's an indicator with that action.
+
+For more information, see [Automated investigation and remediation engine](indicators-overview.md#automated-investigation-and-remediation-engine).
+
+## Alternatives and steps to consider before you create an exclusion
+
+Creating an exclusion or an allow indicator creates a protection gap. Use these techniques only after you determine the root cause of the issue. Until then, consider alternatives such as [submitting a file to Microsoft for analysis](#submit-files-for-analysis) or [suppressing an alert](#suppress-alerts).
+
+The following list describes common scenarios and the steps to consider before creating an exclusion or allow indicator.
+
+- **[False positive](defender-endpoint-false-positives-negatives.md)**: An entity, such as a file or a process, was detected and identified as malicious, even though the entity isn't a threat. Steps to consider:
+ 1. [Review and classify alerts](defender-endpoint-false-positives-negatives.md#part-1-review-and-classify-alerts) that were generated as a result of the detected entity.
+ 1. [Suppress an alert](#suppress-alerts) for a known entity.
+ 1. [Review remediation actions](defender-endpoint-false-positives-negatives.md#part-2-review-remediation-actions) that were taken for the detected entity.
+ 1. [Submit the false positive to Microsoft](#submit-files-for-analysis) for analysis.
+ 1. [Define an indicator or an exclusion](defender-endpoint-false-positives-negatives.md#part-3-review-or-define-exclusions) for the entity (only if necessary).
+
+- **[Performance issues](troubleshoot-performance-issues.md)**. For example:
+ - A system has high CPU usage or other performance issues.
+ - A system has memory leak issues.
+ - An app is slow to load on devices.
+ - An app is slow to open a file on devices.
+
+ Steps to consider:
+
+ 1. [Collect diagnostic data](collect-diagnostic-data.md) for Microsoft Defender Antivirus.
+ 1. If you're using a non-Microsoft antivirus solution, [check with the vendor for known issues with antivirus products](troubleshoot-performance-issues.md#check-with-the-vendor-for-known-issues-with-antivirus-products).
+ 1. Review performance logs (see [Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI](troubleshoot-av-performance-issues-with-wprui.md)) to determine the estimated performance impact. For performance-specific issues related to Microsoft Defender Antivirus, use the [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).
+ 1. [Define an exclusion for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-overview.md) (if necessary).
+ 1. [Create an indicator for Defender for Endpoint](indicators-overview.md) (only if necessary).
+
+- **[Compatibility issues with non-Microsoft antivirus products](microsoft-defender-antivirus-compatibility.md)**. For example, Defender for Endpoint relies on security intelligence updates for devices, whether they're running Microsoft Defender Antivirus or a non-Microsoft antivirus solution. Steps to consider:
+ 1. If you're using a non-Microsoft antivirus product as your primary antivirus/antimalware solution, [set Microsoft Defender Antivirus to passive mode](microsoft-defender-antivirus-compatibility.md#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode).
+ 1. If you're switching from a non-Microsoft antivirus/antimalware solution to Defender for Endpoint, see [Make the switch to Defender for Endpoint](switch-to-mde-overview.md). This guidance includes [Exclusions you might need to define for Microsoft Defender Antivirus](switch-to-mde-phase-2.md#step-4-add-your-existing-solution-to-the-exclusion-list-for-microsoft-defender-antivirus) and [Troubleshooting information](switch-to-mde-troubleshooting.md) (just in case something goes wrong while migrating).
+
+- **Compatibility with applications**. For example, applications are crashing or experiencing unexpected behaviors after a device is onboarded to Microsoft Defender for Endpoint. See [Address unwanted behaviors in Microsoft Defender for Endpoint with exclusions, indicators, and other techniques](address-unwanted-behaviors-mde.md).
+
+
+
+### Submit files for analysis
+
+If you have a file that you think is wrongly detected as malware (a false positive), or a file that you suspect might be malware even though it wasn't detected (a false negative), you can submit the file to Microsoft for analysis. Your submission is scanned immediately and then reviewed by Microsoft security analysts. You can check the status of your submission on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory).
+
+Submitting files for analysis helps reduce false positives and false negatives for all customers. For more information, see the following articles:
+
+- [Submit files for analysis](/unified-secops/submission-guide)
+- [Submit files in the Microsoft Defender portal](admin-submissions-mde.md) (Defender for Endpoint Plan 2 or Microsoft Defender XDR only)
+
+### Suppress alerts
+
+If you're getting alerts in the Microsoft Defender portal for tools or processes that you know aren't actually a threat, you can suppress those alerts.
+
+To suppress an alert, you create a suppression rule and specify what actions to take for that alert on other identical alerts. You can create suppression rules for a specific alert on a single device, or for all alerts that have the same title in your organization.
+
+For more information, see the following articles:
+
+- [Suppress alerts](/defender-xdr/investigate-alerts?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json#built-in-alert-tuning-rules)
+- [Tech Community Blog: Introducing the new alert suppression experience](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719) (for Defender for Endpoint)
+
+## See also
+
+- [Address common false-positive scenarios with exclusions](address-unwanted-behaviors-mde.md)
+- [Configure exclusions for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-configure.md)
+- [Exclusions to avoid in Microsoft Defender Antivirus and Defender for Endpoint](defender-endpoint-exclusions-common-mistakes.md)
+- [Overview of indicators in Microsoft Defender for Endpoint](indicators-overview.md)
diff --git a/defender-endpoint/defender-endpoint-false-positives-negatives.md b/defender-endpoint/defender-endpoint-false-positives-negatives.md
index df1d6bef1fc..6567dc3045f 100644
--- a/defender-endpoint/defender-endpoint-false-positives-negatives.md
+++ b/defender-endpoint/defender-endpoint-false-positives-negatives.md
@@ -1,12 +1,12 @@
---
title: Address false positives/negatives in Microsoft Defender for Endpoint
-description: Learn how to handle false positives or false negatives in Microsoft Defender for Endpoint.
+description: Learn how to identify, investigate, and resolve false positives and false negatives in Microsoft Defender for Endpoint, including submissions and exclusions.
ms.service: defender-endpoint
ms.subservice: ngp
ms.author: chrisda
author: chrisda
ms.localizationpriority: medium
-ms.date: 10/20/2025
+ms.date: 07/29/2026
ms.collection:
- m365-security
- m365initiative-defender-endpoint
@@ -20,6 +20,8 @@ ms.custom:
- FPFN
- admindeeplinkDEFENDER
- sfi-image-nochange
+ - msecd-doc-authoring-1015
+ai-usage: ai-assisted
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -44,9 +46,9 @@ When you have a false positive, a good first step is to try to determine its det
|Detection source| Information|
| -------- | -------- |
|Endpoint Detection and Response (EDR) | The alert is related to EDR in Defender for Endpoint
- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
- Work-around: Add an EDR exclusion or tune the alerts|
-|Antivirus|The alert relates to Microsoft Defender Antivirus in active mode (primary) where it blocks.
- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
- Work-around: Add [Indicators - File hash - allow ](indicator-file.md) or an [Antivirus exclusion](navigate-defender-endpoint-antivirus-exclusions.md)
If Microsoft Defender Antivirus is in passive mode, EDR in block mode might just detect.|
-| Custom TI| Custom indicators:
- [File hash](indicator-file.md)
- [IP address or URL](indicator-ip-domain.md)
- [Certificates](indicator-certificates.md)
Solution: [Manage indicators](indicator-manage.md).
Or, if you see `CustomEnterpriseBlock`, your detection source could be one of the following capabilities in Defender for Endpoint:
1. [Automated investigation and remediation](automated-investigations.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Automation folder exclusions ](manage-automation-folder-exclusions.md)
2. Custom detection rules deriving from [Advanced Hunting](/defender-xdr/advanced-hunting-overview)
-- Solution: [Manage existing custom detection rules ](/defender-xdr/custom-detection-rules)
3. [EDR in block mode](edr-in-block-mode.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Indicators – File hash – allow](indicator-file.md) or [Antivirus exclusions](navigate-defender-endpoint-antivirus-exclusions.md)
4. [Live response](live-response.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Indicators – File hash – allow](indicator-file.md) or [Antivirus exclusions](navigate-defender-endpoint-antivirus-exclusions.md)
5. [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Indicators – File hash – allow](indicator-file.md) or [Antivirus exclusions](navigate-defender-endpoint-antivirus-exclusions.md)|
-| Smartscreen|[Smartscreen](https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx): You can [Report an unsafe site](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site) or [submit a network protection detection](https://www.microsoft.com/wdsi/support/report-exploit-guard)|
+|Antivirus|The alert relates to Microsoft Defender Antivirus in active mode (primary) where it blocks.
- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
- Work-around: Add [Indicators - File hash - allow ](indicator-file.md) or an [Antivirus exclusion](defender-endpoint-exclusions-overview.md)
If Microsoft Defender Antivirus is in passive mode, EDR in block mode might just detect.|
+| Custom TI| Custom indicators:
- [File hash](indicator-file.md)
- [IP address or URL](indicator-ip-domain.md)
- [Certificates](indicator-certificates.md)
Solution: [Manage indicators](indicator-manage.md).
Or, if you see `CustomEnterpriseBlock`, your detection source could be one of the following capabilities in Defender for Endpoint:
1. [Automated investigation and remediation](automated-investigations.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Automation folder exclusions ](automation-folder-exclusions-configure.md)
2. Custom detection rules deriving from [Advanced Hunting](/defender-xdr/advanced-hunting-overview)
-- Solution: [Manage existing custom detection rules ](/defender-xdr/custom-detection-rules)
3. [EDR in block mode](edr-in-block-mode.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Indicators – File hash – allow](indicator-file.md) or [Antivirus exclusions](defender-endpoint-exclusions-overview.md)
4. [Live response](live-response.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Indicators – File hash – allow](indicator-file.md) or [Antivirus exclusions](defender-endpoint-exclusions-overview.md)
5. [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md)
-- Solution: Submit the false positive to [https://aka.ms/wdsi](https://aka.ms/wdsi)
-- Work-around: [Indicators – File hash – allow](indicator-file.md) or [Antivirus exclusions](defender-endpoint-exclusions-overview.md)|
+| Smartscreen|[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/): You can [Report an unsafe site](https://www.microsoft.com/wdsi/support/report-unsafe-site) or [submit a network protection detection](https://www.microsoft.com/wdsi/support/report-exploit-guard)|
## False positives and how to address them
@@ -196,7 +198,7 @@ For more information, see [Configure and manage Microsoft Defender Antivirus wit
## Part 3: Review or define exclusions
> [!CAUTION]
-> Before you define an exclusion, review the detailed information in [Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md). Keep in mind that every exclusion that is defined lowers your level of protection.
+> Before you define an exclusion, review the detailed information in [Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md). Keep in mind that every exclusion that is defined lowers your level of protection.
An exclusion is an entity, such as a file or URL, that you specify as an exception to remediation actions. The excluded entity can still get detected, but no remediation actions are taken on that entity. That is, the detected file or process isn't stopped, sent to quarantine, removed, or otherwise changed by Microsoft Defender for Endpoint.
@@ -232,7 +234,7 @@ When you [create an "allow" indicator for a file, such as an executable](indicat
Before you create indicators for files, make sure the following requirements are met:
-- Microsoft Defender Antivirus is configured with cloud-based protection enabled (see [Manage cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus))
+- Microsoft Defender Antivirus is configured with cloud-based protection enabled (see [Manage cloud-based protection](deploy-manage-report-microsoft-defender-antivirus.md))
- Antimalware client version is 4.18.1901.x or later
- Client devices must be running Windows 11 or Windows 10, version 1703 or later
- Server devices must be running Windows Server 2016 and later
@@ -274,43 +276,31 @@ Before you create indicators for application certificates, make sure the followi
In general, you shouldn't need to define exclusions for Microsoft Defender Antivirus. Make sure that you define exclusions sparingly, and that you only include the files, folders, processes, and process-opened files that are resulting in false positives. In addition, make sure to review your defined exclusions regularly. We recommend using [Microsoft Intune](/intune/intune-service/fundamentals/what-is-intune) to define or edit your antivirus exclusions; however, you can use other methods, such as [Group Policy](/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](preferences-setup.md)).
> [!TIP]
-> Need help with antivirus exclusions? See [Configure and validate exclusions for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md).
+> Need help with antivirus exclusions? See [Configure and validate exclusions for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-configure.md).
#### Use Intune to manage antivirus exclusions (for existing policies)
-1. In the [Microsoft Intune admin center](https://intune.microsoft.com), choose **Endpoint security** \> **Antivirus**, and then select an existing policy. (If you don't have an existing policy, or you want to create a new policy, skip to [Use Intune to create a new antivirus policy with exclusions](#use-intune-to-create-a-new-antivirus-policy-with-exclusions).)
+To manage antivirus exclusions with Microsoft Intune, see Modify existing policies (opens in a new tab in the Intune documentation). Choose the following options:
-1. Choose **Properties**, and next to **Configuration settings**, choose **Edit**.
-
-1. Expand **Microsoft Defender Antivirus Exclusions** and then specify your exclusions.
-
- - **Excluded Extensions** are exclusions that you define by file type extension. These extensions apply to any file name that has the defined extension without the file path or folder. Separate each file type in the list must be separated with a `|` character. For example, `lib|obj`. For more information, see [ExcludedExtensions](/windows/client-management/mdm/policy-csp-defender#excludedextensions).
- - **Excluded Paths** are exclusions that you define by their location (path). These types of exclusions are also known as file and folder exclusions. Separate each path in the list with a `|` character. For example, `C:\Example|C:\Example1`. For more information, see [ExcludedPaths](/windows/client-management/mdm/policy-csp-defender#excludedpaths).
- - **Excluded Processes** are exclusions for files that are opened by certain processes. Separate each file type in the list with a `|` character. For example, `C:\Example. exe|C:\Example1.exe`. These exclusions aren't for the actual processes. To exclude processes, you can use file and folder exclusions. For more information, see [ExcludedProcesses](/windows/client-management/mdm/policy-csp-defender#excludedprocesses).
-
-1. Choose **Review + save**, and then choose **Save**.
+- **Policy**: **Antivirus**, then select your Microsoft Defender Antivirus policy
+- **Microsoft Defender Antivirus Exclusions**: Specify your exclusions.
+ - **Excluded Extensions** are exclusions that you define by file type extension. These extensions apply to any file name that has the defined extension without the file path or folder. Separate each file type in the list must be separated with a `|` character. For example, `lib|obj`. For more information, see [ExcludedExtensions](/windows/client-management/mdm/policy-csp-defender#excludedextensions).
+ - **Excluded Paths** are exclusions that you define by their location (path). These types of exclusions are also known as file and folder exclusions. Separate each path in the list with a `|` character. For example, `C:\Example|C:\Example1`. For more information, see [ExcludedPaths](/windows/client-management/mdm/policy-csp-defender#excludedpaths).
+ - **Excluded Processes** are exclusions for files that are opened by certain processes. Separate each file type in the list with a `|` character. For example, `C:\Example. exe|C:\Example1.exe`. These exclusions aren't for the actual processes. To exclude processes, you can use file and folder exclusions. For more information, see [ExcludedProcesses](/windows/client-management/mdm/policy-csp-defender#excludedprocesses).
#### Use Intune to create a new antivirus policy with exclusions
-1. In the [Microsoft Intune admin center](https://intune.microsoft.com), choose **Endpoint security** \> **Antivirus** \> **+ Create Policy**.
-
-1. Select a platform (such as **Windows 10, Windows 11, and Windows Server**).
-
-1. For **Profile**, select **Microsoft Defender Antivirus exclusions**, and then choose **Create**.
-
-1. On the **Create profile** step, specify a name and description for the profile, and then choose **Next**.
-
-1. On the **Configuration settings** tab, specify your antivirus exclusions, and then choose **Next**.
+To create a new antivirus policy with exclusions in Microsoft Intune, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:
- - **Excluded Extensions** are exclusions that you define by file type extension. These extensions apply to any file name that has the defined extension without the file path or folder. Separate each file type in the list with a `|` character. For example, `lib|obj`. For more information, see [ExcludedExtensions](/windows/client-management/mdm/policy-csp-defender#excludedextensions).
- - **Excluded Paths** are exclusions that you define by their location (path). These types of exclusions are also known as file and folder exclusions. Separate each path in the list with a `|` character. For example, `C:\Example|C:\Example1`. For more information, see [ExcludedPaths](/windows/client-management/mdm/policy-csp-defender#excludedpaths).
- - **Excluded Processes** are exclusions for files that are opened by certain processes. Separate each file type in the list with a `|` character. For example, `C:\Example. exe|C:\Example1.exe`. These exclusions aren't for the actual processes. To exclude processes, you can use file and folder exclusions. For more information, see [ExcludedProcesses](/windows/client-management/mdm/policy-csp-defender#excludedprocesses).
-
-1. On the **Scope tags** tab, if you're using scope tags in your organization, specify scope tags for the policy you're creating. (See [Scope tags](/intune/intune-service/fundamentals/scope-tags).)
-
-1. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](/intune/intune-service/configuration/device-profile-assign).)
-
-1. On the **Review + create** tab, review the settings, and then choose **Create**.
+- **Policy type**: Antivirus
+- **Platform**: Windows 10, Windows 11, and Windows Server
+- **Profile**: Microsoft Defender Antivirus exclusions
+- **Configuration settings**: Specify your antivirus exclusions.
+ - **Excluded Extensions** are exclusions that you define by file type extension. These extensions apply to any file name that has the defined extension without the file path or folder. Separate each file type in the list with a `|` character. For example, `lib|obj`. For more information, see [ExcludedExtensions](/windows/client-management/mdm/policy-csp-defender#excludedextensions).
+ - **Excluded Paths** are exclusions that you define by their location (path). These types of exclusions are also known as file and folder exclusions. Separate each path in the list with a `|` character. For example, `C:\Example|C:\Example1`. For more information, see [ExcludedPaths](/windows/client-management/mdm/policy-csp-defender#excludedpaths).
+ - **Excluded Processes** are exclusions for files that are opened by certain processes. Separate each file type in the list with a `|` character. For example, `C:\Example. exe|C:\Example1.exe`. These exclusions aren't for the actual processes. To exclude processes, you can use file and folder exclusions. For more information, see [ExcludedProcesses](/windows/client-management/mdm/policy-csp-defender#excludedprocesses).
+- **Scope tags**: If you're using scope tags in your organization, specify scope tags for the policy you're creating. (See [Scope tags](/intune/intune-service/fundamentals/scope-tags).)
+- **Assignments**: specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](/intune/intune-service/configuration/device-profile-assign).)
## Part 4: Submit a file for analysis
@@ -345,7 +335,7 @@ Your submission is immediately scanned by our systems to give you the latest det
For submissions that weren't already processed, they're prioritized for analysis as follows:
- Prevalent files with the potential to affect a large number of computers are given a higher priority.
-- Authenticated customers, especially enterprise customers with valid [Software Assurance IDs (SAIDs)](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx), are given a higher priority.
+- Authenticated customers, especially enterprise customers with valid [Software Assurance IDs (SAIDs)](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default), are given a higher priority.
- Submissions flagged as high priority by SAID holders are given immediate attention.
To check for updates regarding your submission, sign in at the [Microsoft Security Intelligence submission site](https://www.microsoft.com/wdsi/filesubmission).
@@ -373,7 +363,7 @@ See [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-prot
Potentially unwanted applications (PUA) are a category of software that can cause devices to run slowly, display unexpected ads, or install other software that might be unexpected or unwanted. Examples of PUA include advertising software, bundling software, and evasion software that behaves differently with security products. Although PUA isn't considered malware, some kinds of software are PUA based on their behavior and reputation.
-To learn more about PUA, see [Detect and block potentially unwanted applications](/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus).
+To learn more about PUA, see [Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md).
Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus.
@@ -393,6 +383,99 @@ Depending on the [level of automation](automation-levels.md) set for your organi
> [!IMPORTANT]
> We recommend using *Full automation* for automated investigation and remediation. Don't turn these capabilities off because of a false positive. Instead, use ["allow" indicators to define exceptions](#indicators-for-defender-for-endpoint), and keep automated investigation and remediation set to take appropriate actions automatically. Following [this guidance](automation-levels.md#levels-of-automation) helps reduce the number of alerts your security operations team must handle.
+## False negatives and how to address them
+
+A false negative occurs when a malicious entity (such as a file, process, or network connection) isn't detected by Defender for Endpoint. False negatives can result from outdated security intelligence, misconfigured features, or threats that evade existing signatures.
+
+> [!NOTE]
+> Some capabilities in this section depend on your plan. Advanced hunting, collecting an investigation package, and [EDR in block mode](edr-in-block-mode.md) require [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md). The device timeline requires Defender for Endpoint Plan 2 or [Microsoft Defender for Business](/defender-business/mdb-overview). These capabilities aren't available in Defender for Endpoint Plan 1.
+
+### Verify a suspected false negative
+
+Before you report a false negative, confirm that the suspicious activity occurred and wasn't detected. Use the device timeline and advanced hunting in the Microsoft Defender portal to cross-verify endpoint behavior.
+
+1. On the **Device inventory** page of the Defender portal at
Windows Server 2016 or later | older than 1.329.495.0 | Disabled (0) |
| Windows 10 or later
Windows Server 2016 or later | 1.329.495.0 or later | Audit mode (2) |
@@ -123,9 +126,9 @@ The following table shows the default PUA protection settings for devices onboar
| Scenarios |Security intelligence update version | Smart App Control| PUA protection default setting|
| -------- | -------- | -------- | -------- |
-| Windows 10, version 2004 or later
Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)
Windows Server 2019 or later |Older than 1.329.495.0 |Feature not available | Audit mode (2)|
+| Windows 10, version 2004 or later
Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution for Windows Server 2016 and 2012 R2](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)
Windows Server 2019 or later |Older than 1.329.495.0 |Feature not available | Audit mode (2)|
| Windows 11, version 22H2 or later | 1.329.495.0 or later | Available | Audit mode (2)|
-| Windows 10, version 2004 or later
Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)
Windows Server 2019 or later | 1.329.495.0 or later |Feature not available | Block mode (1)|
+| Windows 10, version 2004 or later
Windows Server 2012 R2 and Windows Server 2016 with the [modern unified solution for Windows Server 2016 and 2012 R2](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)
Windows Server 2019 or later | 1.329.495.0 or later | Feature not available | Block mode (1)|
> [!TIP]
> To enforce PUA protection in block mode, use any of the following management methods:
@@ -138,11 +141,11 @@ The following table shows the default PUA protection settings for devices onboar
### Use Microsoft Defender for Endpoint Security Settings Management to configure PUA protection
-For more information, see Use Microsoft Defender for Endpoint Security Settings Management to manage Microsoft Defender Antivirus
+For more information about using Defender for Endpoint Security Settings Management to configure PUA protection, see Use Microsoft Defender for Endpoint Security Settings Management to manage Microsoft Defender Antivirus
### Use Intune to configure PUA protection
-See the following articles:
+For information about configuring PUA protection through Intune device restriction settings, see the following articles:
- [Configure device restriction settings in Microsoft Intune](/intune/intune-service/configuration/device-restrictions-configure)
- [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/intune-service/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)
@@ -162,24 +165,40 @@ For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unw
Perform the following steps to configure PUA protection by using Group Policy:
-1. Download and install [Administrative Templates (.admx) for Windows 11](https://www.microsoft.com/download/details.aspx?id=104042)
+> [!NOTE]
+> If the **Configure detection for potentially unwanted applications** setting isn't available in your GPMC, update the Administrative Templates files in your Central Store. The setting is included in the Windows 10, version 1809 Administrative Templates and later. For download links and instructions, see [Create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store).
+
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
-1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
-1. Select the Group Policy Object you want to configure, and then choose **Edit**.
+1. Right-click the GPO, and then select **Edit**.
-1. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
-1. Expand the tree to **Windows Components** \> **Microsoft Defender Antivirus**.
+ > [!NOTE]
+ > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Antivirus instead of _Microsoft_ Defender Antivirus. Both names refer to the same policy location.
-1. Double-click **Configure detection for potentially unwanted applications**, and set it to **Enabled**.
+1. In the details pane of **Microsoft Defender Antivirus**, open the **Configure detection for potentially unwanted applications** setting. To open the setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
-1. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting works in your environment. Select **OK**.
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Options** section: Select one of the following values:
+ - **Block**: Block potentially unwanted applications.
+ - **Audit Mode**: Test how the setting works in your environment.
-1. Deploy your Group Policy object as you usually do.
+ When you're finished, select **OK**.
+
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
### Use PowerShell cmdlets to configure PUA protection
+Use the following PowerShell cmdlets to enable, audit, disable, or query PUA protection in Microsoft Defender Antivirus.
+
#### To enable PUA protection
Enable PUA protection in Microsoft Defender Antivirus to block potentially unwanted applications on the device:
@@ -224,7 +243,7 @@ Get-MpPreference | Format-Table PUAProtection
| `1` | PUA Protection on. Detected items are blocked. They'll show in history along with other threats.|
| `2` | Audit mode. Microsoft Defender Antivirus detects potentially unwanted applications but takes no action. You can review information about the applications Microsoft Defender Antivirus would've taken action against by searching for events created by Microsoft Defender Antivirus in the Event Viewer, but not in the [Microsoft Defender portal](https://security.microsoft.com).|
-For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/index).
+For more information about managing Microsoft Defender Antivirus with PowerShell, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/index).
## Test and make sure that PUA blocking works
@@ -271,7 +290,7 @@ To learn more about advanced hunting, see [Proactively hunt for threats with adv
Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be added to an exclusion list.
-For more information, see [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md).
+For more information, see [Configure and validate exclusions based on file extension and folder location](microsoft-defender-antivirus-exclusions-configure.md).
## See also
diff --git a/defender-endpoint/device-control-deploy-manage-intune.md b/defender-endpoint/device-control-deploy-manage-intune.md
index e9745da5b1a..6dd4daa55c7 100644
--- a/defender-endpoint/device-control-deploy-manage-intune.md
+++ b/defender-endpoint/device-control-deploy-manage-intune.md
@@ -27,47 +27,27 @@ If you're using Intune to manage Defender for Endpoint settings, you can use it
## Configure and manage device control in Intune
-1. In the Microsoft Intune admin center at
- `1`: show notification
- `2`: send event
- `3`: show notification and send event |
| `AccessMask` | Defines the access | See the following section [Understand mask access](#understand-mask-access-windows) |
| `Sid` | Local user SID or user SID group, or the SID of the Microsoft Entra object or the Object ID. It defines whether to apply this policy over a specific user or user group. One entry can have a maximum of one SID and an entry without any SID means to apply the policy over the device. | SID |
-| `ComputerSid` | Local computer SID or computer SID group, or the SID of the Microsoft Entra object or the Object Id. It defines whether to apply this policy over a specific device or device group. One entry can have a maximum of one ComputerSID and an entry without any ComputerSID means to apply the policy over the device. If you want to apply an Entry to a specific user and specific device, add both SID and ComputerSID into the same Entry. | SID |
+| `ComputerSid` | Local computer SID or computer SID group, or the Microsoft Entra group object ID. It defines whether to apply this policy over a specific device or device group. One entry can have a maximum of one ComputerSID and an entry without any ComputerSID means to apply the policy over the device. If you want to apply an Entry to a specific user and specific device, add both SID and ComputerSID into the same Entry. Microsoft Entra device object IDs currently aren't supported. | SID |
| `Parameters` | Condition for an entry, such as network condition. | Can add groups (nondevice types) or even put parameters into parameters. For more information, see the [advanced conditions](#advanced-conditions) section (in this article). |
#### Understand mask access (Windows)
diff --git a/defender-endpoint/device-health-microsoft-defender-antivirus-health.md b/defender-endpoint/device-health-microsoft-defender-antivirus-health.md
index 47604ba9215..889a1d7fbd6 100644
--- a/defender-endpoint/device-health-microsoft-defender-antivirus-health.md
+++ b/defender-endpoint/device-health-microsoft-defender-antivirus-health.md
@@ -33,7 +33,7 @@ The Device Health report provides information about the devices in your organiza
> For devices to appear **correctly** in Microsoft Defender Antivirus device health reports, they must meet the following prerequisites:
>
> - Device is onboarded to Microsoft Defender for Endpoint
-> - OS: Windows 10, Windows 11, Windows Server 2012 R2/, 2016 R2/ 2019/2022 (not onboarded via Microsoft Management Agent), macOS, Linux
+> - OS: Windows 10, Windows 11, Windows Server 2012 R2 or later (not onboarded via Microsoft Management Agent), macOS, Linux
> - Sense (MsSense.exe) version: **10.8210.** *+.
>
> **OS build dependency (Windows 10 2016 LTSB / 1607):**
diff --git a/defender-endpoint/device-health-reports.md b/defender-endpoint/device-health-reports.md
index dedb3312e85..694d2a8475b 100644
--- a/defender-endpoint/device-health-reports.md
+++ b/defender-endpoint/device-health-reports.md
@@ -5,7 +5,7 @@ ms.service: defender-endpoint
ms.author: lwainstein
author: limwainstein
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/03/2026
ms.collection:
- m365-security
- tier2
@@ -14,7 +14,7 @@ ms.subservice: ngp
ms.reviewer: mkaminska
appliesto:
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -25,13 +25,13 @@ ai-usage: ai-assisted
-The Device Health report provides information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, Windows 10 versions, and Microsoft Defender Antivirus update versions.
+The Device Health report provides information about the devices in your organization. The Device Health report includes trending information showing the sensor health state, antivirus status, OS platforms, Windows 10 versions, and Microsoft Defender Antivirus update versions.
> [!IMPORTANT]
> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
In the Microsoft Defender portal navigation panel, select **Reports**, and then open **Device health and compliance**.
-The Device health and compliance dashboard is structured in two tabs:
+The **Device health and compliance** dashboard in the Microsoft Defender portal is structured in two tabs:
- The [**Sensor health & OS** tab](device-health-sensor-health-os.md#sensor-health--os-tab) provides general operating system information, divided into three cards that display the following device attributes:
- [Sensor health card](device-health-sensor-health-os.md#sensor-health-card)
@@ -50,7 +50,7 @@ The Device health and compliance dashboard is structured in two tabs:
## Report access permissions
-To access the Device health and antivirus compliance report in the Microsoft Defender portal, the following permissions are required:
+To access the Device Health report (the **Device health and compliance** dashboard) in the Microsoft Defender portal, the following permissions are required:
| Permission name | Permission type |
|:---|:---|
@@ -97,6 +97,8 @@ To assign the View Data - Threat and vulnerability management (TVM) permission f
> See: [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).
>
+### See also
+
- [Create and manage roles for role-based access control](user-roles.md).
- [Export device antivirus health details API methods and properties](api/device-health-api-methods-properties.md)
diff --git a/defender-endpoint/device-health-sensor-health-os.md b/defender-endpoint/device-health-sensor-health-os.md
index 69dcd3063b1..992e409c5a1 100644
--- a/defender-endpoint/device-health-sensor-health-os.md
+++ b/defender-endpoint/device-health-sensor-health-os.md
@@ -1,11 +1,11 @@
---
-title: Device health Sensor health & OS report
-description: Use the device health report to track device health, OS platforms, and Windows 10 versions.
+title: Device health sensor health and OS report in Microsoft Defender for Endpoint
+description: Use the Sensor health and OS device health report in Microsoft Defender for Endpoint to monitor sensor health, antivirus status, OS platforms, and Windows version trends.
ms.service: defender-endpoint
ms.author: lwainstein
author: limwainstein
ms.localizationpriority: medium
-ms.date: 06/16/2026
+ms.date: 07/03/2026
ms.collection:
- m365-security
- tier2
@@ -15,7 +15,7 @@ ms.reviewer: mkaminska
appliesto:
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -62,9 +62,10 @@ To assign these permissions:
For more information about user role management, see [Create and manage roles for role-based access control](user-roles.md).
-## Sensor health & OS tab
+
+## Sensor health and operating system tab
-Sensor health and OS cards report on general operating system health, which includes detection sensor health, up to date versus out-of-date operating systems, and Windows 10 versions.
+Sensor health and operating system (OS) cards report on general operating system health, which includes detection sensor health, up to date versus out-of-date operating systems, and Windows 10 versions.
>:::image type="content" source="media/device-health-sensor-health-os-tab.png" alt-text="Shows Sensor health and Operating system information." lightbox="media/device-health-sensor-health-os-tab.png":::
@@ -73,7 +74,7 @@ Each of the three cards on the **Sensor health** tab has two reporting sections,
### Current state graph overview
-In each card, the Current state (referred to in some documentation as _Device summary_) is the top, horizontal bar graph. Current state is a snapshot that shows information collected about devices in your organization, scoped to the current day. This graph represents the distribution of devices across your organization that report status or are detected to be in a specific state.
+In each card, the Current state (referred to in some documentation as _Device summary_) is the top, horizontal bar graph. Current state is a snapshot that shows information collected about devices in your organization, scoped to the current day. The Current state graph represents the distribution of devices across your organization that report status or are detected to be in a specific state.
>:::image type="content" source="media/device-health-sensor-health-os-current-state-graph.png" alt-text="Shows the current state graph." lightbox="media/device-health-sensor-health-os-current-state-graph.png":::
@@ -86,9 +87,10 @@ By default, the device trends graph displays device information from the 30-day
>:::image type="content" source="media/device-health-sensor-health-os-device-trends-graph.png" alt-text="Shows the Device Health versions trends graph." lightbox="media/device-health-sensor-health-os-device-trends-graph.png":::
-### Data filters
+
+### Use data filters to refine report results
-Use the provided filters to include or exclude devices with certain attributes. You can select multiple filters to apply from the device attributes. When applied, filters apply to all three cards in the report.
+Use the provided filters to include or exclude devices with certain attributes. You can select multiple filters to apply from the device attributes. When filters are applied, they affect all three cards in the report.
For example, to show data about Windows 10 devices with Active sensor health state:
@@ -117,7 +119,7 @@ Devices that are either experiencing impaired communications, or devices from wh
### Operating systems and platforms card overview
-This card shows the distribution of operating systems and platforms that exist within your organization.
+The Operating systems and platforms card shows the distribution of operating systems and platforms that exist within your organization.
_OS systems and platforms_ can give useful insights into whether devices in your organization are running current or outdated operating systems. When new operating systems are introduced, security enhancements are frequently included that improve your organization's posture against security threats.
For example, Secure Boot (introduced in Windows 8) practically eliminated the threat from some of the most harmful types of malware. Improvements in Windows 10 provide PC manufacturers the option to prevent users from disabling Secure Boot. Preventing users from disabling Secure Boot removes almost any chance of malicious rootkits or other low-level malware from infecting the boot process.
diff --git a/defender-endpoint/discover-local-ai-agents.md b/defender-endpoint/discover-local-ai-agents.md
index 34a6d22f84e..55af6177a36 100644
--- a/defender-endpoint/discover-local-ai-agents.md
+++ b/defender-endpoint/discover-local-ai-agents.md
@@ -1,10 +1,10 @@
---
title: Discover local AI agents with Microsoft Defender for Endpoint (Preview)
-description: Learn how to discover, view, and investigate local AI agents on Windows devices by using Microsoft Defender.
+description: Learn how to discover, view, and investigate local AI agents on Windows and macOS devices by using Microsoft Defender.
author: lwainstein
ms.author: lwainstein
ms.service: defender-endpoint
-ms.topic: overview
+ms.topic: how-to
ms.date: 05/27/2026
ai-usage: ai-assisted
#customer intent: As a security administrator, I want to discover and monitor local AI agents on my organization's devices so that I can manage AI-related security risks on endpoints.
@@ -16,182 +16,436 @@ ai-usage: ai-assisted
Microsoft Defender automatically discovers supported local AI agents and MCP servers configured on onboarded devices and surfaces them in the AI agent inventory and advanced hunting. To learn more about local AI agent discovery, see [Local AI agent discovery with Microsoft Defender for Endpoint](local-agent-discovery-overview.md).
-In this article, you learn how to view discovered agents in the inventory, explore their relationships with devices and identities, and investigate agent presence using advanced hunting.
-
-> [!NOTE]
-> Local AI agent discovery provides discovery and investigation capabilities only, and doesn't include security posture assessment or alerts for endpoint agents.
+In this article, you learn how to view discovered agents in the inventory, review their configuration and risk, explore their relationships with devices and identities, and investigate agent presence using advanced hunting.
## Prerequisites
Before you can discover local AI agents on endpoints, make sure you meet the following requirements:
- Your environment is in the commercial cloud. Sovereign and national clouds aren't supported.
-- Your organization has a Microsoft Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7 license.
-- Your devices are onboarded to [Microsoft Defender for Endpoint](/defender-endpoint/onboard-configure).
+- Your organization has a Microsoft Defender for Endpoint Plan 2 license. For more information, see [Licensing](#licensing).
+- Your devices are [onboarded to Microsoft Defender for Endpoint](onboard-configure.md).
- Your devices run a supported version of Windows or macOS, and Microsoft Defender Antivirus is updated with current monthly platform and engine updates.
-- Your devices are running Microsoft Defender Antivirus in active mode with real-time protection enabled in Windows Security.
+- Microsoft Defender Antivirus is running in active mode on your devices, with real-time protection enabled.
You don't need additional deployment, configuration, or scripts beyond the device onboarding requirements. If the device meets all of the prerequisites, agent discovery begins automatically.
+### Licensing
+
+Microsoft Defender for Endpoint Plan 2 is the minimum license for local AI agent discovery. Security posture capabilities for the agents that Defender discovers require another license, as described in the following table.
+
+| Capability | Required license |
+| --- | --- |
+| Discover local AI agents and view them in the AI agent inventory, including the agent details, the device and account, and the configured MCP servers | Microsoft Defender for Endpoint Plan 2 |
+| Query local AI agents in advanced hunting, including the `AgentsInfo` table | Microsoft Defender for Endpoint Plan 2 |
+| View the risk level, risk indicators, and security recommendations for discovered local AI agents | Microsoft 365 E7, or Microsoft Agent 365 together with Microsoft Defender for Endpoint Plan 2 |
+
+Microsoft 365 E5 and Microsoft 365 E7 both include Microsoft Defender for Endpoint Plan 2. If your organization has Microsoft Defender for Endpoint Plan 2 without Microsoft 365 E7 or Microsoft Agent 365, you can discover local AI agents, view the inventory, and query agents in advanced hunting, but the risk level, risk indicators, and security recommendations aren't available.
+
## View local AI agents in the inventory
-- To view a list of all local AI agents discovered on endpoints:
+1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/).
+
+1. In the left navigation pane, select **Assets** > **AI agents**.
+
+1. Select the **Local agents** tab to see the local AI agents discovered on your devices.
+
+ :::image type="content" source="media/local-agent-discovery-overview/discovery-overview.png" alt-text="Screenshot showing the local AI agents inventory in the Microsoft Defender portal with discovered agents listed." lightbox="media/local-agent-discovery-overview/discovery-overview.png":::
- 1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/).
+The **Agents insights** cards summarize the total number of monitored agents, the number of agents at a high risk level, and the number of critical agents.
- 1. In the left navigation pane, select **Assets** > **AI Agents**.
+The list shows one entry for each agent installation, so an agent that runs on several devices, or under several accounts on the same device, appears more than once. Use the filters to narrow the list, select **Customize columns** to change which columns appear, or select **Export** to download the list.
- 1. Select **Local agents** to see a filtered list of local AI agents discovered on endpoint devices.
-
-- To view a specific agent's details:
+| Column | Description |
+| --- | --- |
+| **Agent name**, **Version** | The discovered agent, and the version installed. |
+| **Device name**, **Device ID**, **OS platform**, **Device type** | The device where the agent was discovered. |
+| **Account name**, **Account domain** | The account that the agent runs under. |
+| **Risk level** | The overall risk level of the agent. |
+| **Risk indicators** | Why the agent is considered risky, such as **Running on a Critical Device** or **Used by a Critical User**. |
+| **Recommendations** | The security recommendations that apply to the agent. |
+| **MCP servers**, **Local MCPs** | The number of remote MCP servers, and of local MCP servers, configured for the agent. |
+| **First seen** | When the agent was first discovered. |
- 1. From the **Local agents** list, select an agent to open the **Agent** pane.
-
- :::image type="content" source="media/local-agent-discovery-overview/discovery-overview.png" alt-text="Screenshot showing the local AI agents inventory in the Microsoft Defender portal with discovered agents listed." lightbox="media/local-agent-discovery-overview/discovery-overview.png":::
+> [!NOTE]
+> Risk levels, risk indicators, and security recommendations require Microsoft 365 E7 or Microsoft Agent 365. Without one of these licenses, you can still view the inventory and the details of each agent. For more information, see [Licensing](#licensing).
+
+### View the details of a local AI agent
+
+From the **Local agents** list, select an agent to open its details pane:
+
+- **Details** shows the agent name, vendor, model, related process, whether the host process is trusted, whether the agent automatically approves its own actions, and the source agent ID.
+- **Risk** shows the risk level, the risk indicators, and the security recommendations that apply to the agent.
+- **Device details** shows the device where the agent was discovered, including the OS platform and version, the device type and roles, and the Microsoft Entra device ID.
+- **User details** shows the ID, name, and domain of the account that the agent runs under.
+- **MCP servers** lists the MCP servers configured for the agent, with the name, type, and endpoint of each server.
+- **Local MCP servers** lists the local MCP entries discovered on the device.
+
+To investigate further, select **Go hunt** to query the agent in advanced hunting, **View on map** to see the agent in the attack surface map, or **Open Agent page** to open the full agent page.
- 1. Review the agent details, including:
+### Review an agent's attack surface and recommendations
- - Agent name, version, and related process
- - Associated device and user
- - First seen and last updated timestamps
- - Integrity level, auto-approve status, and trust indicator
- - Configured MCP servers, when detected
+The agent page has an **Overview** tab and a **Security recommendations** tab. The **Attack surface** map on the **Overview** tab shows the other agents, devices, identities, and resources associated with the agent.
- For more information on using the AI agent inventory, see [Discover AI agents and assess security posture using Microsoft Defender](/defender-xdr/security-for-ai/ai-agent-inventory).
+For more information on using the AI agent inventory, see [Discover AI agents and assess security posture using Microsoft Defender](/defender-xdr/security-for-ai/ai-agent-inventory).
## Query local AI agents using advanced hunting
-Use advanced hunting to proactively investigate local AI agent presence, understand which users and resources agents can reach, and identify high-risk configurations. These queries help you assess exposure, trace access paths to sensitive assets, and prioritize security response.
+Use advanced hunting to proactively investigate local AI agent presence, understand how agents are configured, and identify the agents and users that carry the most risk. These queries help you inventory agents, review the MCP servers they connect to, and trace access to critical or sensitive assets.
+
+### Understand the tables
+
+Three advanced hunting tables describe local AI agents. Each answers a different question, and they're most useful together.
+
+| Table | What it contains | Use it to answer |
+| --- | --- | --- |
+| [AgentsInfo](/defender-xdr/advanced-hunting-agentsinfo-table) | A profile record for every AI agent that Microsoft Defender discovers, across all agent platforms. For local AI agents, the record includes the publisher, version, host process, trust and auto-approve settings, configured MCP servers, and the device and account where the agent was seen. | What is this agent, and how is it configured? |
+| [ExposureGraphNodes](/defender-xdr/advanced-hunting-exposuregraphnodes-table) | Every entity in your organization as a node, including AI agents, devices, identities, and cloud resources, along with properties such as asset criticality and whether the entity holds sensitive data. | What is this entity, and how much does it matter? |
+| [ExposureGraphEdges](/defender-xdr/advanced-hunting-exposuregraphedges-table) | The relationships between nodes, such as the device an agent runs on, or the resources an identity can access. | What can this agent reach? |
+
+In short, `AgentsInfo` describes what an agent *is*, and the exposure graph describes what an agent can *reach*.
-The [ExposureGraphNodes](/defender-xdr/advanced-hunting-exposuregraphnodes-table) and [ExposureGraphEdges](/defender-xdr/advanced-hunting-exposuregraphedges-table) tables represent the security graph for local AI agents, including entities and relationships.
+Both data sources contain agents from every platform, including cloud agents, so each one needs its own filter.
+
+In `AgentsInfo`, filter on the `Platform` column:
+
+```kusto
+AgentsInfo
+| where Platform == "LocalAgents"
+```
+
+In `ExposureGraphNodes`, AI agents use the `ai-agent` node label. Filter on the platform reported in the node properties:
+
+```kusto
+ExposureGraphNodes
+| where NodeLabel == "ai-agent"
+| where tostring(NodeProperties.rawData.aiAgentMetadata.platform) == "LocalAgents"
+```
+
+> [!IMPORTANT]
+> The `ExposureGraphEdges` table doesn't include a property that identifies local AI agents. Filtering only on `SourceNodeLabel == "ai-agent"` returns edges for every AI agent in your tenant, including cloud agents. Always resolve the local agent set from `ExposureGraphNodes` first, and then join to `ExposureGraphEdges` on the node ID, as shown in the following queries.
+
+### Combine the tables
+
+An agent has two identifiers, and queries that combine the tables need both:
+
+- `AgentId` identifies the agent profile in `AgentsInfo`. The exposure graph stores the same value in the agent node, as `NodeProperties.rawData.aiAgentMetadata.id`.
+- `NodeId` identifies the agent's node in the exposure graph. This is the value that `ExposureGraphEdges` refers to, in `SourceNodeId` and `TargetNodeId`.
+
+| To go from | To | Match on |
+| --- | --- | --- |
+| `AgentsInfo` | `ExposureGraphNodes` | `tostring(AgentId)` and `tostring(NodeProperties.rawData.aiAgentMetadata.id)` |
+| `ExposureGraphNodes` | `ExposureGraphEdges` | `NodeId` and `SourceNodeId` or `TargetNodeId` |
> [!NOTE]
-> The following queries use the `ExposureGraphEdges` table to query the device associated with the AI agent. You can also use the `ExposureGraphNodes` table to query the actual agent.
+> `AgentId` is a `guid` column in `AgentsInfo`, but the exposure graph stores the same value as a string. Convert it with `tostring()` on both sides of the join. A join between columns of different types doesn't match any rows.
+
+Local AI agent nodes connect to the rest of the exposure graph through the following edges:
+
+| Edge label | Target node label | Description |
+| --- | --- | --- |
+| `runs on` | `device`, `ec2.instance`, `microsoft.compute/virtualmachines` | The device where the agent was discovered. |
+| `uses` | `mcp/server` | An MCP server that's configured for the agent. |
+| `used by` | `user` | The identity that uses the agent. |
+
+Cloud AI agents also use a `can authenticate as` edge that points to a service principal or a Microsoft Entra OAuth app. Local AI agents don't use that edge, so use `used by` to resolve the identity behind a local AI agent.
+
+Asset criticality is stored in `ExposureGraphNodes`, in `NodeProperties.rawData.criticalityLevel.criticalityLevel`, where `0` is the highest level (very high) and `3` is the lowest (low). The `ruleNames` property lists the classification rules that made the asset critical.
-### Get an inventory of AI agents across endpoints
+### Work with local AI agent profiles
-This query lists all discovered local AI agents and the devices they run on:
+`AgentsInfo` adds a record each time an agent profile is updated, so a single agent usually has several records. To return only the most recent record for each agent, summarize with `arg_max` on `Timestamp`:
```kusto
-ExposureGraphEdges
-| where SourceNodeLabel == "endpointAiAgent"
-| where EdgeLabel =~ "runs on"
-| summarize Devices = make_set(TargetNodeName),
- DeviceCount = dcount(TargetNodeName)
- by AIAgent = SourceNodeName
-| sort by DeviceCount desc
+AgentsInfo
+| where Platform == "LocalAgents"
+| summarize arg_max(Timestamp, Name, Version, LifecycleStatus, RawAgentInfo) by AgentId
```
-### Map AI agents to users
+`LifecycleStatus` reports whether the agent is still present on the device. An agent that's reinstalled can also be reissued with a new `AgentId`, which leaves the earlier record marked as `Deleted`, so filter out `Deleted` and `Uninstalled` records when you want a current inventory.
-This query maps local AI agents to the users with credentials on the devices they run on:
+Many `AgentsInfo` columns describe cloud agents and are empty for local AI agents. The columns that carry local AI agent data are `AgentId`, `Name`, `Version`, `PublishedStatus`, `LifecycleStatus`, `LastUpdatedDateTime`, `McpServers`, `DeclaredTools`, and `RawAgentInfo`.
+
+Local AI agent posture is nested in the `RawAgentInfo` column, under `localAgentMetadata`:
+
+| Property | Description |
+| --- | --- |
+| `vendor` | The publisher of the agent, such as Anthropic, Google, or OpenAI. |
+| `relatedProcess` | The process that hosts the agent, such as `code.exe`. |
+| `trustedProcess` | Whether the host process is trusted. Reported as the string `"true"` or `"false"`. |
+| `autoApprove` | Whether the agent acts without prompting the user for approval. Reported as the string `"true"` or `"false"`. |
+| `deviceName`, `aadDeviceId` | The device where the agent was discovered. |
+| `accountName`, `accountDomain`, `accountSid` | The account that the agent ran under. |
+| `localMcps` | MCP servers that run locally on the device, including the command that starts each one. |
+
+> [!NOTE]
+> `trustedProcess` and `autoApprove` are reported as strings, not as boolean values. Compare them to `"true"` or `"false"` rather than using `tobool()`.
+
+Each of the following queries is self-contained. The queries that use the exposure graph start with a set of `let` statements that resolve local AI agents and the devices they run on.
+
+### Get an inventory of local AI agents
+
+This query lists the local AI agents discovered in your organization, together with the publisher, the host process, the versions in use, and how widely each agent is deployed:
```kusto
-let accessEdges = dynamic(["contains", "has credentials of", "has permissions to",
- "has role on", "can authenticate as", "can authenticate to"]);
-ExposureGraphEdges
-| where SourceNodeLabel == "endpointAiAgent"
-| project AIAgent = SourceNodeName, DeviceId = TargetNodeId, Device = TargetNodeName
-| join kind=inner (
- ExposureGraphEdges
- | where EdgeLabel in (accessEdges)
- | where TargetNodeLabel in ("device", "ec2.instance", "microsoft.compute/virtualmachines")
- | project UserId = SourceNodeId, User = SourceNodeName,
- UserType = SourceNodeLabel, DeviceId = TargetNodeId
-) on DeviceId
-| summarize AIAgents = make_set(AIAgent) by Device, User, UserType
-| sort by Device asc
+AgentsInfo
+| where Platform == "LocalAgents"
+| summarize arg_max(Timestamp, Name, Version, LifecycleStatus, RawAgentInfo)
+ by AgentId
+| where LifecycleStatus !in~ ("Deleted", "Uninstalled")
+| extend AgentMetadata = RawAgentInfo.localAgentMetadata
+| extend Vendor = tostring(AgentMetadata.vendor),
+ Process = tostring(AgentMetadata.relatedProcess),
+ Device = tostring(AgentMetadata.deviceName),
+ Account = tostring(AgentMetadata.accountName)
+| summarize Installations = count(),
+ DeviceCount = dcount(Device),
+ Devices = make_set(Device, 100),
+ Versions = make_set(Version, 20),
+ Accounts = make_set_if(Account, isnotempty(Account), 50)
+ by Agent = Name, Vendor, Process
+| sort by DeviceCount desc, Installations desc
```
-### Find AI agents on devices of users with broad access
+Each `AgentId` represents one agent profile, which is a single agent on a single device for a single account. `Installations` counts those profiles, so an agent that two people use on the same device counts twice, while `DeviceCount` counts the device once.
+
+### Review the MCP servers and tools that local AI agents use
-This query identifies which users on local AI agent devices have permissions to the most resources, helping you prioritize risk based on scope of access:
+This query lists the MCP servers and tools configured for local AI agents, the agents and devices that use them, and where each one runs:
```kusto
-let accessEdges = dynamic(["contains", "has credentials of", "has permissions to",
- "has role on", "can authenticate as", "can authenticate to",
- "member of", "can impersonate as"]);
-let biEdges =
- ExposureGraphEdges
- | where EdgeLabel in (accessEdges)
- | project src = SourceNodeId, tgt = TargetNodeId,
- srcName = SourceNodeName, tgtName = TargetNodeName, edge = EdgeLabel
- | union (
- ExposureGraphEdges
- | where EdgeLabel in (accessEdges)
- | project src = TargetNodeId, tgt = SourceNodeId,
- srcName = TargetNodeName, tgtName = SourceNodeName, edge = EdgeLabel
- );
-let userAccess =
+let localAgentProfiles =
+ AgentsInfo
+ | where Platform == "LocalAgents"
+ | extend AgentMetadata = RawAgentInfo.localAgentMetadata
+ | project Timestamp,
+ Agent = Name,
+ Device = tostring(AgentMetadata.deviceName),
+ Account = tostring(AgentMetadata.accountName),
+ McpServers,
+ DeclaredTools,
+ LocalServers = AgentMetadata.localMcps;
+let remoteMcpServers =
+ localAgentProfiles
+ | mv-expand Server = McpServers
+ | project Timestamp, Agent, Device, Account,
+ McpServer = tostring(Server.name),
+ Origin = "Remote MCP server",
+ Transport = tostring(Server.type),
+ Location = tostring(Server.endpoint);
+let agentDeclaredTools =
+ localAgentProfiles
+ | mv-expand Tool = DeclaredTools
+ | project Timestamp, Agent, Device, Account,
+ McpServer = tostring(Tool.name),
+ Origin = "Declared tool",
+ Transport = tostring(Tool.type),
+ Location = tostring(Tool.endpoint);
+let localMcpServers =
+ localAgentProfiles
+ | mv-expand Server = LocalServers
+ | project Timestamp, Agent, Device, Account,
+ McpServer = tostring(Server.name),
+ Origin = "Local MCP server",
+ Transport = tostring(Server.transportType),
+ Location = tostring(Server.commandName);
+remoteMcpServers
+| union agentDeclaredTools, localMcpServers
+| where isnotempty(McpServer)
+| summarize LastSeen = max(Timestamp),
+ Agents = make_set(Agent, 20),
+ Devices = make_set(Device, 20),
+ Accounts = make_set_if(Account, isnotempty(Account), 20)
+ by McpServer, Origin, Transport, Location
+| sort by McpServer asc, Origin asc
+```
+
+The `Origin` column distinguishes the three ways a server or tool is reported:
+
+- A **remote MCP server** is reached over the network, and `Location` holds its endpoint.
+- A **local MCP server** runs as a process on the device, and `Location` holds the command that starts it. Local MCP servers are reported only in `AgentsInfo`.
+- A **declared tool** is a tool the agent advertises. Declared tools are often backed by an MCP server, but they don't always report an endpoint.
+
+Unlike the other queries, this one reads every profile record for each agent, so that MCP servers reported at any point are included. The `LastSeen` column shows when each server was last reported.
+
+### Find local AI agents with risky configurations
+
+This query returns local AI agents that act without asking the user for approval, or that run in a host process that isn't trusted:
+
+```kusto
+AgentsInfo
+| where Platform == "LocalAgents"
+| summarize arg_max(Timestamp, Name, Version, LifecycleStatus, RawAgentInfo)
+ by AgentId
+| where LifecycleStatus !in~ ("Deleted", "Uninstalled")
+| extend AgentMetadata = RawAgentInfo.localAgentMetadata
+| extend AutoApprove = tostring(AgentMetadata.autoApprove),
+ TrustedProcess = tostring(AgentMetadata.trustedProcess),
+ Vendor = tostring(AgentMetadata.vendor),
+ Process = tostring(AgentMetadata.relatedProcess),
+ Device = tostring(AgentMetadata.deviceName),
+ Account = tostring(AgentMetadata.accountName)
+| where AutoApprove =~ "true" or TrustedProcess =~ "false"
+| extend RiskReason = case(
+ AutoApprove =~ "true" and TrustedProcess =~ "false",
+ "Acts without approval, and the host process isn't trusted",
+ AutoApprove =~ "true",
+ "Acts without approval",
+ "The host process isn't trusted")
+| project Agent = Name, Vendor, Version, Process, Device, Account,
+ AutoApprove, TrustedProcess, RiskReason, LastSeen = Timestamp
+| sort by Device asc, Agent asc
+```
+
+An agent that auto-approves its own actions runs tools and reaches resources without a person confirming each step, so the account and device that the agent runs on define what it can do unsupervised.
+
+### Find risky local AI agents on critical devices
+
+This query combines agent configuration from `AgentsInfo` with asset criticality from the exposure graph, so you can start with the agents that both act unsupervised and run on business-critical devices:
+
+```kusto
+let deviceLabels = dynamic(["device", "ec2.instance",
+ "microsoft.compute/virtualmachines"]);
+let riskyAgentProfiles =
+ AgentsInfo
+ | where Platform == "LocalAgents"
+ | summarize arg_max(Timestamp, Name, Version, LifecycleStatus, RawAgentInfo)
+ by AgentId
+ | where LifecycleStatus !in~ ("Deleted", "Uninstalled")
+ | extend AgentMetadata = RawAgentInfo.localAgentMetadata
+ | extend AutoApprove = tostring(AgentMetadata.autoApprove),
+ TrustedProcess = tostring(AgentMetadata.trustedProcess)
+ | where AutoApprove =~ "true" or TrustedProcess =~ "false"
+ | project AgentId = tostring(AgentId),
+ Agent = Name,
+ Version,
+ Vendor = tostring(AgentMetadata.vendor),
+ Account = tostring(AgentMetadata.accountName),
+ AutoApprove,
+ TrustedProcess;
+let localAgentNodes =
+ ExposureGraphNodes
+ | where NodeLabel == "ai-agent"
+ | where tostring(NodeProperties.rawData.aiAgentMetadata.platform) == "LocalAgents"
+ | project AgentNodeId = NodeId,
+ AgentId = tostring(NodeProperties.rawData.aiAgentMetadata.id);
+let agentDeviceEdges =
ExposureGraphEdges
- | where SourceNodeLabel == "user"
- | where EdgeLabel in ("has permissions to", "has role on")
- | summarize
- ResourceCount = dcount(TargetNodeId),
- ResourceTypes = make_set(TargetNodeLabel)
- by UserId = SourceNodeId, User = SourceNodeName;
-ExposureGraphEdges
-| where SourceNodeLabel == "endpointAiAgent"
-| project AIAgent = SourceNodeName, n1 = TargetNodeId, Device = TargetNodeName
-| join kind=inner (
- biEdges | project n1 = src, UserId = tgt, User = tgtName
-) on n1
-| join kind=inner userAccess on UserId
-| summarize AIAgents = make_set(AIAgent) by Device, User, ResourceCount,
- tostring(ResourceTypes)
-| sort by ResourceCount desc
+ | where SourceNodeLabel == "ai-agent"
+ | where EdgeLabel =~ "runs on"
+ | where TargetNodeLabel in (deviceLabels)
+ | project AgentNodeId = SourceNodeId, DeviceId = TargetNodeId,
+ Device = TargetNodeName, DeviceType = TargetNodeLabel;
+let criticalDevices =
+ ExposureGraphNodes
+ | where NodeLabel in (deviceLabels)
+ | where NodeProperties has "criticalityLevel"
+ | extend CriticalityLevel =
+ toint(NodeProperties.rawData.criticalityLevel.criticalityLevel)
+ | where CriticalityLevel between (0 .. 3)
+ | extend Criticality = case(
+ CriticalityLevel == 0, "Very high",
+ CriticalityLevel == 1, "High",
+ CriticalityLevel == 2, "Medium",
+ "Low")
+ | project DeviceId = NodeId, CriticalityLevel, Criticality,
+ CriticalityReason =
+ tostring(NodeProperties.rawData.criticalityLevel.ruleNames);
+riskyAgentProfiles
+| join kind=inner localAgentNodes on AgentId
+| join kind=inner agentDeviceEdges on AgentNodeId
+| join kind=inner criticalDevices on DeviceId
+| project Device, DeviceType, Criticality, CriticalityReason,
+ Agent, Vendor, Version, Account, AutoApprove, TrustedProcess,
+ CriticalityLevel
+| sort by CriticalityLevel asc, Device asc, Agent asc
+| project-away CriticalityLevel
```
-### Find AI agents with paths to critical or sensitive assets
+To review every local AI agent on a critical device instead of only the risky ones, remove the `where AutoApprove =~ "true" or TrustedProcess =~ "false"` line.
+
+### Rank the users whose local AI agents reach critical or sensitive assets
-This query traces access paths from local AI agents through the exposure graph to resources marked as critical or containing sensitive data:
+This query ranks the identities that use local AI agents by how many critical or sensitive resources they can reach, so you can prioritize the users with the widest blast radius. The `UserCriticality` column shows whether the identity is itself classified as a critical asset, such as a Global Administrator:
```kusto
-let accessEdges = dynamic(["contains", "has credentials of", "has permissions to",
- "has role on", "can authenticate as", "can authenticate to",
- "member of", "can impersonate as"]);
-let biEdges =
+let deviceLabels = dynamic(["device", "ec2.instance",
+ "microsoft.compute/virtualmachines"]);
+let localAgents =
+ ExposureGraphNodes
+ | where NodeLabel == "ai-agent"
+ | where tostring(NodeProperties.rawData.aiAgentMetadata.platform) == "LocalAgents"
+ | project AgentNodeId = NodeId, AIAgent = NodeName;
+let agentDeviceEdges =
+ ExposureGraphEdges
+ | where SourceNodeLabel == "ai-agent"
+ | where EdgeLabel =~ "runs on"
+ | where TargetNodeLabel in (deviceLabels)
+ | project AgentNodeId = SourceNodeId, DeviceId = TargetNodeId,
+ Device = TargetNodeName;
+let agentUserEdges =
ExposureGraphEdges
- | where EdgeLabel in (accessEdges)
- | project src = SourceNodeId, tgt = TargetNodeId,
- srcName = SourceNodeName, tgtName = TargetNodeName, edge = EdgeLabel
+ | where SourceNodeLabel == "ai-agent"
+ | where EdgeLabel =~ "used by"
+ | project AgentNodeId = SourceNodeId, UserId = TargetNodeId,
+ User = TargetNodeName;
+let userReach =
+ ExposureGraphEdges
+ | where EdgeLabel in~ ("has permissions to", "has role on")
+ | project UserId = SourceNodeId, AssetId = TargetNodeId
| union (
- ExposureGraphEdges
- | where EdgeLabel in (accessEdges)
- | project src = TargetNodeId, tgt = SourceNodeId,
- srcName = TargetNodeName, tgtName = SourceNodeName, edge = EdgeLabel
+ ExposureGraphNodes
+ | where NodeLabel == "user"
+ | project UserId = NodeId, AssetId = NodeId
);
let sensitiveAssets =
ExposureGraphNodes
- | extend CriticalityLevel = toint(NodeProperties.rawData.criticalityLevel.criticalityLevel)
- | extend HasSensitiveData = iff(isnotempty(NodeProperties.rawData.containsSensitiveData),
- "Yes", "No")
- | extend CriticalityReason = tostring(NodeProperties.rawData.criticalityLevel.ruleNames)
- | where CriticalityLevel > 0 or HasSensitiveData == "Yes"
- | extend Criticality = case(
- CriticalityLevel == 1, "Critical",
- CriticalityLevel == 2, "High",
- CriticalityLevel == 3, "Medium",
- CriticalityLevel == 4, "Low",
- "Sensitive Data"
- )
- | project AssetId = NodeId, AssetName = NodeName, AssetType = NodeLabel,
- Criticality, HasSensitiveData, CriticalityReason;
-ExposureGraphEdges
-| where SourceNodeLabel == "endpointAiAgent"
-| project AIAgent = SourceNodeName, n1 = TargetNodeId, Device = TargetNodeName
-| join kind=inner (
- biEdges | project n1 = src, n2 = tgt, Hop1 = tgtName, Via1 = edge
-) on n1
-| join kind=inner (
- biEdges | project n2 = src, n3 = tgt, Via2 = edge
-) on n2
-| join kind=inner (
- sensitiveAssets | project n3 = AssetId, AssetName, AssetType,
- Criticality, HasSensitiveData, CriticalityReason
-) on n3
-| summarize ExposedVia = make_set(Hop1) by
- AIAgent, Device, AssetName, AssetType,
- Criticality, HasSensitiveData, CriticalityReason
-| sort by Criticality asc, HasSensitiveData desc
+ | where NodeProperties has "criticalityLevel"
+ or NodeProperties has "containsSensitiveData"
+ | extend
+ CriticalityLevel =
+ toint(NodeProperties.rawData.criticalityLevel.criticalityLevel),
+ SensitiveDataRaw = tostring(NodeProperties.rawData.containsSensitiveData)
+ | extend HasSensitiveData =
+ iff(isnotempty(SensitiveDataRaw) and SensitiveDataRaw !~ "false", "Yes", "No")
+ | where CriticalityLevel between (0 .. 3) or HasSensitiveData == "Yes"
+ | extend CriticalityRank =
+ iff(CriticalityLevel between (0 .. 3), CriticalityLevel, 4)
+ | project AssetId = NodeId, AssetName = NodeName,
+ CriticalityRank, HasSensitiveData;
+let agentUsers =
+ localAgents
+ | join kind=inner agentDeviceEdges on AgentNodeId
+ | join kind=inner agentUserEdges on AgentNodeId
+ | project AIAgent, Device, UserId, User;
+agentUsers
+| join kind=inner userReach on UserId
+| join kind=inner sensitiveAssets on AssetId
+| summarize AIAgents = make_set(AIAgent, 20),
+ Devices = make_set(Device, 20),
+ ReachableAssets = dcountif(AssetId, AssetId != UserId),
+ SensitiveAssets = dcountif(AssetId,
+ AssetId != UserId and HasSensitiveData == "Yes"),
+ Assets = make_set_if(AssetName, AssetId != UserId, 50),
+ UserRank = minif(CriticalityRank, AssetId == UserId),
+ AssetRank = minif(CriticalityRank, AssetId != UserId)
+ by User
+| extend UserCriticality = case(
+ UserRank == 0, "Very high",
+ UserRank == 1, "High",
+ UserRank == 2, "Medium",
+ UserRank == 3, "Low",
+ "Not classified"),
+ HighestAssetCriticality = case(
+ AssetRank == 0, "Very high",
+ AssetRank == 1, "High",
+ AssetRank == 2, "Medium",
+ AssetRank == 3, "Low",
+ AssetRank == 4, "Sensitive data",
+ "None")
+| extend SortRank = coalesce(AssetRank, 99)
+| project User, UserCriticality, ReachableAssets, SensitiveAssets,
+ HighestAssetCriticality, AIAgents, Devices, Assets, SortRank
+| sort by SortRank asc, ReachableAssets desc
+| project-away SortRank
```
diff --git a/defender-endpoint/edr-block-mode-faqs.yml b/defender-endpoint/edr-block-mode-faqs.yml
index 4683b55ce4f..644f3c1788b 100644
--- a/defender-endpoint/edr-block-mode-faqs.yml
+++ b/defender-endpoint/edr-block-mode-faqs.yml
@@ -33,7 +33,7 @@ sections:
answer: |
If you get a false positive, you can submit the file for analysis at the [Microsoft Security Intelligence submission site](https://www.microsoft.com/en-us/wdsi/filesubmission).
- You can also define an exclusion for Microsoft Defender Antivirus. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md).
+ You can also define an exclusion for Microsoft Defender Antivirus. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](microsoft-defender-antivirus-exclusions-configure.md).
- question: |
Do I need to turn EDR in block mode on if I have Microsoft Defender Antivirus running on devices?
answer: |
diff --git a/defender-endpoint/edr-detection.md b/defender-endpoint/edr-detection.md
index c25ba7dcfd1..29e5811c39e 100644
--- a/defender-endpoint/edr-detection.md
+++ b/defender-endpoint/edr-detection.md
@@ -9,10 +9,10 @@ ms.collection:
- m365-security
- tier3
- mde-macos
-ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1014
+ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1016
ms.topic: how-to
ms.subservice: edr
-ms.date: 06/17/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
@@ -24,6 +24,8 @@ ai-usage: ai-assisted
## Prerequisites
+Before you run the EDR detection test, make sure your environment meets these requirements:
+
- Windows client devices must be running Windows 11, Windows 10 version 1709 build 16273 or newer, Windows 8.1, or Windows 7 SP1.
- Windows server devices must be running Windows Server 2008 R2 SP1, Windows Server 2012 R2 and later, or Azure Stack HCI OS, version 23H2 and later.
- Linux servers must be running a supported version (see [Prerequisites for Microsoft Defender for Endpoint on Linux](mde-linux-prerequisites.md))
@@ -33,26 +35,28 @@ Endpoint detection and response (EDR) in Microsoft Defender for Endpoint provide
## Run an EDR detection test
+Use the following platform-specific procedures to run the EDR detection test.
+
### Run the EDR detection test on Windows
> [!TIP]
> The Windows device must be listening for requests on TCP port 80 for the following commands to work. You can verify by running the following PowerShell command: `Test-NetConnection 127.0.0.1 -Port 80`.
-In a Command Prompt window, run the following commands:
+In a Command Prompt window, run the following command to download and launch a test file that triggers an EDR detection:
```dos
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference='silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-WDATP-test\\invoice.exe');Start-Process 'C:\\test-WDATP-test\\invoice.exe'
```
-If the command runs successfully and the test file executes, the detection test is marked as completed and a new alert appears within a few minutes.
+If the command runs successfully and the test file executes, the Windows EDR detection test is marked as completed and a new alert appears within a few minutes.
### Run the EDR detection test on Linux
Perform the following steps to run the EDR detection test on Linux.
-1. Download the MDE Linux EDR DIY package to an onboarded Linux server so you can extract and run the test script locally. For more information, see the [script file](https://aka.ms/MDE-Linux-EDR-DIY).
+1. Download the MDE Linux EDR DIY package to an onboarded Linux server so you can extract and run the test script locally. For more information, see the [MDE Linux EDR DIY test script](https://aka.ms/MDE-Linux-EDR-DIY).
```bash
curl -o ~/Downloads/MDE-Linux-EDR-DIY.zip -L https://aka.ms/MDE-Linux-EDR-DIY
@@ -133,7 +137,7 @@ Perform the following steps to run the EDR detection test on macOS.
## Next steps
-If you're experiencing issues with application compatibility or performance, you might consider adding exclusions. See the following articles for more information:
+If you have app compatibility or performance issues, consider adding exclusions. For more information, see:
- [Configure and validate exclusions for Microsoft Defender for Endpoint on macOS](mac-exclusions.md)
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
diff --git a/defender-endpoint/edr-in-block-mode.md b/defender-endpoint/edr-in-block-mode.md
index fae89741e5d..485e8d33421 100644
--- a/defender-endpoint/edr-in-block-mode.md
+++ b/defender-endpoint/edr-in-block-mode.md
@@ -1,6 +1,6 @@
---
title: Endpoint detection and response in block mode
-description: Learn about endpoint detection and response in block mode
+description: Learn about endpoint detection and response in block mode.
author: limwainstein
ms.author: lwainstein
ms.reviewer: pahuijbr, kausd
@@ -9,11 +9,13 @@ ms.service: defender-endpoint
ms.subservice: edr
ms.localizationpriority: medium
ms.custom:
+ - msecd-doc-authoring-1015
- next-gen
- mde-edr
- admindeeplinkDEFENDER
- sfi-ga-nochange
-ms.date: 10/20/2025
+ms.date: 08/12/2026
+ai-usage: ai-assisted
ms.collection:
- m365-security
- tier2
@@ -21,6 +23,7 @@ ms.collection:
appliesto:
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender Antivirus
+#customer intent: As a security administrator, I want to understand endpoint detection and response in block mode so that endpoints can remediate malicious artifacts when Microsoft Defender Antivirus isn't the primary antivirus product.
---
# Endpoint detection and response in block mode
@@ -65,6 +68,7 @@ When EDR in block mode is turned on, and a malicious artifact is detected, Defen
## Enable EDR in block mode
> [!IMPORTANT]
+>
> - Make sure the [requirements](#requirements-for-edr-in-block-mode) are met before turning on EDR in block mode.
> - Defender for Endpoint Plan 2 licenses are required.
> - Beginning with [platform version 4.18.2202.X](microsoft-defender-antivirus-updates.md), you can set EDR in block mode to target specific device groups using Intune CSPs. You can continue to set EDR in block mode tenant-wide in the [Microsoft Defender portal](https://security.microsoft.com).
@@ -90,17 +94,23 @@ For more information on the Defender CSP used for EDR in block mode, see "Config
You can use Group Policy to enable EDR in block mode.
-1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
+
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
-1. Right-click the Group Policy Object you want to configure, and then select **Edit**.
+1. Right-click the GPO, and then select **Edit**.
-1. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Features**.
-1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Features**.
+1. In the details pane of **Features**, open the **Enable EDR in block mode** setting. To open the setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
-1. Double-click **Enable EDR in block mode** and set the option to **Enabled**.
+1. In the setting window that opens, select **Enabled**, and then select **OK**.
-1. Select **OK**.
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Features**.
## Requirements for EDR in block mode
@@ -117,7 +127,7 @@ The following table lists requirements for EDR in block mode:
|Microsoft Defender Antivirus engine|Devices must be up to date. To confirm, using PowerShell, run the [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus) cmdlet as an administrator. In the **AMEngineVersion** line, you should see **1.1.16700.2** or above.
To learn more, see [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md).|
> [!IMPORTANT]
-> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your [exclusions are configured](configure-exclusions-microsoft-defender-antivirus.md). EDR in block mode respects exclusions that are defined for Microsoft Defender Antivirus, but not [indicators](indicators-overview.md) that are defined for Microsoft Defender for Endpoint.
+> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your [exclusions are configured](microsoft-defender-antivirus-exclusions-configure.md). EDR in block mode respects exclusions that are defined for Microsoft Defender Antivirus, but not [indicators](indicators-overview.md) that are defined for Microsoft Defender for Endpoint.
>
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
@@ -125,6 +135,3 @@ The following table lists requirements for EDR in block mode:
## See also
- [Endpoint detection and response (EDR) in block mode frequently asked questions (FAQ)](edr-block-mode-faqs.yml)
-
-
-
diff --git a/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md b/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md
index 9c3ede387bf..a3217043bf3 100644
--- a/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md
+++ b/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md
@@ -6,9 +6,9 @@ ms.localizationpriority: medium
ms.topic: how-to
author: chrisda
ms.author: chrisda
-ms.date: 06/16/2026
+ms.date: 08/12/2026
ms.reviewer: pahuijbr
-ms.custom: nextgen, msecd-doc-authoring-1014
+ms.custom: nextgen, msecd-doc-authoring-1015
ms.subservice: asr
ms.collection:
- m365-security
@@ -20,6 +20,7 @@ appliesto:
- Microsoft Defender Antivirus
ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to turn on cloud protection so that Microsoft Defender Antivirus can use cloud-delivered detection and protection features.
---
# Turn on cloud protection in Microsoft Defender Antivirus
@@ -41,33 +42,31 @@ The following operating systems support cloud protection:
Microsoft Defender Antivirus cloud protection helps protect against malware on your endpoints and across your network. We recommend keeping cloud protection turned on, because certain security features and capabilities in Microsoft Defender for Endpoint only work when cloud protection is enabled.
-[](enable-cloud-protection-microsoft-defender-antivirus.md)
+[](enable-cloud-protection-microsoft-defender-antivirus.md)
+The following table summarizes the features and capabilities that depend on cloud protection:
-The following table summarizes the features and capabilities that depend on cloud protection:
-
-| Feature/Capability | Subscription requirement | Description |
-|---------|---------|--------|
+| Feature/Capability | Subscription requirement | Description |
+| --- | --- | --- |
| **Checking against metadata in the cloud**. The Microsoft Defender Antivirus cloud service uses machine learning models as an extra layer of defense. These machine learning models include metadata, so when a suspicious or malicious file is detected, its metadata is checked.
To learn more, see [Blog: Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/) | Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5) |
| **[Cloud protection and sample submission](cloud-protection-microsoft-antivirus-sample-submission.md)**. Files and executables can be sent to the Microsoft Defender Antivirus cloud service for detonation and analysis. Automatic sample submission relies on cloud protection, although it can also be configured as a standalone setting.
To learn more, see [Cloud protection and sample submission in Microsoft Defender Antivirus](cloud-protection-microsoft-antivirus-sample-submission.md). | Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5) |
| **[Tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md)**. Tamper protection helps protect against unwanted changes to your organization's security settings.
To learn more, see [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md). | Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5) |
-| **[Block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md)**
Block at first sight detects new malware and blocks it within seconds. When a suspicious or malicious file is detected, block at first sight capabilities queries the cloud protection backend and applies heuristics, machine learning, and automated analysis of the file to determine whether it's a threat.
To learn more, see [What is "block at first sight"?](configure-block-at-first-sight-microsoft-defender-antivirus.md#what-is-block-at-first-sight) | Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5) |
+| **[Block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md)**
Block at first sight detects new malware and blocks it within seconds. When a suspicious or malicious file is detected, block at first sight capabilities queries the cloud protection backend and applies heuristics, machine learning, and automated analysis of the file to determine whether it's a threat.
To learn more, see [What is "block at first sight"?](configure-block-at-first-sight-microsoft-defender-antivirus.md) | Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5) |
| **[Emergency signature updates](microsoft-defender-antivirus-updates.md#security-intelligence-updates)**. When malicious content is detected, emergency signature updates and fixes are deployed. Rather than wait for the next regular update, you can receive these fixes and updates within minutes.
To learn more about updates, see [Microsoft Defender Antivirus security intelligence and product updates](microsoft-defender-antivirus-updates.md). | Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5) |
| **[Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md)**. EDR in block mode provides extra protection when Microsoft Defender Antivirus isn't the primary antivirus product on a device. EDR in block mode remediates artifacts found during EDR-generated scans that the non-Microsoft, primary antivirus solution might have missed. When enabled for devices with Microsoft Defender Antivirus as the primary antivirus solution, EDR in block mode provides the added benefit of automatically remediating artifacts identified during EDR-generated scans.
To learn more, see [EDR in block mode](edr-in-block-mode.md). | Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5) |
| **[Attack surface reduction (ASR) rules](attack-surface-reduction-rules-overview.md)**. ASR rules block risky behavior from apps. Some ASR rules require cloud protection. For m9ore information, see [Requirements for ASR rules](attack-surface-reduction-rules-overview.md#requirements-for-asr-rules). | Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5) |
| **[Indicators of compromise (IoCs)](indicators-overview.md)**. In Defender for Endpoint, IoCs can be configured to define the detection, prevention, and exclusion of entities. Examples:
"Allow" indicators can be used to define exceptions to antivirus scans and remediation actions.
"Alert and block" indicators can be used to prevent files or processes from executing.
To learn more, see [Create indicators](indicators-overview.md). | Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5) |
-
## Methods to configure cloud protection
-You can turn Microsoft Defender Antivirus cloud protection on or off by using one of several methods, such as:
+You can turn Microsoft Defender Antivirus cloud protection on or off by using one of the following methods:
- [Turn on cloud protection in Microsoft Defender Antivirus](#turn-on-cloud-protection-in-microsoft-defender-antivirus)
- [Why cloud protection should be turned on](#why-cloud-protection-should-be-turned-on)
- [Methods to configure cloud protection](#methods-to-configure-cloud-protection)
- [Use Microsoft Intune to turn on cloud protection](#use-microsoft-intune-to-turn-on-cloud-protection)
- [Use Group Policy to turn on cloud protection](#use-group-policy-to-turn-on-cloud-protection)
- - [Use PowerShell cmdlets to turn on cloud protection](#use-powershell-cmdlets-to-turn-on-cloud-protection)
+ - [Use PowerShell cmdlets to turn on cloud protection](#use-powershell-to-turn-on-cloud-protection)
- [Use Windows Management Instrumentation (WMI) to turn on cloud protection](#use-windows-management-instruction-wmi-to-turn-on-cloud-protection)
- [Turn on cloud protection on individual clients with the Windows Security app](#turn-on-cloud-protection-on-individual-clients-with-the-windows-security-app)
- [See also](#see-also)
@@ -81,71 +80,103 @@ For more information about the specific network-connectivity requirements to ens
## Use Microsoft Intune to turn on cloud protection
-To enable cloud protection by using Microsoft Intune, perform the following steps:
+To enable cloud protection by using Microsoft Intune, you first select an existing policy or create a new policy.
-1. Go to the [Microsoft Intune admin center](https://intune.microsoft.com) and sign in.
+To create a new policy and enable cloud protection in Intune, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the endpoint security policy, use these settings:
-1. Choose **Endpoint security** \> **Antivirus**.
+- **Policy type**: Antivirus
+- **Platform**: Windows
+- **Profile**: Microsoft Defender Antivirus
+- **Basics**: Specify a name and description for the policy
+- **Defender**: Find **Allow Cloud Protection** and set it to **Allowed**.
+- **Submit Samples Consent**: Select **Send all samples automatically** or **Send safe samples automatically**
+- **Scope tags**: If your organization is using [scope tags](/intune/intune-service/fundamentals/scope-tags), select the tags you want to use
+- **Assignments**: Select the groups, users, or devices to whicj that you want to apply this policy
-1. In the **AV policies** section, either select an existing policy, or choose **+ Create Policy**.
+When modifying an existing policy, see Modify existing policies (opens in a new tab in the Intune documentation). Select the antivirus policy you want to edit and choose the following options:
- | Task | Steps |
- |---------|---------|
- | Create a new policy | 1. For **Platform**, select **Windows**.
2. For **Profile**, select **Microsoft Defender Antivirus**.
3. On the **Basics** page, specify a name and description for the policy, and then choose **Next**.
4. In the **Defender** section, find **Allow Cloud Protection**, and set it to **Allowed**.
5. Scroll down to **Submit Samples Consent**, and select one of the following settings:
- **Send all samples automatically**
- **Send safe samples automatically**
6. On the **Scope tags** step, if your organization is using [scope tags](/intune/intune-service/fundamentals/scope-tags), select the tags you want to use, and then choose **Next**.
7. On the **Assignments** step, select the groups, users, or devices that you want to apply this policy to, and then choose **Next**.
8. On the **Review + create** step, review the settings for your policy, and then choose **Create**. |
- | Edit an existing policy | 1. Select the policy that you want to edit.
2. Under **Configuration settings**, choose **Edit**.
3. In the **Defender** section, find **Allow Cloud Protection**, and set it to **Allowed**.
4. Scroll down to **Submit Samples Consent**, and select one of the following settings:
- **Send all samples automatically**
- **Send safe samples automatically**
5. Select **Review + save**. |
+- **Defender**: Find **Allow Cloud Protection** and set it to **Allowed**.
+- **Submit Samples Consent**: Select **Send all samples automatically** or **Send safe samples automatically**
> [!TIP]
> To learn more about Microsoft Defender Antivirus settings in Intune, see [Antivirus policy for endpoint security in Intune](/intune/intune-service/protect/endpoint-security-antivirus-policy).
## Use Group Policy to turn on cloud protection
+> [!NOTE]
+> MAPS settings are equal to cloud-delivered protection.
+
To enable cloud protection by using Group Policy, perform the following steps:
-1. On your Group Policy management device, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and select **Edit**.
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
-1. In the **Group Policy Management Editor**, go to **Computer configuration**.
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
-1. Select **Administrative templates**.
+1. Right-click the GPO, and then select **Edit**.
-1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus > MAPS**
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **MAPS**.
- > [!NOTE]
- > MAPS settings are equal to cloud-delivered protection.
+ > [!NOTE]
+ > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Antivirus instead of _Microsoft_ Defender Antivirus. Both names refer to the same policy location.
-1. Double-click **Join Microsoft MAPS**. Ensure the option is turned on and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**.
+1. In the details pane of **MAPS**, the available settings are:
+ - [Join Microsoft MAPS](#enable-and-configure-join-microsoft-maps)
+ - [Send file samples when further analysis is required](#enable-and-configure-send-file-samples-when-further-analysis-is-required)
- You can choose to send basic or additional information about detected software:
+ To open and configure a cloud protection setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
- - Basic MAPS: Basic membership sends basic information to Microsoft about malware and potentially unwanted software that has been detected on your device. Information includes where the software came from (like URLs and partial paths), the actions taken to resolve the threat, and whether the actions were successful.
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **MAPS**.
- - Advanced MAPS: In addition to basic information, advanced membership sends detailed information about malware and potentially unwanted software, including the full path to the software, and detailed information about how the software has affected your device.
+### Enable and configure Join Microsoft Maps
-1. Double-click **Send file samples when further analysis is required**. Ensure that the first option is set to **Enabled** and that the other options are set to either:
+1. In the details pane of **MAPS**, open the **Join Microsoft MAPS** setting.
- - **Send safe samples** (1)
- - **Send all samples** (3)
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Join Microsoft MAPS** in the **Options** section: Select one of the following values:
+ - **Basic MAPS**: Basic membership sends basic information to Microsoft about malware and potentially unwanted software that has been detected on your device. Information includes where the software came from (like URLs and partial paths), the actions taken to resolve the threat, and whether the actions were successful.
+ - **Advanced MAPS**: In addition to basic information, advanced membership sends detailed information about malware and potentially unwanted software, including the full path to the software, and detailed information about how the software has affected your device.
- > [!NOTE]
- > The **Send safe samples** (1) option means that most samples are sent automatically. Files that are likely to contain personal information prompt the user for additional confirmation.
- > Setting the option to **Always Prompt** (0) lowers the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work.
+ When you're finished, select **OK**.
+
+### Enable and configure Send file samples when further analysis is required
+
+1. In the details pane of **MAPS**, open the **Send file samples when further analysis is required** setting.
-1. Select **OK**.
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Send file samples when further analysis is required** in the **Options** section: Select one of the following values:
+ - **Send safe samples**: Most samples are sent automatically. Files that are likely to contain personal information prompt the user for more confirmation.
+ - **Send all samples**
-## Use PowerShell cmdlets to turn on cloud protection
+ When you're finished, select **OK**.
+
+> [!NOTE]
+>
+> - **Always Prompt** lowers the protection state of the device.
+> - **Never send** lowers the protection state of the device and disables [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md).
-The following cmdlets enable advanced cloud-delivered protection (MAPS) reporting and configure automatic sample submission for all file types:
+
-```PowerShell
-Set-MpPreference -MAPSReporting Advanced
-Set-MpPreference -SubmitSamplesConsent SendAllSamples
+## Use PowerShell to turn on cloud protection
+
+The following command in an elevated PowerShell prompt (a PowerShell window you opened by selecting **Run as administrator**) enables advanced cloud-delivered protection (Microsoft Active Protection Service (MAPS)) reporting and configures automatic sample submission for all file types:
+
+```powershell
+Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendAllSamples
```
-For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Microsoft Defender Antivirus cmdlets](/powershell/module/defender/). [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent).
+_SubmitSamplesConsent_ supports the following values:
-> [!IMPORTANT]
-> You can set **-SubmitSamplesConsent** to `SendSafeSamples` (the default, recommended setting), `NeverSend`, or `AlwaysPrompt`.
-> The `SendSafeSamples` setting means that most samples are sent automatically. Files that are likely to contain personal information result in a prompt for the user to continue, and require confirmation.
-> The `NeverSend` and `AlwaysPrompt` settings lower the protection level of the device. Furthermore, the `NeverSend` setting means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work.
+- `SendSafeSamples`: The default, recommended setting. Most samples are sent automatically. Files that are likely to contain personal information result in a prompt for the user to continue, and require confirmation.
+- `AlwaysPrompt`: Lowers the protection state of the device.
+- `NeverSend`: Lowers the protection state of the device and disables [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md).
+
+For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Microsoft Defender Antivirus cmdlets](/powershell/module/defender/). [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent).
@@ -163,7 +194,7 @@ For more information about allowed parameters, see [Windows Defender WMIv2 APIs]
## Turn on cloud protection on individual clients with the Windows Security app
> [!NOTE]
-> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings are greyed out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting is updated in Windows Settings.
+> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in **Windows Security > Virus & threat protection settings** is greyed out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting is updated in **Windows Security > Virus & threat protection settings**.
1. Open the Windows Security app by selecting the shield icon in the task bar, or by searching the start menu for **Windows Security**.
@@ -179,13 +210,12 @@ For more information about allowed parameters, see [Windows Defender WMIv2 APIs]
## See also
- [Use Microsoft cloud protection in Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md)
-
- [Configuration Manager: Microsoft Defender for Endpoint](/intune/configmgr/protect/deploy-use/defender-advanced-threat-protection)
-
- [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md)
> [!TIP]
> If you're looking for Antivirus related information for other platforms, see:
+>
> - [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md)
> - [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md)
> - [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/intune/intune-service/protect/antivirus-microsoft-defender-settings-macos)
@@ -193,6 +223,3 @@ For more information about allowed parameters, see [Windows Defender WMIv2 APIs]
> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
> - [Configure Defender for Endpoint on Android features](android-configure.md)
> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)
-
-
-
diff --git a/defender-endpoint/enable-controlled-folders.md b/defender-endpoint/enable-controlled-folders.md
deleted file mode 100644
index 3ef6f6bfc33..00000000000
--- a/defender-endpoint/enable-controlled-folders.md
+++ /dev/null
@@ -1,141 +0,0 @@
----
-title: Enable controlled folder access
-description: Learn how to protect your important files by enabling Controlled folder access.
-ms.service: defender-endpoint
-ms.topic: how-to
-ms.localizationpriority: medium
-author: paulinbar
-ms.author: painbar
-ms.reviewer: sugamar; moeghasemi
-ms.subservice: asr
-ms.collection:
-- m365-security
-- tier3
-- mde-asr
-ms.date: 06/17/2026
-appliesto:
- - Microsoft Defender for Endpoint Plan 1
- - Microsoft Defender for Endpoint Plan 2
- - Microsoft Defender Antivirus
-ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
----
-
-# Enable controlled folder access
-
-[Controlled folder access](controlled-folders.md) helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is available in the following operating systems:
-
-- Included in Windows 10 or later.
-- Included in Windows Server 2019 or later.
-- Available in Windows Server 2016 and Windows Server 2012 R2 as part of the [modern, unified Microsoft Defender for Endpoint solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
-
-You can enable controlled folder access by using any of the following methods described in this article:
-
-- [Enable controlled folder access in the Microsoft Intune admin center](#enable-controlled-folder-access-in-the-microsoft-intune-admin-center)
- - [Mobile Device Management (MDM)](#mobile-device-management-mdm)
- - [Microsoft Configuration Manager](#microsoft-configuration-manager)
- - [Group Policy](#group-policy)
- - [PowerShell](#powershell)
-
-> [!TIP]
-> Exclusions don't work if you're using [data loss prevention (DLP)](/purview/dlp-learn-about-dlp). Do the following steps to investigate:
->
-> 1. Download and install the [Defender for Endpoint client analyzer](run-analyzer-windows.md).
-> 2. Run a trace for at least five minutes.
-> 3. In the resulting `MDEClientAnalyzerResult.zip` output file, extract the contents of the `EventLogs` folder, and search for instances of `DLP EA` in the available `.evtx` log files.
-
-## Prerequisites
-
-### Supported operating systems
-
-Controlled folder access is supported on the following operating systems:
-
-- Windows
-
-## Enable controlled folder access in the Microsoft Intune admin center
-
-To configure controlled folder access using a Microsoft Intune Endpoint Security **Attack surface reduction** policy, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:
-
-- **Policy type**: Attack surface reduction
-- **Platform**: Windows 10, Windows 11, and Windows Server
-- **Profile**: Attack Surface Reduction Rules
-- **Configuration settings**: Set **Enable Controlled Folder Access** to **Audit mode** to assess impact before switching to **Enabled**
-
-For more information about the Intune attack surface reduction profile used to configure controlled folder access, see [Manage attack surface reduction settings with Microsoft Intune](/intune/intune-service/protect/endpoint-security-asr-policy#attack-surface-reduction-profiles).
-
-
-## Enable controlled folder access by using Mobile Device Management (MDM)
-
-To configure controlled folder access with MDM, use the [ControlledFolderAccessProtectedFolders policy CSP](/windows/client-management/mdm/policy-csp-defender) (`./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders`) to allow apps to make changes to protected folders.
-
-
-## Enable controlled folder access by using Microsoft Configuration Manager
-
-To enable controlled folder access by using Microsoft Configuration Manager, perform the following steps:
-
-1. In Microsoft Configuration Manager, go to **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
-
-1. Select **Home** > **Create Exploit Guard Policy**.
-
-1. Enter a name and a description, select **Controlled folder access**, and select **Next**.
-
-1. Choose whether block or audit changes, allow other apps, or add other folders, and select **Next**.
-
- > [!NOTE]
- > Wildcard is supported for applications, but not for folders. Allowed apps continue to trigger events until they're restarted.
-
-1. Review the settings and select **Next** to create the policy.
-
-1. After the policy is created, **Close**.
-
-For more information about Microsoft Configuration Manager and Controlled Folder Access, visit [Controlled folder access policies and options](/intune/configmgr/protect/deploy-use/create-deploy-exploit-guard-policy).
-
-
-## Enable controlled folder access by using Group Policy
-
-Use the following steps to configure controlled folder access with Group Policy:
-
-1. On your Group Policy management device, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console). Right-click the Group Policy Object you want to configure and select **Edit**.
-
-1. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
-
-1. Expand the tree to **Windows components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled folder access**.
-
-1. Double-click the **Configure Controlled folder access** setting and set the option to **Enabled**. In the options section, you must specify one of the following options:
-
- - **Enable** - Malicious and suspicious apps aren't allowed to make changes to files in protected folders. A notification is provided in the Windows event log.
- - **Disable (Default)** - The Controlled folder access feature won't work. All apps can make changes to files in protected folders.
- - **Audit Mode** - Changes are allowed if a malicious or suspicious app attempts to make a change to a file in a protected folder. However, it's recorded in the Windows event log where you can assess the impact on your organization.
- - **Block disk modification only** - Attempts by untrusted apps to write to disk sectors are logged in Windows Event log. These logs can be found in **Applications and Services Logs** > Microsoft > Windows > Windows Defender > Operational > ID 1123.
- - **Audit disk modification only** - Only attempts to write to protected disk sectors are recorded in the Windows event log (under **Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Defender** > **Operational** > **ID 1124**). Attempts to modify or delete files in protected folders won't be recorded.
-
- :::image type="content" source="/defender/media/cfa-gp-enable.png" alt-text="Screenshot shows the group policy option enabled and Audit Mode selected." lightbox="/defender/media/cfa-gp-enable.png":::
-
-> [!IMPORTANT]
-> To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and select **Block** in the options drop-down menu.
-
-
-## Enable controlled folder access by using PowerShell
-
-Use PowerShell to enable controlled folder access as follows:
-
-1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**.
-
-1. Run the following command to enable controlled folder access and help protect sensitive folders from unauthorized changes by ransomware or other untrusted apps:
-
- ```powershell
- Set-MpPreference -EnableControlledFolderAccess Enabled
- ```
-
- You can enable the feature in audit mode by specifying `AuditMode` instead of `Enabled`. Use `Disabled` to turn off the feature.
-
-For detailed syntax and parameter information, see [Set-MpPreference EnableControlledFolderAccess parameter](/powershell/module/defender/set-mppreference#-enablecontrolledfolderaccess).
-
-
-## Related content
-
-- [Protect important folders with controlled folder access](controlled-folders.md)
-- [Customize controlled folder access](customize-controlled-folders.md)
-- [Evaluate Microsoft Defender for Endpoint](evaluate-mde.md)
-
-
diff --git a/defender-endpoint/enable-exploit-protection.md b/defender-endpoint/enable-exploit-protection.md
index 18b43e6a70d..8f7ce5edd2c 100644
--- a/defender-endpoint/enable-exploit-protection.md
+++ b/defender-endpoint/enable-exploit-protection.md
@@ -8,23 +8,26 @@ ms.author: lwainstein
ms.reviewer: ksarens
ms.subservice: asr
ms.topic: how-to
-ms.collection:
+ms.collection:
- m365-security
- tier3
- mde-asr
-ms.date: 06/16/2026
+ms.date: 08/12/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1015
+#customer intent: As a security administrator, I want to configure exploit protection so that Windows devices use the required mitigations against attacks.
---
# Enable exploit protection
[Exploit protection](exploit-protection.md) helps protect against malware that uses exploits to infect devices and spread. Exploit protection consists of many mitigations that can be applied to either the operating system or individual apps.
+This article describes how to enable and configure exploit protection mitigations by using the Windows Security app, Microsoft Intune, MDM, Microsoft Configuration Manager, Group Policy, or PowerShell.
+
> [!IMPORTANT]
> .NET 2.0 is not compatible with some exploit protection capabilities, specifically, Export Address Filtering (EAF) and Import Address Filtering (IAF). If you have enabled .NET 2.0, usage of EAF and IAF are not supported.
@@ -49,11 +52,12 @@ The following recommendations can help you successfully deploy exploit protectio
Safe deployment practices (SDP): Safe deployment processes and procedures define how to safely make and deploy changes to your workload. Implementing SDP requires you to think about deployments through the lens of managing risk. You can minimize the risk of end-user productivity outages in your deployments and limit the effects of problematic deployments on your users by implementing SDP.
-Start out with a small set (for example, 10 to 50) of Windows devices and use that as your test environment to see which of the 21 mitigations, are incompatible with exploit protection. Remove the mitigations that aren't compatible with the application. Reiterate with the applications that you're targeting. Once the exploit protection policy is ready for production, begin rolling it out more broadly.
+Start out with a small set (for example, 10 to 50) of Windows devices and use that device group as your test environment to see which of the 21 mitigations, are incompatible with exploit protection. Remove the mitigations that aren't compatible with the application. Reiterate with the applications that you're targeting. Once the exploit protection policy is ready for production, begin rolling it out more broadly.
Start out by pushing first to User Acceptance Testing (UAT) comprised of the IT administrators, Security administrators and help desk personnel. Then to 1%, 5%, 10%, 25%, 50%, 75%, and finally to 100% of your environment.
-## Enabling exploit protection mitigations
+
+## Enable exploit protection mitigations
You can enable each mitigation separately by using any of the following methods:
@@ -64,13 +68,15 @@ You can enable each mitigation separately by using any of the following methods:
- [Group Policy](#group-policy)
- [PowerShell](#powershell)
-Exploit protection is configured by default in Windows 10 and Windows 11. You can set each mitigation to on, off, or to its default value. Some mitigations have more options. You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other devices.
+Exploit protection is configured by default in Windows 10 and Windows 11. You can set each mitigation to on, off, or to its default value. Some mitigations have more options. You can [export the exploit protection mitigation settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other devices.
You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the device.
## Enable exploit protection by using the Windows Security app
+Use the following steps to configure exploit protection mitigations in the Windows Security app:
+
1. Open the Windows Security app by either selecting the shield icon in your task bar, or by searching the Start menu for **Security**.
1. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection settings**.
@@ -148,7 +154,7 @@ For more information about attack surface reduction policies in Microsoft Intune
## Enable exploit protection by using MDM
-Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode.
+Use the [ExploitGuard ExploitProtectionSettings configuration service provider (CSP)](/windows/client-management/mdm/policy-csp-exploitguard) to enable or disable exploit protection mitigations or to use audit mode.
## Enable exploit protection by using Microsoft Configuration Manager
@@ -158,7 +164,7 @@ You can deploy exploit protection through Configuration Manager by using either
### Enable exploit protection from the Endpoint Security node
-Use the following steps to create an exploit protection policy from the Endpoint Security node:
+To create an exploit protection policy in Microsoft Configuration Manager by using the Endpoint Security node, follow these steps:
1. In Microsoft Configuration Manager, go to **Endpoint Security** \> **Attack surface reduction**.
@@ -175,7 +181,7 @@ Use the following steps to create an exploit protection policy from the Endpoint
### Enable exploit protection from the Assets and Compliance workspace
-Use the following steps to create an exploit protection policy from the Assets and Compliance workspace:
+To create an exploit protection policy in Microsoft Configuration Manager by using the Assets and Compliance workspace, follow these steps:
1. In Microsoft Configuration Manager, go to **Assets and Compliance** \> **Endpoint Protection** \> **Windows Defender Exploit Guard**.
@@ -194,13 +200,30 @@ Use the following steps to create an exploit protection policy from the Assets a
Perform the following steps to configure exploit protection through Group Policy:
-1. On your Group Policy management device, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). Right-click the Group Policy Object you want to configure and select **Edit**.
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
+
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
+
+1. Right-click the GPO, and then select **Edit**.
+
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Exploit Guard** \> **Exploit Protection**.
-1. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
+ > [!NOTE]
+ > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Exploit Guard instead of _Microsoft_ Defender Exploit Guard. Both names refer to the same policy location.
-1. Expand the tree to **Windows components** \> **Windows Defender Exploit Guard** \> **Exploit Protection** \> **Use a common set of exploit protection settings**.
+1. In the details pane of **Exploit Protection**, open the **Use a common set of exploit protection settings** setting. To open the setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
-1. Select **Enabled** and type the location of the [XML file](/windows/client-management/mdm/policy-csp-exploitguard), and then choose **OK**.
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file** in the **Options** section: Enter the location of the [XML file](/windows/client-management/mdm/policy-csp-exploitguard).
+
+ When you're finished, select **OK**.
+
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Exploit Guard** \> **Exploit Protection**.
## Enable exploit protection by using PowerShell
@@ -213,6 +236,7 @@ Get-ProcessMitigation -Name processName.exe
> [!IMPORTANT]
> System-level mitigations that have not been configured will show a status of `NOTSET`.
+>
> - For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied.
> - For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied.
> The default setting for each system-level mitigation can be seen in the Windows Security.
@@ -249,7 +273,7 @@ To enable DEP as a system-wide mitigation that applies to all processes, use the
Set-Processmitigation -System -Enable DEP
```
-To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this action forces the mitigation to be disabled only for that app.
+To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, replacing `-Enable` with `-Disable` forces the mitigation to be disabled only for that app.
To remove an app-specific DEP override and restore the mitigation back to the system default, include the `-Remove` cmdlet as shown in the following example:
@@ -291,19 +315,18 @@ Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlu
[2]: Audit for this mitigation isn't available via PowerShell cmdlets.
-## Customize the notification
+
+## Customize exploit protection notifications
-For information about customizing the notification when a rule is triggered and an app or file is blocked, see [Windows Security](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center).
+For information about customizing the notification when a rule is triggered and an app or file is blocked, see [Windows Security](/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center).
-## Removing the exploit protection mitigations
+
+## Remove exploit protection mitigations
-To reset (undo or remove) the exploit protection mitigations, see the [Exploit protection reference](exploit-protection-reference.md).
+To reset (undo or remove) exploit protection mitigations, see [Reset or remove exploit protection mitigations](exploit-protection-reference.md).
## See also
- [Evaluate exploit protection](evaluate-exploit-protection.md)
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
-
-
-
diff --git a/defender-endpoint/enable-network-protection.md b/defender-endpoint/enable-network-protection.md
index 1578192b44d..7c5f8693ce2 100644
--- a/defender-endpoint/enable-network-protection.md
+++ b/defender-endpoint/enable-network-protection.md
@@ -3,7 +3,7 @@ title: Turn on network protection
description: Enable network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager.
ms.service: defender-endpoint
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/02/2026
ms.topic: how-to
author: paulinbar
ms.author: painbar
@@ -18,7 +18,7 @@ appliesto:
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender Antivirus
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Turn on network protection
@@ -28,7 +28,7 @@ ms.custom: msecd-doc-authoring-1014
> [!IMPORTANT]
> On Windows Server, Network Protection is an opt-in capability. Before any policy from Defender, Intune, or SCCM can enable it, the operating system must explicitly allow the feature using the **AllowNetworkProtectionOnWinServer** setting. Without this prerequisite, the Defender agent ignores any Network Protection configuration, even if it is successfully deployed, resulting in the feature appearing as not applied.
-For details, see [Network filtering configuration options](/intune/intune-service/protect/endpoint-protection-windows-10#network-filtering).
+For details about network filtering settings, see [Network filtering configuration options](/intune/intune-service/protect/endpoint-protection-windows-10#network-filtering).
## Prerequisites
@@ -42,15 +42,18 @@ Network protection is supported on the following operating systems:
## Enable network protection
-To enable network protection, you can use any of the methods described in this article.
+To enable network protection, you can use Microsoft Defender for Endpoint Security Settings Management, Microsoft Intune, Group Policy, PowerShell, Microsoft Configuration Manager, or mobile device management (MDM).
-### Microsoft Defender for Endpoint Security Settings Management
+
+### Enable network protection with Defender for Endpoint security settings management
> [!TIP]
> This method requires the **Security Administrator** role in Microsoft Entra ID.
#### Create an endpoint security policy
+Use the following steps to create an endpoint security policy that enables network protection:
+
1. In the Microsoft Defender portal at
Windows Server 2012 R2 with the [unified agent for Microsoft Defender for Endpoint](enable-network-protection.md)|`Set-MpPreference -AllowNetworkProtectionDownLevel $true`
`Set-MpPreference -AllowNetworkProtectionOnWinServer $true`|
+ |Windows Server 2016
Windows Server 2012 R2 with the [unified agent for Microsoft Defender for Endpoint](configure-server-endpoints.md#functionality-in-the-modern-unified-solution)|`Set-MpPreference -AllowNetworkProtectionDownLevel $true`
`Set-MpPreference -AllowNetworkProtectionOnWinServer $true`|
> [!IMPORTANT]
> Disable the "AllowDatagramProcessingOnWinServer" setting. Disabling this setting is important for any roles that generate high volumes of UDP traffic such as Domain Controllers, Windows DNS servers, Windows File Servers, Microsoft SQL servers, Microsoft Exchange servers, and others. Enabling datagram processing in these cases can reduce network performance and reliability. Disabling it helps keep the network stable and ensures better use of system resources in high-demand environments.
diff --git a/defender-endpoint/enable-troubleshooting-mode.md b/defender-endpoint/enable-troubleshooting-mode.md
index 8b745ae4d39..a6dbd3aa64b 100644
--- a/defender-endpoint/enable-troubleshooting-mode.md
+++ b/defender-endpoint/enable-troubleshooting-mode.md
@@ -79,7 +79,7 @@ You can query all troubleshooting mode events in advanced hunting.
|Semester/Redstone|OS version|Release|
|:---|:---|:---|
- | 21H2/SV1|`22000.593` or later|[KB5011563: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5019275) |
+ | 21H2/SV1|`22000.593` or later|[KB5011563: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011563) |
| 20H1/20H2/21H1|`19042.1620` or later
`19041.1620` or later
`19043.1620` or later|[KB5011543: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011543) |
| Windows Server 2022 or later|`20348.617` or later|[KB5011558: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011558) |
| Windows Server 2019 (RS5)|`17763.2746` or later |[KB5011551: Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5011551) |
@@ -184,4 +184,3 @@ DeviceEvents
- [Protect security settings with tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md)
-
diff --git a/defender-endpoint/enable-update-mdav-to-latest-ws.md b/defender-endpoint/enable-update-mdav-to-latest-ws.md
index 12426293a2f..16647565f8b 100644
--- a/defender-endpoint/enable-update-mdav-to-latest-ws.md
+++ b/defender-endpoint/enable-update-mdav-to-latest-ws.md
@@ -6,12 +6,12 @@ ms.author: chrisda
author: chrisda
ms.reviewer: yongrhee
ms.localizationpriority: high
-ms.date: 06/16/2026
+ms.date: 07/02/2026
ms.collection:
- m365-security
- tier2
- mde-ngp
-ms.custom: intro-overview, msecd-doc-authoring-1014
+ms.custom: intro-overview, msecd-doc-authoring-1016
ms.topic: how-to
ms.subservice: ngp
appliesto:
@@ -53,13 +53,15 @@ First, ensure that Microsoft Defender Antivirus is not disabled either through G
If Microsoft Defender Antivirus features and installation files were previously removed from Windows Server 2016, follow the guidance in [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) to restore the feature installation files.
-On Windows Server 2016 you might need to use the `-WdEnable` option on the MpCmdRun command-line tool to re-enable Microsoft Defender Antivirus.
+On Windows Server 2016, you might need to use the Microsoft Defender Antivirus command-line utility (MpCmdRun.exe) with the `-WdEnable` option to re-enable Microsoft Defender Antivirus.
1. In an elevated Command Prompt (a Command Prompt window you opened by selecting **Run as administrator**), run the following commands:
> [!TIP]
> The first command changes the directory to the latest version of \
**During offboarding:** Failed to change the service start type. The offboarding process continues. |Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Onboard client devices](onboard-client.md).|
|10|Microsoft Defender for Endpoint service failed to persist the onboarding information. Failure code: `variable`.|The device didn't onboard correctly and isn't reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Onboard client devices running Windows or macOS](onboard-client.md).|
|11|Onboarding or reonboarding of Defender for Endpoint service completed.|The device onboarded correctly.|Normal operating notification; no action required.
It might take several hours for the device to appear in the portal.|
- |12|Microsoft Defender for Endpoint failed to apply the default configuration.|Service was unable to apply the default configuration.|This error should resolve after a short period of time.|
+ |12|Microsoft Defender for Endpoint failed to apply the default configuration.|Service was unable to apply the default configuration.|The default configuration error should resolve after a short period of time.|
|13|Microsoft Defender for Endpoint device ID calculated: `variable`.|Normal operating process.|Normal operating notification; no action required.|
|15|Microsoft Defender for Endpoint can't start command channel with URL: `variable`.|Variable = URL of the Defender for Endpoint processing servers.
The service couldn't contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet.md).|
|17|Microsoft Defender for Endpoint service failed to change the Connected User Experiences and Telemetry service location. Failure code: `variable`.|An error occurred with the Windows telemetry service.|[Ensure the diagnostic data service is enabled](troubleshoot-onboarding.md#ensure-that-microsoft-defender-antivirus-is-not-disabled-by-a-policy)">Ensure the diagnostic data service is enabled.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Onboard client devices running Windows or macOS](onboard-client.md).|
@@ -90,7 +90,7 @@ The service event ID table in this article lists events recorded by the service.
|49|Invalid cloud configuration command received and ignored. Version: %1, status: %2, error code: %3, message: %4|Received an invalid configuration file from the cloud service that was ignored.|If this error persists, contact Support.|
|50|New cloud configuration applied successfully. Version: %1.|Successfully applied a new configuration from the cloud service.|Normal operating notification; no action required.|
|51|New cloud configuration failed to apply, version: %1. Successfully applied the last known good configuration, version %2.|Received a bad configuration file from the cloud service. Last known good configuration was applied successfully.|If this error persists, contact Support.|
- |52|New cloud configuration failed to apply, version: %1. Also failed to apply last known good configuration, version %2. Successfully applied the default configuration.|Received a bad configuration file from the cloud service. Failed to apply the last known good configuration - and the default configuration was applied.|The service will attempt to download a new configuration file within 5 minutes. If you don't see event #50 - contact Support.|
+ |52|New cloud configuration failed to apply, version: %1. Also failed to apply last known good configuration, version %2. Successfully applied the default configuration.|Received a bad configuration file from the cloud service. Failed to apply the last known good configuration - and the default configuration was applied.|The service attempts to download a new configuration file within 5 minutes. If the "New cloud configuration applied successfully" event (Event ID 50) doesn't appear after 5 minutes, contact Support.|
|53|Cloud configuration loaded from persistent storage, version: %1.|The configuration was loaded from persistent storage on service startup.|Normal operating notification; no action required.|
|55|Failed to create the Secure ETW autologger. Failure code: %1|Failed to create the secure ETW logger.|Reboot the device. If this error persists, contact Support.|
|56|Failed to remove the Secure ETW autologger. Failure code: %1|Failed to remove the secure ETW session on offboarding.|Contact Support.|
@@ -127,7 +127,7 @@ The service event ID table in this article lists events recorded by the service.
|96|Microsoft Defender for Endpoint Init has called. Result code: %2|The SenseCE executable has called MCE initialization.|Normal operating notification; no action required.|
|97|There are connectivity issues to the Cloud for the DLP scenario|There are network connectivity issues that affect the DLP classification flow.|Check the network connectivity.|
|98|The connectivity to the Cloud for the DLP scenario has been restored|The connectivity to the network was restored and the DLP classification flow can continue.|Normal operating notification; no action required.|
- |99|Sense has encountered the following error while communicating with server: (%1). Result: (%2)|A communication error occurred.|Check the following events in the event log for further details.|
+ |99|Sense has encountered the following error while communicating with server: (%1). Result: (%2)|A communication error occurred.|Check subsequent events in the Microsoft-Windows-SENSE/Operational event log for further details.|
|100|Microsoft Defender for Endpoint executable failed to start. Failure code: %1|The SenseCE executable has failed to start.|Reboot the device. If this error persists, contact Support.|
|102|Microsoft Defender for Endpoint Network Detection and Response executable has started|The SenseNdr executable has started.|Normal operating notification; no action required.|
|103|Microsoft Defender for Endpoint Network Detection and Response executable has ended|The SenseNdr executable has ended.|Normal operating notification; no action required.|
@@ -206,7 +206,7 @@ To open the System event log:
1. Select **Start** on the Windows menu, type **Event Viewer**, and press **Enter** to open the Event Viewer.
2. In the log list, under **Log Summary**, scroll until you see **System**. Double-click the item to open the log.
-You can use the System event log event ID table for more information on the Defender for Endpoint events in the System events log and to determine further troubleshooting steps.
+Use the following table to find more information on Defender for Endpoint events in the System event log and to determine further troubleshooting steps.
|Event ID|Message|Description|Action|
|---|---|---|---|
diff --git a/defender-endpoint/exploit-protection-reference.md b/defender-endpoint/exploit-protection-reference.md
index d21b8d78642..a99707750cd 100644
--- a/defender-endpoint/exploit-protection-reference.md
+++ b/defender-endpoint/exploit-protection-reference.md
@@ -6,14 +6,14 @@ ms.localizationpriority: medium
author: limwainstein
ms.author: lwainstein
ms.reviewer: cjacks
-ms.custom: asr, msecd-doc-authoring-1014
+ms.custom: asr, msecd-doc-authoring-1016
ms.subservice: asr
ms.topic: how-to
ms.collection:
- m365-security
- tier3
- mde-asr
-ms.date: 06/16/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -31,26 +31,26 @@ This article helps you understand how exploit protection works, both at the poli
Exploit protection mitigations are applied per application.
-Mitigations are configured via a registry entry for each program that you configure protections for. These settings are stored in the **MitigationOptions** registry entry for each program (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*ImageFileName*\MitigationOptions`). They take effect when you restart the program, and remain effective until you change them and restart the program again.
+Each program has its own registry entry that controls which mitigations apply. These settings are stored in the **MitigationOptions** registry entry (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*ImageFileName*\MitigationOptions`). These mitigation settings take effect when you restart the program. They remain active until you change them and restart the program.
> [!IMPORTANT]
-> Image file execution options only allow you to specify a file name or path, and not a version number, architecture, or any other differentiator. Be careful to target mitigations to apps which have unique names or paths, applying them only on devices where you tested that version and that architecture of the application.
+> Image file execution options only let you specify a file name or path. You can't specify a version number, architecture, or any other differentiator. Target mitigations to apps that have unique names or paths. Apply them only on devices where you tested that version and architecture of the application.
-If you configure exploit protection mitigations using an XML configuration file by using PowerShell, Group Policy, or MDM, when processing this XML configuration file, individual registry settings are configured for you.
+You can configure mitigations through an XML file by using PowerShell, Group Policy, or MDM. When you use an XML file, the system sets the registry entries for you.
## Resetting exploit protection
> [!IMPORTANT]
-> When the policy distributing the XML file is no longer enforced, settings deployed by this XML configuration file won't be automatically removed.
+> When the Group Policy or MDM policy that deploys the XML file is no longer enforced, settings deployed by this XML configuration file won't be automatically removed.
-To remove exploit protection settings, export the XML configuration from a clean Windows 10 or Windows 11 device, and deploy this new XML file. Alternately, Microsoft provides an XML file as part of the Windows Security Baselines for resetting exploit protection settings.
+To remove exploit protection settings, export the XML configuration from a clean Windows 10 or Windows 11 device, and deploy this new XML file. Alternately, Microsoft provides an XML file as part of the [Windows Security Baselines](/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines) for resetting exploit protection settings.
-To reset exploit protection settings using PowerShell, use the following command:
+To reset exploit protection settings using PowerShell, run the following command to apply the reset policy from the XML file and restore mitigation settings to their defaults:
```powershell
Set-ProcessMitigation -PolicyFilePath EP-reset.xml
```
-Following is the EP-reset.xml distributed with the Windows Security Baselines:
+The following XML file is the EP-reset.xml distributed with the [Windows Security Baselines](/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines). This file defines per-application mitigation overrides that reset exploit protection settings to their defaults for common applications such as Microsoft Office, web browsers, and media players:
```xml
Included natively in Windows 10 and Windows 11
For more information, see [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Yes |
+|NullPage Security Mitigation | Yes
Included natively in Windows 10 and Windows 11
For more information, see [Mitigate threats by using Windows 10 security features](/previous-versions/windows/it-pro/windows-10/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Yes |
|Randomize memory allocations (Bottom-Up ASLR) | Yes | Yes |
|Simulate execution (SimExec) | Yes | Yes |
|Validate API invocation (CallerCheck) | Yes | Yes |
|Validate exception chains (SEHOP) | Yes | Yes |
|Validate stack integrity (StackPivot) | Yes | Yes |
|Certificate trust (configurable certificate pinning) | Windows 10 and Windows 11 provide enterprise certificate pinning | Yes |
-|Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
For more information, see [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Yes |
+|Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
For more information, see [Mitigate threats by using Windows 10 security features](/previous-versions/windows/it-pro/windows-10/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Yes |
|Block low integrity images | Yes | No |
|Code integrity guard | Yes | No |
|Disable extension points | Yes | No |
@@ -138,7 +138,7 @@ The table in this section indicates the availability and support of native mitig
|Validate image dependency integrity | Yes | No |
> [!NOTE]
-> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10 and Windows 11, which other EMET advanced settings are enabled by default, as part of enabling the anti-ROP mitigations for a process. For more information on how Windows 10 employs existing EMET technology, see the [Mitigation threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit).
+> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10 and Windows 11, which other EMET advanced settings are enabled by default, as part of enabling the anti-ROP mitigations for a process. For more information on how Windows 10 employs existing EMET technology, see the [Mitigation threats by using Windows 10 security features](/previous-versions/windows/it-pro/windows-10/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit).
## See also
diff --git a/defender-endpoint/faqs-on-tamper-protection.yml b/defender-endpoint/faqs-on-tamper-protection.yml
index 3ceb89d895a..90d17cf6314 100644
--- a/defender-endpoint/faqs-on-tamper-protection.yml
+++ b/defender-endpoint/faqs-on-tamper-protection.yml
@@ -145,7 +145,7 @@ sections:
- question: |
I'm an enterprise customer. Can local admins change tamper protection on their devices?
answer: |
- In general, tamper protection helps protect against users being able to change security settings directly on devices. Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). To further prevent malware from running in kernel, consider using [driver block rules with Application Control for Windows](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules).
+ In general, tamper protection helps protect against users being able to change security settings directly on devices. Tamper protection is part of anti-tampering capabilities that include [standard protection attack surface reduction rules](attack-surface-reduction-rules-reference.md). To further prevent malware from running in kernel, consider using [driver block rules with Application Control for Windows](/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules).
- question: |
What happens if my device is onboarded with Microsoft Defender for Endpoint and then goes into an off-boarded state?
diff --git a/defender-endpoint/feedback-loop-blocking.md b/defender-endpoint/feedback-loop-blocking.md
index dff40ce188f..a7a50e5ea52 100644
--- a/defender-endpoint/feedback-loop-blocking.md
+++ b/defender-endpoint/feedback-loop-blocking.md
@@ -28,7 +28,7 @@ appliesto:
## Overview
-Feedback-loop blocking, also referred to as rapid protection, is a component of [behavioral blocking and containment capabilities](behavioral-blocking-containment.md) in [Microsoft Defender for Endpoint](/windows/security/threat-protection/). With feedback-loop blocking, devices across your organization are better protected from attacks.
+Feedback-loop blocking, also referred to as rapid protection, is a component of [behavioral blocking and containment capabilities](behavioral-blocking-containment.md) in [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md). With feedback-loop blocking, devices across your organization are better protected from attacks.
## Prerequisites
@@ -55,7 +55,7 @@ If your organization is using Defender for Endpoint, feedback-loop blocking is e
- [Attack surface reduction](attack-surface-reduction-rules-overview.md)
-- [Next-generation protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features) (antivirus)
+- [Next-generation protection](configure-microsoft-defender-antivirus-features.md) (antivirus)
> [!TIP]
> If you're looking for Antivirus related information for other platforms, see:
@@ -73,5 +73,3 @@ If your organization is using Defender for Endpoint, feedback-loop blocking is e
- [(Blog) Behavioral blocking and containment: Transforming optics into protection](https://www.microsoft.com/security/blog/2020/03/09/behavioral-blocking-and-containment-transforming-optics-into-protection/)
-
-
diff --git a/defender-endpoint/find-defender-malware-name.md b/defender-endpoint/find-defender-malware-name.md
index 9a95be3416d..0b41902bd25 100644
--- a/defender-endpoint/find-defender-malware-name.md
+++ b/defender-endpoint/find-defender-malware-name.md
@@ -1,6 +1,6 @@
---
title: Find malware detection names for Microsoft Defender for Endpoint
-description: How to find the names for the latest malware detections in Defender for Endpoint
+description: Find Microsoft's detection name for a malware family in Defender for Endpoint. Learn how Microsoft malware naming works and how to look up the corresponding detection name.
ms.service: defender-endpoint
ms.subservice: edr
ms.author: chrisda
@@ -10,13 +10,13 @@ ms.collection:
- m365-security
- tier3
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Find malware detection names for Microsoft Defender for Endpoint
diff --git a/defender-endpoint/gov.md b/defender-endpoint/gov.md
index 81ae5c86d27..4548546b34a 100644
--- a/defender-endpoint/gov.md
+++ b/defender-endpoint/gov.md
@@ -72,16 +72,16 @@ The following OS versions are supported:
|:---|:---:|:---:|:---:|
|Windows 11|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
|Windows 10, version 21H1 and later|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
-|Windows 10, version 20H2 (with [KB4586853](https://support.microsoft.com/help/4586853))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
-|Windows 10, version 2004 (with [KB4586853](https://support.microsoft.com/help/4586853))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing); upgrade now|
-|Windows 10, version 1909 (with [KB4586819](https://support.microsoft.com/help/4586819))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing); upgrade now|
-|Windows 10, version 1903 (with [KB4586819](https://support.microsoft.com/help/4586819))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing); upgrade now|
-|Windows 10, version 1809 (with [KB4586839](https://support.microsoft.com/help/4586839))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|
-|Windows 10, version 1803 (with [KB4598245](https://support.microsoft.com/help/4598245))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|
-|Windows 10, version 1709|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|:::image type="icon" source="media/svg/check-yes.svg" border="false"::: With [KB4499147](https://support.microsoft.com/help/4499147)
See note 1 following this table
[Deprecated](/lifecycle/announcements/revised-end-of-service-windows-10-1709); upgrade now|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|
+|Windows 10, version 20H2 (with [KB4586853](https://support.microsoft.com/servicing/os/windows-10/2020/11/november-30-2020-kb4586853-os-builds-19041-662-and-19042-662-preview))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
+|Windows 10, version 2004 (with [KB4586853](https://support.microsoft.com/servicing/os/windows-10/2020/11/november-30-2020-kb4586853-os-builds-19041-662-and-19042-662-preview))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-version-2004-end-of-servicing); upgrade now|
+|Windows 10, version 1909 (with [KB4586819](https://support.microsoft.com/topic/november-19-2020-kb4586819-os-builds-18362-1237-and-18363-1237-preview-25cbb849-74af-b8b8-29b8-68aa925e8cc3))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1909-end-of-servicing); upgrade now|
+|Windows 10, version 1903 (with [KB4586819](https://support.microsoft.com/topic/november-19-2020-kb4586819-os-builds-18362-1237-and-18363-1237-preview-25cbb849-74af-b8b8-29b8-68aa925e8cc3))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1903-end-of-servicing); upgrade now|
+|Windows 10, version 1809 (with [KB4586839](https://support.microsoft.com/topic/november-19-2020-kb4586839-os-build-17763-1613-preview-aeebda71-959c-48e0-204f-7d9dc84db0f0))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|
+|Windows 10, version 1803 (with [KB4598245](https://support.microsoft.com/servicing/os/windows-10/2021/01/january-12-2021-kb4598245-os-build-17134-1967-expired))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|:::image type="icon" source="media/svg/check-yes.svg" border="false":::
[Deprecated](/lifecycle/announcements/windows-10-1803-1809-end-of-servicing); upgrade now|
+|Windows 10, version 1709|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|:::image type="icon" source="media/svg/check-yes.svg" border="false"::: With [KB4499147](https://support.microsoft.com/servicing/os/windows-10/2019/05/may-28-2019-kb4499147-os-build-16299-1182)
See note 1 following this table
[Deprecated](/lifecycle/announcements/revised-end-of-service-windows-10-1709); upgrade now|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|
|Windows 10, version 1703 and earlier|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|:::image type="icon" source="media/svg/check-no.svg" border="false":::
Not supported|
|Windows Server 2022 and later|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
-|Windows Server 2019 (with [KB4586839](https://support.microsoft.com/help/4586839))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
+|Windows Server 2019 (with [KB4586839](https://support.microsoft.com/topic/november-19-2020-kb4586839-os-build-17763-1613-preview-aeebda71-959c-48e0-204f-7d9dc84db0f0))
See note 1 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
|Windows Server 2016 (Modern)
See note 2 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
|Windows Server 2012 R2 (Modern)
See note 2 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
|Windows Server 2016 (Legacy)
See note 3 following this table|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|:::image type="icon" source="media/svg/check-yes.svg" border="false":::|
diff --git a/defender-endpoint/grant-mssp-access.md b/defender-endpoint/grant-mssp-access.md
index 591c2ae55a2..d1b3dd2f336 100644
--- a/defender-endpoint/grant-mssp-access.md
+++ b/defender-endpoint/grant-mssp-access.md
@@ -10,11 +10,11 @@ ms.collection:
- m365-security
- tier3
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -23,7 +23,7 @@ ai-usage: ai-assisted
> [!IMPORTANT]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
>
-> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+> Microsoft recommends that you use roles with the fewest permissions. Using roles with the fewest permissions helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
To implement a multitenant delegated access solution, take the following steps:
@@ -35,11 +35,11 @@ To implement a multitenant delegated access solution, take the following steps:
## Enable role-based access controls in Microsoft Defender for Endpoint
-Complete the following steps to enable role-based access controls and connect them with Microsoft Entra ID groups.
+Complete the following steps to enable role-based access controls and connect RBAC roles with Microsoft Entra ID groups.
1. **Create access groups for MSSP resources in Customer Entra ID: Groups**
- These groups are linked to the Roles you create in Defender for Endpoint. To create these access groups, in the customer Entra ID tenant, create three groups. In our example approach, we create the following groups:
+ The access groups are linked to the roles you create in Defender for Endpoint. To create the access groups, in the customer Entra ID tenant, create three groups. In our example approach, we create the following groups:
- Tier 1 Analyst
- Tier 2 Analyst
@@ -49,13 +49,13 @@ Complete the following steps to enable role-based access controls and connect th
To enable RBAC in the customer [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Permissions** > **Roles**, and then select **Turn on roles**.
- Then, create RBAC roles to meet MSSP SOC Tier needs. Link these roles to the created user groups via assigned user groups. There are two possible roles: Tier 1 Analysts, and Tier 2 Analysts.
+ Then, create RBAC roles to meet MSSP SOC Tier needs. Link these roles to the Tier 1 Analyst, Tier 2 Analyst, and MSSP Analyst Approvers Microsoft Entra ID groups via assigned user groups. There are two possible roles: Tier 1 Analysts, and Tier 2 Analysts.
- **Tier 1 Analysts** - Perform all actions except for live response and manage security settings.
- **Tier 2 Analysts** - Tier 1 capabilities with the addition to [live response](live-response.md)
- For more information, see [Use role-based access control](rbac.md).
+ For details about role assignments and permissions, see [Role-based access control in Defender for Endpoint](rbac.md).
## Configure Governance Access Packages
@@ -105,6 +105,8 @@ Use the following steps to configure Governance Access Packages for MSSP access.
## Manage MSSP access in Microsoft Defender for Endpoint
+Use the following steps to review and manage MSSP access requests in My Access.
+
1. Review and authorize access requests in Customer and/or MSSP MyAccess.
Access requests are managed in the customer My Access, by members of the MSSP Analyst Approvers group.
diff --git a/defender-endpoint/guidance-for-pen-testing-and-bas.md b/defender-endpoint/guidance-for-pen-testing-and-bas.md
index e48b66f1bb3..1ed3f0d5576 100644
--- a/defender-endpoint/guidance-for-pen-testing-and-bas.md
+++ b/defender-endpoint/guidance-for-pen-testing-and-bas.md
@@ -7,8 +7,8 @@ ms.topic: how-to
author: chrisda
ms.author: chrisda
ms.reviewer: yongrhee
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.subservice: ngp
ms.collection:
- m365-security
@@ -30,7 +30,7 @@ Common challenges during pen testing include:
- Concerns about enabling [cloud protection](cloud-protection-microsoft-defender-antivirus.md), as it might proceed to cloud protection detonation if it doesn't find metadata. For more information about Microsoft Defender Antivirus and cloud protection, see [hybrid detection and protection](adv-tech-of-mdav.md).
> [!NOTE]
-> If you're downloading multiple payloads and notice that Microsoft Defender Antivirus doesn't remediate some of the payloads, keep in mind that the missed remediation might not be a true positive, and a non-Microsoft vendor might be showing a false positive. See the "How to submit possible false negatives for investigation" section later in this article for guidance on reporting undetected payloads to Microsoft.
+> If you're downloading multiple payloads and notice that Microsoft Defender Antivirus doesn't remediate some of the payloads, keep in mind that the missed remediation might not be a true positive, and a non-Microsoft vendor might be showing a false positive. See [How to submit possible false negatives for investigation](#how-to-submit-possible-false-negatives-for-investigation) for guidance on reporting undetected payloads to Microsoft.
## Common misconfigurations of Microsoft Defender Antivirus during pen testing
@@ -46,7 +46,7 @@ It's common for penetration testers to disable features of Microsoft Defender An
- [Behavior monitoring](behavior-monitor.md) is enabled.
-- Adding [antivirus exclusions](configure-exclusions-microsoft-defender-antivirus.md) for the folder where you copied the payload. After you copy the payload to the device, remove the antivirus exclusion so that Microsoft Defender Antivirus can block detections during pen testing.
+- Adding [antivirus exclusions](microsoft-defender-antivirus-exclusions-configure.md) for the folder where you copied the payload. After you copy the payload to the device, remove the antivirus exclusion so that Microsoft Defender Antivirus can block detections during pen testing.
- Make sure that you don't have antivirus exclusions for your BAS tools, such as AttackIQ, Cymulate, SafeBreach, and others.
@@ -62,7 +62,7 @@ It's common for penetration testers to disable features of Microsoft Defender An
- [Network Protection](enable-network-protection.md) is set to block mode.
-- [Controlled Folder Access](enable-controlled-folders.md) (CFA) is set to block mode.
+- [Controlled Folder Access](controlled-folder-access-configure.md) (CFA) is set to block mode.
It's important to get the settings correct. To resolve misconfiguration issues, use the following articles:
@@ -80,7 +80,7 @@ Use the following steps to submit possible false negatives to Microsoft for inve
### Step 1: Gather the Microsoft Defender for Endpoint diagnostic logs
-Choose one of the following methods to gather Microsoft Defender for Endpoint diagnostic logs.
+Gather Microsoft Defender for Endpoint diagnostic logs by using either the MDE Client Analyzer log or the Microsoft Defender Antivirus diagnostic package (MpSupport.cab).
#### Use the Microsoft Defender for Endpoint (MDE) Client Analyzer log
@@ -135,4 +135,4 @@ It's crucial to report to Microsoft as soon as possible. The advanced hunting te
1. Wait for an update. After Microsoft receives the sample, the file is investigated, and a determination is made. If Microsoft determines that the sample file is malicious, we take corrective action to prevent the malware from going undetected.
- If you have questions, [contact support](contact-support.md).
+ If you have questions, [contact Microsoft Defender for Endpoint support](contact-support.md).
diff --git a/defender-endpoint/guidance-pen-testing-bas-linux.md b/defender-endpoint/guidance-pen-testing-bas-linux.md
index bad0b78f6b6..346e04eca60 100644
--- a/defender-endpoint/guidance-pen-testing-bas-linux.md
+++ b/defender-endpoint/guidance-pen-testing-bas-linux.md
@@ -4,11 +4,11 @@ description: Learn how to configure Microsoft Defender for Endpoint on Linux for
author: paulinbar
ms.author: painbar
ms.reviewer: rutujadange
-ms.date: 06/17/2026
+ms.date: 07/02/2026
ms.topic: how-to
ms.service: defender-endpoint
ms.localizationpriority: medium
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
ai-usage: ai-assisted
#customer intent: As a penetration tester, I want to configure Defender for Endpoint on Linux with full protection so that my evaluation results reflect true detection capabilities.
---
@@ -58,7 +58,7 @@ It's common for penetration testers to use just the default mode or enable only
- **Additional antivirus and sensor capabilities**: These settings enable deeper inspection of file, process, and network activity, along with extended telemetry collection from the system. Together, they improve detection depth, increase visibility into attack techniques, and reduce the chances of missed signals during BAS and penetration testing by capturing more system-level events and enforcing stronger scanning behavior.
-Enable all of the protection settings listed above by creating the managed JSON configuration profile (`mdatp_managed.json`) on the path `/etc/opt/microsoft/mdatp/managed`. Copy the following content to `mdatp_managed.json`. The path can differ if you use a custom path for installation. For more information, see [Set preferences for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-preferences).
+Enable all of the protection settings listed above by creating the managed JSON configuration profile (`mdatp_managed.json`) on the path `/etc/opt/microsoft/mdatp/managed`. Copy the following configuration, which enables real-time protection, behavioral monitoring, cloud-delivered protection, and advanced sensor capabilities, to `mdatp_managed.json`. The path can differ if you use a custom path for installation. For more information, see [Set preferences for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-preferences).
```json
{
@@ -90,14 +90,14 @@ After deploying the configuration file, verify device health:
- Run the `mdatp health` command to verify device health.
> [!NOTE]
-> Some of these advanced sensor settings will be progressively enabled by default in the Defender for Endpoint agent to simplify configuration for administrators. As this rollout continues, explicit configuration will no longer be required for those capabilities, and they'll be gradually removed from documentation.
+> Some of these advanced sensor settings will be progressively enabled by default in the Defender for Endpoint agent to simplify configuration for administrators. As the rollout of these advanced sensor settings continues, explicit configuration will no longer be required for those capabilities, and they'll be gradually removed from documentation.
> [!NOTE]
> Evaluation guidance enables additional advanced antivirus and sensor capabilities to maximize detection coverage and visibility. These settings can increase resource usage. For best results, use them in adequately sized environments. Low-resource environments might experience performance degradation or reduced evaluation accuracy.
### Enable new protection capabilities currently in preview
-To get the most current and comprehensive assessment of Defender's detection and prevention depth, enable new protection capabilities that might be in preview. These capabilities incorporate protections for emerging threats and evolving attack techniques, ensuring that BAS and penetration-test exercises reflect Defender's latest security advancements. To get **early access to new protection capabilities currently in preview**:
+To get the most current and comprehensive assessment of Defender's detection and prevention depth, enable new protection capabilities that might be in preview. These preview protection capabilities incorporate protections for emerging threats and evolving attack techniques, ensuring that BAS and penetration-test exercises reflect Defender's latest security advancements. To get **early access to new protection capabilities currently in preview**:
- Contact your Microsoft account executive for guided enablement (Preview feature).
@@ -151,7 +151,7 @@ To collect diagnostic data, follow these steps:
1. Run the following command to collect the logs: `sudo mdatp diagnostic create`.
-For more information, see [Microsoft Defender for Endpoint on Linux resources](/defender-endpoint/linux-resources).
+For more information about diagnostic logs and troubleshooting tools, see [Microsoft Defender for Endpoint on Linux resources](/defender-endpoint/linux-resources).
### Step 2: Gather information
@@ -176,7 +176,7 @@ Report to Microsoft promptly. The advanced hunting telemetry data wraps around a
| MDSI portal | The MDSI portal is a service provided by Microsoft Defender Security Intelligence. It allows users to submit files for malware analysis. Microsoft Defender security researchers analyze these files to determine if they're threats, unwanted applications, or normal files. The portal is used to report detection concerns to Microsoft Defender Research, submit files for analysis, and track the results of submissions. |
| Microsoft Defender portal | If you have a subscription to Microsoft Defender XDR, or your subscription includes Defender for Endpoint Plan 2, you can use the **Submissions** page in the Microsoft Defender portal. |
-Submit the data you gathered in Steps 1 and 2 by using either the MDSI portal or the Microsoft Defender portal:
+Submit the diagnostic logs and required investigation details by using either the MDSI portal or the Microsoft Defender portal:
1. **MDSI portal**: Go to the [MDSI portal](https://www.microsoft.com/wdsi), and then select **Submit files**. Follow the guidance on the page.
diff --git a/defender-endpoint/host-firewall-reporting.md b/defender-endpoint/host-firewall-reporting.md
index 43ea281e967..0b4a985d317 100644
--- a/defender-endpoint/host-firewall-reporting.md
+++ b/defender-endpoint/host-firewall-reporting.md
@@ -39,8 +39,8 @@ Firewall reporting in the [Microsoft Defender portal](https://security.microsoft
- To onboard devices to the Microsoft Defender for Endpoint service, see [onboarding guidance](onboard-configure.md).
- For the [Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2077139) to start receiving data, you must enable **Audit Events** for Windows Defender Firewall with Advanced Security. See the following articles:
- - [Audit Filtering Platform Packet Drop](/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop)
- - [Audit Filtering Platform Connection](/windows/security/threat-protection/auditing/audit-filtering-platform-connection)
+ - [Audit Filtering Platform Packet Drop](/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-packet-drop)
+ - [Audit Filtering Platform Connection](/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-connection)
- Enable these events by using Group Policy Object Editor, Local Security Policy, or the auditpol.exe commands. For more information, see [documentation about auditing and logging](/windows/win32/fwp/auditing-and-logging). The two PowerShell commands are as follows:
- `auditpol /set /subcategory:"Filtering Platform Packet Drop" /failure:enable`
diff --git a/defender-endpoint/includes/air-deprecation-note.md b/defender-endpoint/includes/air-deprecation-note.md
new file mode 100644
index 00000000000..7ec7f1dbcc6
--- /dev/null
+++ b/defender-endpoint/includes/air-deprecation-note.md
@@ -0,0 +1,4 @@
+> [!IMPORTANT]
+> As of September 1, 2026, Automated Investigation and Response (AIR) will no longer run as a separate investigation experience or be available for manual triggering in Microsoft Defender.
+>
+> AIR detection and response capabilities are already included in Microsoft Defender's default antivirus protection stack and run automatically. For on-demand investigations, run a full antivirus scan as needed.
\ No newline at end of file
diff --git a/defender-endpoint/includes/intune-recommended-separate-product.md b/defender-endpoint/includes/intune-recommended-separate-product.md
new file mode 100644
index 00000000000..f4dc1ace493
--- /dev/null
+++ b/defender-endpoint/includes/intune-recommended-separate-product.md
@@ -0,0 +1,9 @@
+---
+author: chrisda
+ms.author: chrisda
+ms.service: defender-endpoint
+ms.topic: include
+ms.date: 06/05/2026
+---
+
+Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and it isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. If you don't have Intune, you can use any of the other methods in this article. For more information, see [Microsoft Intune licensing](/intune/intune-service/fundamentals/licenses).
diff --git a/defender-endpoint/includes/linux-build-issue.md b/defender-endpoint/includes/linux-build-issue.md
new file mode 100644
index 00000000000..00edbb9cf04
--- /dev/null
+++ b/defender-endpoint/includes/linux-build-issue.md
@@ -0,0 +1,30 @@
+---
+author: limwainstein
+ms.author: lwainstein
+ms.service: defender-endpoint
+ms.topic: include
+ms.date: 07/10/2026
+ai-usage: ai-assisted
+---
+
+
+#### Issues have been found with versions 101.26042.0000–101.26042.0009
+Issues have been found with versions [101.26042.0000–101.26042.0009](/defender-endpoint/microsoft-defender-endpoint-releases#linux--june-2026--101260420009), where the Defender service might be disabled on some devices that were upgraded and rebooted. For all supported Linux operating systems, affected versions have been removed from the production channel, and are no longer available for installation.
+
+If you use Defender for Servers (Plan 1 or 2) with Defender for Cloud and have the MDE integration enabled, automatic updates for the MDE.Linux extension are enabled by default, which means your machines could have received an affected version automatically. If an affected version was installed, the issue might impact active protection on rebooted devices until remediation steps are taken.
+
+**Resolution:**
+
+- If you haven't upgraded yet, we recommend upgrading to the following build version: 101.26042.0011.
+
+#### Update may fail on FIPS-enabled RHEL 8/9 devices
+
+We are investigating an issue where some devices running Red Hat Enterprise Linux (RHEL) 8 or 9 with FIPS mode enabled may fail to install Microsoft Defender for Endpoint on Linux platform version 101.26042.x.
+
+**Impact**
+
+Affected devices may be unable to complete the platform update and may remain on their previously installed platform version until a corrected package is available.
+
+**Current status**
+
+Fixed in platform version 101.26052.0011 and later. FIPS-enabled RHEL 8/9 devices that were affected by this issue can now install/update to 101.26052.0011 or later successfully.
diff --git a/defender-endpoint/includes/streamlined-connectivity-no-ssl-inspection.md b/defender-endpoint/includes/streamlined-connectivity-no-ssl-inspection.md
new file mode 100644
index 00000000000..43b6575d479
--- /dev/null
+++ b/defender-endpoint/includes/streamlined-connectivity-no-ssl-inspection.md
@@ -0,0 +1,9 @@
+---
+author: paulinbar
+ms.author: painbar
+ms.date: 07/02/2026
+ms.topic: include
+ms.service: defender-endpoint
+---
+
+For streamlined connectivity, exclude traffic to `*.endpoint.security.microsoft.com` from SSL/TLS inspection, HTTPS interception, and man-in-the-middle (MITM) proxying. If you enable SSL inspection, Defender for Endpoint sensors might fail to communicate with backend services, resulting in onboarding or connectivity failures.
diff --git a/defender-endpoint/includes/streamlined-connectivity-processes.md b/defender-endpoint/includes/streamlined-connectivity-processes.md
index 9959aa25b86..acf8caf9266 100644
--- a/defender-endpoint/includes/streamlined-connectivity-processes.md
+++ b/defender-endpoint/includes/streamlined-connectivity-processes.md
@@ -17,7 +17,7 @@ The specific exclusions to configure depend on which version of Windows your end
| OS | Exclusions |
|--|--|
| Windows 11
Windows 10, version 1803 or later (See Windows 10 release information)
Windows 10, version 1703 or 1709 with KB4493441 installed
Windows Server 2025
Azure Stack HCI OS, version 23H2 and later
Windows Server 2022
Windows Server 2019
Windows Server, version 1803
Windows Server 2016 running the modern unified solution
Windows Server 2012 R2 running the modern unified solution | **EDR exclusions**:
`C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseTracer.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseDlpProcessor.exe`
**Registry path**:
`HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\*`
**Antivirus exclusions**:
`C:\Program Files\Windows Defender\MsMpEng.exe`
`C:\Program Files\Windows Defender\NisSrv.exe`
`C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe`
`C:\Program Files\Windows Defender\MpCmdRun.exe`
`C:\Program Files\Windows Defender\MpDefenderCoreService.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MsMpEng.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\NisSrv.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\ConfigSecurityPolicy.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpCopyAccelerator.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpCmdRun.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDefenderCoreService.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\mpextms.exe`
**Endpoint Data Loss Prevention (Endpoint DLP) exclusions**:
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDlpService.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDlpCmd.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MipDlp.exe`
`C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\DlpUserAgent.exe`|
-| Windows Server 2016 or Windows Server 2012 R2 running the [modern unified solution](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Fswitch-to-mde-phase-2.md/main/76b249d7-f914-4c03-3eaf-48aa43b2fa4a/onboard-server.md) | The following **additional** exclusions are required after updating the Sense EDR component using [KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac):
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseTVM.exe`|
+| Windows Server 2016 or Windows Server 2012 R2 running the [modern unified solution](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Fswitch-to-mde-phase-2.md/main/76b249d7-f914-4c03-3eaf-48aa43b2fa4a/onboard-server.md) | The following **additional** exclusions are required after updating the Sense EDR component using [KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor):
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseTVM.exe`|
| [Windows 8.1](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2) [Windows 7](/windows/release-health/status-windows-7-and-windows-server-2008-r2-sp1) [Windows Server 2008 R2 SP1](/windows/release-health/status-windows-7-and-windows-server-2008-r2-sp1) | `C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 6\45\MsSenseS.exe`
( Monitoring Host Temporary Files 6\45 can be different numbered subfolders.)
`C:\Program Files\Microsoft Monitoring Agent\Agent\AgentControlPanel.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\HSLockdown.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\MOMPerfSnapshotHelper.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\TestCloudConnection.exe` |
### [**macOS**](#tab/macOS)
diff --git a/defender-endpoint/indicator-certificates.md b/defender-endpoint/indicator-certificates.md
index 687741b7e10..d8f8e79920d 100644
--- a/defender-endpoint/indicator-certificates.md
+++ b/defender-endpoint/indicator-certificates.md
@@ -12,19 +12,19 @@ ms.collection:
- mde-asr
ms.topic: how-to
ms.subservice: asr
-ms.date: 06/17/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Create indicators for certificates in Microsoft Defender for Endpoint
-You can create indicators for certificates. Some common use cases include:
+This article shows you how to create certificate-based indicators in Microsoft Defender for Endpoint to allow or block signed applications. Some common use cases include:
- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction-rules-overview.md) but need to allow behaviors from signed applications by adding the certificate in the allowlist.
- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Microsoft Defender Antivirus prevents file executions (block and remediate), and automated investigation and remediation behaves the same.
@@ -33,7 +33,7 @@ You can create indicators for certificates. Some common use cases include:
It's important to understand the following requirements before creating indicators for certificates:
-- This feature is available if your organization uses Microsoft Defender Antivirus (in active mode) and cloud-based protection is enabled. For more information, see [Manage cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).
+- This feature is available if your organization uses Microsoft Defender Antivirus (in active mode) and cloud-based protection is enabled. For more information, see [Manage cloud-based protection](deploy-manage-report-microsoft-defender-antivirus.md).
- The anti-malware client version must be `4.18.1901.x` or later.
- Supported on machines on Windows 10, version 1703 or later, Windows Server 2012 R2 and later, or Azure Stack HCI OS, version 23H2 and later.
@@ -51,7 +51,7 @@ It's important to understand the following requirements before creating indicato
> [!NOTE]
> In situations where a certificate-based indicator is configured to **Block**, but a file hash indicator for one of its signed files is configured to **Allow**, this configuration is **not supported by design**.
-> Certificate-based indicators have higher precedence in the Defender evaluation pipeline and will always override file hash allow indicators.
+> Certificate-based indicators have higher precedence in the Microsoft Defender for Endpoint evaluation pipeline and will always override file hash allow indicators.
> A configuration that simultaneously:
> - blocks a certificate, and
> - attempts to allow one of its signed files via file hash
@@ -61,8 +61,10 @@ It's important to understand the following requirements before creating indicato
## Create an indicator for certificates from the settings page
+Use the following steps to create a certificate indicator from the Settings page.
+
> [!IMPORTANT]
-> Creating or removing a certificate IoC can take up to 3 hours.
+> Creating or removing a certificate indicator of compromise (IoC) can take up to 3 hours.
1. In the navigation pane, select **Settings** \> **Endpoints** \> **Indicators** (under **Rules**).
@@ -82,7 +84,6 @@ It's important to understand the following requirements before creating indicato
- [Create indicators for files](indicator-file.md)
- [Create indicators for IPs and URLs/domains](indicator-ip-domain.md)
- [Manage indicators](indicator-manage.md)
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
-
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
diff --git a/defender-endpoint/indicator-file.md b/defender-endpoint/indicator-file.md
index 7e5296567e9..99e7bb39076 100644
--- a/defender-endpoint/indicator-file.md
+++ b/defender-endpoint/indicator-file.md
@@ -6,7 +6,7 @@ ms.service: defender-endpoint
ms.author: lwainstein
author: limwainstein
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/03/2026
ms.collection:
- m365-security
- tier2
@@ -19,19 +19,19 @@ appliesto:
- Microsoft Defender for Business
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
-# Create indicators for files
+# Create file indicators in Microsoft Defender for Endpoint
> [!IMPORTANT]
> In Defender for Endpoint Plan 1 and Defender for Business, you can create an indicator to block or allow a file. In Defender for Business, your indicator is applied across your environment and cannot be scoped to specific devices.
> [!NOTE]
-> For this feature to work on Windows Server 2016 and Windows Server 2012 R2, those devices must be onboarded using the [modern unified solution for Windows Server 2016 and Windows Server 2012 R2](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
+> For file indicators to work on Windows Server 2016 and Windows Server 2012 R2, those devices must be onboarded using the [modern unified solution for Windows Server 2016 and Windows Server 2012 R2](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
> Custom file indicators with the Allow, Block and Remediate actions are now also available in the [enhanced anti-malware engine capabilities for macOS and Linux](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003).
-File indicators prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. Blocking the file prevents it from being read, written, or executed on devices in your organization.
+File indicators prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. Blocking the file prevents it from being read, written, or executed on devices in your organization. Before you begin, review the [prerequisites](#prerequisites) for supported operating systems and platform-specific requirements.
There are three ways you can create indicators for files:
@@ -85,7 +85,7 @@ Before creating file indicators on Linux, ensure the following prerequisites are
- Available in Defender for Endpoint version `101.85.27` or later.
- [Configure file hash computation on Linux](linux-preferences.md#configure-file-hash-computation-feature) in the Microsoft Defender portal or in the managed JSON
-- Behavior monitoring enabled is preferred, but this feature works with any other scan (RTP or Custom).
+- Behavior monitoring enabled is preferred, but file indicators work with any other scan (RTP or Custom).
> [!NOTE]
> On Linux, file indicators support script files (.sh files) and ELF files.
@@ -151,12 +151,13 @@ The current supported actions for file IOC are allow, audit and block, and remed
> For more information about the EnableFileHashComputation group policy, see [Defender CSP](/windows/client-management/mdm/defender-csp).
> For more information on configuring this feature on Defender for Endpoint on Linux and macOS, see [Configure file hash computation feature on Linux](linux-preferences.md#configure-file-hash-computation-feature) and [Configure file hash computation feature on macOS](mac-preferences.md#configure-file-hash-computation-feature).
-## Advanced hunting capabilities (preview)
+
+## Advanced hunting capabilities for file indicators (preview)
> [!IMPORTANT]
-> Information in this section (**Public Preview for Automated investigation and remediation engine**) relates to prerelease product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+> The following advanced hunting capabilities information relates to the **Automated investigation and remediation engine** public preview, which is a prerelease product that might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-Currently in preview, you can query the response action activity in advance hunting. Below is a sample advance hunting query:
+Currently in preview, you can query the response action activity in advanced hunting. The following sample advanced hunting query shows how to query response action activity:
```console
search in (DeviceFileEvents, DeviceProcessEvents, DeviceEvents, DeviceRegistryEvents, DeviceNetworkEvents, DeviceImageLoadEvents, DeviceLogonEvents)
@@ -179,7 +180,8 @@ Certificates:
The response action activity can also be viewable in the device timeline.
-## Policy conflict handling
+
+## Policy conflict handling for file indicators
Cert and File IoC policy handling conflicts follow this order:
@@ -230,7 +232,8 @@ The following examples show how component enforcement interacts with file indica
|Windows Defender Application Control|Block|Allow|Block|
|Microsoft Defender Antivirus exclusion|Allow|Block|Allow|
-## See also
+
+## Related content
- [Create indicators](indicators-overview.md)
@@ -240,7 +243,7 @@ The following examples show how component enforcement interacts with file indica
- [Manage indicators](indicator-manage.md)
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
diff --git a/defender-endpoint/indicator-ip-domain.md b/defender-endpoint/indicator-ip-domain.md
index 6abee9388cb..68bbb0fe18e 100644
--- a/defender-endpoint/indicator-ip-domain.md
+++ b/defender-endpoint/indicator-ip-domain.md
@@ -6,19 +6,19 @@ ms.service: defender-endpoint
ms.author: lwainstein
author: limwainstein
ms.localizationpriority: medium
-ms.collection:
+ms.collection:
- m365-security
- tier2
- -asr
ms.topic: how-to
-ms.subservice:
-ms.date: 06/16/2026
+ms.subservice:
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Create indicators for IPs and URLs/domains
@@ -48,7 +48,7 @@ Integration into Microsoft browsers is controlled by the browser's SmartScreen s
- [Behavior Monitoring](behavior-monitor.md) enabled.
-- [Cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus) turned on.
+- [Cloud-based protection](deploy-manage-report-microsoft-defender-antivirus.md) turned on.
- [Cloud Protection network connectivity](configure-network-connections-microsoft-defender-antivirus.md).
@@ -73,7 +73,7 @@ IP, URL, and domain indicators are supported on the following operating systems:
### Network Protection requirements
-Network allow and block indicators in Microsoft browsers are controlled by the browser's SmartScreen setting.
+Network allow and block indicators in Microsoft browsers are controlled by the browser's SmartScreen setting.
For other browsers and applications, network allow and block indicators require that the Microsoft Defender for Endpoint component _Network Protection_ is enabled in **block mode**. For more information on Network Protection and configuration instructions, see [Enable network protection](enable-network-protection.md).
@@ -97,9 +97,9 @@ For processes other than Microsoft Edge and Internet Explorer, web protection sc
- Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators
- HTTP URLs (including a full URL path) can be blocked for any browser or process
- HTTPS fully qualified domain names (FQDN) can be blocked in non-Microsoft browsers (indicators specifying a full URL path can only be blocked in Microsoft Edge)
-- Blocking FQDNs in non-Microsoft browsers requires that QUIC and Encrypted Client Hello be disabled in those browsers
+- Blocking FQDNs in non-Microsoft browsers requires that QUIC and Encrypted Client Hello be disabled in those browsers
- FQDNs loaded via HTTP2 connection coalescing can only be blocked in Microsoft Edge
-- If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`.
+- If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/microsoft-365/` takes precedence over the URL indicator policy `https://support.microsoft.com`.
## Network protection implementation
@@ -107,11 +107,11 @@ In non-Microsoft Edge processes, Network Protection determines the fully qualifi
The determination of whether to allow or block access to a site is made after the completion of the [three-way handshake via TCP/IP](/troubleshoot/windows-server/networking/three-way-handshake-via-tcpip) and any TLS handshake. Thus, when a site is blocked by network protection, you might see an action type of `ConnectionSuccess` under `NetworkConnectionEvents` in the Microsoft Defender portal, even though the site was blocked. `NetworkConnectionEvents` are reported from the TCP layer, and not from network protection. After the three-way handshake has completed, access to the site is allowed or blocked by network protection.
-Here's an example of how that works:
+Here's an example of how network protection blocking is logged:
-1. Suppose that a user attempts to access a website on their device. The site happens to be hosted on a dangerous domain, and it should be blocked by network protection.
+1. Suppose that a user attempts to access a website on their device. The site happens to be hosted on a dangerous domain, and it should be blocked by network protection.
-1. The TCP/IP handshake commences. Before it completes, a `NetworkConnectionEvents` action is logged, and its `ActionType` is listed as `ConnectionSuccess`. However, as soon as the TCP/IP handshake process completes, network protection blocks access to the site. All of this happens quickly. A similar process occurs with [Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview); it's after the handshake completes that a determination is made, and access to a site is either blocked or allowed.
+1. The TCP/IP handshake commences. Before it completes, a `NetworkConnectionEvents` action is logged, and its `ActionType` is listed as `ConnectionSuccess`. However, as soon as the TCP/IP handshake process completes, network protection blocks access to the site. The handshake, logging, and blocking sequence happens quickly. A similar process occurs with [Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/); it's after the handshake completes that a determination is made, and access to a site is either blocked or allowed.
1. In the Microsoft Defender portal, an alert is listed in the [alerts queue](alerts-queue.md). Details of that alert include both `NetworkConnectionEvents` and `AlertEvents`. You can see that the site was blocked, even though you also have a `NetworkConnectionEvents` item with the ActionType of `ConnectionSuccess`.
@@ -168,6 +168,9 @@ The result is that categories 1-4 are all blocked. This scenario is illustrated
## Create an indicator for IPs, URLs, or domains from the settings page
+> [!IMPORTANT]
+> It can take up to 48 hours after a policy is created for a URL or IP address to be blocked on a device. In most cases, blocks take effect in under two hours.
+
To create an indicator for IPs, URLs, or domains from the Microsoft Defender portal, perform the following steps:
1. In the navigation pane, select **Settings** \> **Endpoints** \> **Indicators** (under **Rules**).
@@ -185,7 +188,7 @@ To create an indicator for IPs, URLs, or domains from the Microsoft Defender por
1. Review the details in the **Summary** tab, then select **Save**.
> [!IMPORTANT]
-> It can take up to 48 hours after a policy is created for a URL or IP address to be blocked on a device. In most cases, blocks take effect in under two hours.
+> After you create a policy for a URL or IP address, it can take up to 48 hours for the policy to take effect. In most cases, policy changes take effect in under two hours.
## Related content
@@ -194,7 +197,6 @@ To create an indicator for IPs, URLs, or domains from the Microsoft Defender por
- [Create indicators for files](indicator-file.md)
- [Create indicators based on certificates](indicator-certificates.md)
- [Manage indicators](indicator-manage.md)
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
-
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
diff --git a/defender-endpoint/indicator-manage.md b/defender-endpoint/indicator-manage.md
index e9777564168..3afb785c715 100644
--- a/defender-endpoint/indicator-manage.md
+++ b/defender-endpoint/indicator-manage.md
@@ -1,7 +1,7 @@
---
title: Manage indicators in Microsoft Defender for Endpoint
ms.reviewer:
-description: Manage indicators for a file hash, IP address, URLs, or domains that define the detection, prevention, and exclusion of entities.
+description: Edit, delete, or import file hash, IP address, URL/domain, and certificate indicators in Microsoft Defender for Endpoint from the Settings > Endpoints > Indicators page.
ms.service: defender-endpoint
ms.author: lwainstein
author: limwainstein
@@ -12,13 +12,13 @@ ms.collection:
- mde-asr
ms.topic: how-to
ms.subservice: asr
-ms.date: 06/16/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Manage indicators in Microsoft Defender for Endpoint
@@ -34,7 +34,7 @@ ms.custom: msecd-doc-authoring-1014
You can upload indicators from a CSV file that defines indicator attributes, actions, and other details.
-Download the sample indicators CSV file from the import page to review the supported column attributes.
+Download the sample indicators CSV file from the **Indicators** import page (under **Settings** > **Endpoints** > **Indicators**) to review the supported column attributes.
1. In the navigation pane, select **Settings** \> **Endpoints** \> **Indicators** (under **Rules**).
@@ -48,7 +48,7 @@ Download the sample indicators CSV file from the import page to review the suppo
> [!NOTE]
> Only 500 indicators can be uploaded for each batch.
-> Attempting to import indicators with specific categories requires the string to be written in Pascal case convention and only accepts the category list available at the portal.
+> Attempting to import indicators with specific categories requires the string to be written in Pascal case convention and only accepts the category list available in the Microsoft Defender portal.
The following table shows the supported parameters.
@@ -64,7 +64,7 @@ The following table shows the supported parameters.
| recommendedActions|String|TI indicator alert recommended actions.
**Optional** |
| rbacGroups|String|Comma-separated list of RBAC groups the indicator would be applied to.
**Optional** |
| category|String|Category of the alert. Examples include: Execution and credential access.
**Optional** |
-| mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/).
**Optional**
It's recommended to add a value in category when a MITRE technique. |
+| mitretechniques|String|MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/).
**Optional**
It's recommended to provide a value in the category field when you specify a MITRE technique in the mitretechniques field. |
| GenerateAlert|String|Whether the alert should be generated. Possible Values are: `True` or `False`.
**Optional** |
> [!NOTE]
@@ -81,7 +81,7 @@ Watch this video to learn how Microsoft Defender for Endpoint provides multiple
- [Create indicators for files](indicator-file.md)
- [Create indicators for IPs and URLs/domains](indicator-ip-domain.md)
- [Create indicators based on certificates](indicator-certificates.md)
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
diff --git a/defender-endpoint/indicators-overview.md b/defender-endpoint/indicators-overview.md
index 382db903339..a7bd0cc94f4 100644
--- a/defender-endpoint/indicators-overview.md
+++ b/defender-endpoint/indicators-overview.md
@@ -39,7 +39,7 @@ This video shows a walkthrough of creating and adding indicators:
### About Microsoft indicators
-As a general rule, you should only create indicators for known bad IoCs, or for any files / websites that should be explicitly allowed in your organization. For more information on the types of sites that Defender for Endpoint can block by default, see [Microsoft Defender SmartScreen overview](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview).
+As a general rule, you should only create indicators for known bad IoCs, or for any files / websites that should be explicitly allowed in your organization. For more information on the types of sites that Defender for Endpoint can block by default, see [Microsoft Defender SmartScreen overview](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/).
A false positive (FP) refers to a false positive in Microsoft's threat intelligence. If a given resource is not actually a threat, you can create an Allow IoC to allow the resource. You can also help drive improvements to Microsoft's security intelligence by submitting false positives, and suspicious or known-bad IoCs for analysis. If a warning or block is incorrectly shown for a file or application, or if you suspect an undetected file is malware, you can submit a file to Microsoft for review. For more information, see [Submit files for analysis](https://www.microsoft.com/en-us/wdsi/filesubmission/).
@@ -65,17 +65,17 @@ Here's an example of how that works:
1. Suppose that a user attempts to access a website on their device. The site happens to be hosted on a dangerous domain, and it should be blocked by network protection.
-1. The three-way handshake via TCP/IP commences. Before it completes, a `NetworkConnectionEvents` action is logged, and its `ActionType` is listed as `ConnectionSuccess`. However, as soon as the three-way handshake process completes, network protection blocks access to the site. All of this happens quickly. A similar process occurs with [Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview); it's when the three-way handshake completes that a determination is made, and access to a site is either blocked or allowed.
+1. The three-way handshake via TCP/IP commences. Before it completes, a `NetworkConnectionEvents` action is logged, and its `ActionType` is listed as `ConnectionSuccess`. However, as soon as the three-way handshake process completes, network protection blocks access to the site. All of this happens quickly. A similar process occurs with [Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/); it's when the three-way handshake completes that a determination is made, and access to a site is either blocked or allowed.
1. In the Microsoft Defender portal, an alert is listed in the [alerts queue](alerts-queue.md). Details of that alert include both `NetworkConnectionEvents` and `AlertEvents`. You can see that the site was blocked, even though you also have a `NetworkConnectionEvents` item with the ActionType of `ConnectionSuccess`.
#### File hash indicators
-In some cases, creating a new indicator for a newly identified file IoC - as an immediate stop-gap measure - might be appropriate to block files or even applications. However, using indicators to attempt to block an application might not provide the expected results as applications are typically composed of many different files. The preferred methods of blocking applications are to use [Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview) or AppLocker.
+In some cases, creating a new indicator for a newly identified file IoC - as an immediate stop-gap measure - might be appropriate to block files or even applications. However, using indicators to attempt to block an application might not provide the expected results as applications are typically composed of many different files. The preferred methods of blocking applications are to use [Windows Defender Application Control (WDAC)](/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview) or AppLocker.
Because each version of an application has a different file hash, using indicators to block hashes isn't recommended.
-[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create)
+[Windows Defender Application Control (WDAC)](/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create)
#### Certificate indicators
@@ -119,7 +119,7 @@ When your security team creates a new indicator (IoC), the following actions are
> [!NOTE]
> For Warn action, To receive the toast notification to be able to bypass the IoC, make sure the **“Files or activities are blocked”** option is enabled under **Virus & Threat Protection notifications**. The corresponding registry key should be set as follows: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender Security Center\Virus and threat protection\FilesBlockedNotificationDisabled = 0.
>
-> More details see **[Windows Security app settings](https://support.microsoft.com/windows/windows-security-app-settings-1ec98620-4e41-4b6b-b055-3c4bb115d4ee#bkmk_notifications)**.
+> More details see **[Windows Security app settings](https://support.microsoft.com/Windows/Security/Windows-Security/windows-security-app-settings#bkmk_notifications)**.
You can create an indicator for:
@@ -147,7 +147,7 @@ The IoC API schema and the threat IDs in Advanced Hunting are updated to align w
> [!NOTE]
> There's a limit of 15,000 indicators per tenant. Increases to this limit aren't supported.
>
-> File and certificate indicators don't block [exclusions defined for Microsoft Defender Antivirus](/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus). Indicators aren't supported in Microsoft Defender Antivirus when it is in passive mode.
+> File and certificate indicators don't block [exclusions defined for Microsoft Defender Antivirus](/defender-endpoint/microsoft-defender-antivirus-exclusions-overview). Indicators aren't supported in Microsoft Defender Antivirus when it is in passive mode.
>
> The format for importing new indicators (IoCs) has changed according to the new updated actions and alerts settings. We recommend downloading the new CSV format that can be found at the bottom of the import panel.
>
@@ -166,11 +166,10 @@ Customers might experience issues with alerts for IoCs. The following scenarios
## Related articles
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file)
- [Use the Microsoft Defender for Endpoint indicators API](api/ti-indicator.md)
- [Use partner integrated solutions](partner-applications.md)
-
diff --git a/defender-endpoint/information-protection-investigation.md b/defender-endpoint/information-protection-investigation.md
index 012c616130e..d89fccff182 100644
--- a/defender-endpoint/information-protection-investigation.md
+++ b/defender-endpoint/information-protection-investigation.md
@@ -1,32 +1,31 @@
---
title: Use Microsoft Defender for Endpoint sensitivity labels to protect your data and prioritize security incident response
-description: Learn how to use Defender for Endpoint sensitivity labels to protect, prioritize, and investigate incidents that involve data loss, dlp, security incidents.
+description: Learn how Microsoft Defender for Endpoint sensitivity labels help protect sensitive data and prioritize incident investigation.
ms.service: defender-endpoint
ms.author: chrisda
author: chrisda
ms.localizationpriority: medium
-ms.collection:
+ms.collection:
- m365-security
- ContentEngagementFY23
- tier2
- EngageScoreSep2022
ms.topic: how-to
ms.subservice: edr
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
-# Microsoft Defender for Endpoint sensitivity labels protect and prioritize incident response
-## Use sensitivity labels in Defender for Endpoint
+# Microsoft Defender for Endpoint sensitivity labels protect and prioritize incident response
-A typical advanced persistent threat lifecycle (or APT) involves some data exfiltration -- the point at which data is *taken* from the organization. In those situations, sensitivity labels can tell security operations where to start by spelling out what data is highest priority to protect.
+A typical advanced persistent threat (APT) lifecycle involves data exfiltration, where data is *taken* from the organization. Sensitivity labels help security teams know where to start. They show which data has the highest priority to protect.
-Defender for Endpoint helps to make prioritization of security incidents simpler with the use of sensitivity labels too. For example, sensitivity labels quickly identify incidents that can involve devices with sensitive information on them (such as confidential information).
+Defender for Endpoint uses sensitivity labels to simplify how you prioritize security incidents. For example, labels help you quickly spot incidents that involve devices with sensitive or confidential information.
Here's how to use sensitivity labels in Defender for Endpoint.
@@ -39,7 +38,7 @@ Learn how to use data sensitivity labels to prioritize incident investigation.
1. In Microsoft Defender portal, select **Incidents & alerts** \> **Incidents**.
-1. Scroll over to see the **Data sensitivity** column. This column reflects sensitivity labels that are observed on devices related to the incidents providing an indication of whether sensitive files are impacted by the incident.
+1. Scroll over to see the **Data sensitivity** column. This column shows the sensitivity labels found on devices related to each incident. Use it to check whether sensitive files are affected.
:::image type="content" source="media/data-sensitivity-column.png" alt-text="The Highly confidential option in the data sensitivity column" lightbox="media/data-sensitivity-column.png":::
@@ -55,19 +54,19 @@ Learn how to use data sensitivity labels to prioritize incident investigation.
:::image type="content" source="media/investigate-devices-tab.png" alt-text="The Device tab" lightbox="media/investigate-devices-tab.png":::
-1. Select the devices that store sensitive data and search through the timeline to identify which files might be impacted then take appropriate action to ensure that data is protected.
+1. Select the devices that store sensitive data. Search the timeline to find which files might be affected. Then take action to protect that data.
- You can narrow down the events shown on the device timeline by searching for data sensitivity labels. Searching for data sensitivity labels shows only events associated with files that match the label name.
+ To narrow the results, search the device timeline for a specific sensitivity label. Only events for files that match that label name appear.
:::image type="content" source="media/machine-timeline-labels.png" alt-text="The device timeline with narrowed down search results based on label" lightbox="media/machine-timeline-labels.png":::
> [!TIP]
-> These data points are also exposed through the 'DeviceFileEvents' in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status.
+> Sensitivity label and file protection status data are also exposed through the 'DeviceFileEvents' in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status.
## Related information about sensitivity labels
-- [Learn about sensitivity labels in Office 365](/Microsoft-365/compliance/sensitivity-labels)
-- [Learn to apply sensitivity label inside of email or Office](https://support.microsoft.com/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9)
-- [Learn how to use sensitivity labels as a condition when applying Data Loss Prevention](/Microsoft-365/compliance/dlp-sensitivity-label-as-condition)
-
+For more details about sensitivity labels, see the following articles:
+- [Learn about sensitivity labels in Office 365](/purview/sensitivity-labels)
+- [Apply sensitivity labels in email or Office apps](https://support.microsoft.com/Office/security-privacy/apply-sensitivity-labels-to-your-files)
+- [Use sensitivity labels as a condition in Data Loss Prevention policies](/purview/dlp-sensitivity-label-as-condition)
diff --git a/defender-endpoint/investigate-behind-proxy.md b/defender-endpoint/investigate-behind-proxy.md
index 80cda68d6a4..2f99c56cb11 100644
--- a/defender-endpoint/investigate-behind-proxy.md
+++ b/defender-endpoint/investigate-behind-proxy.md
@@ -11,11 +11,11 @@ ms.collection:
- mde-edr
ms.topic: how-to
ms.subservice: edr
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -28,7 +28,8 @@ The proxy acts as if it was the target endpoint. When a forward proxy acts as th
Defender for Endpoint supports advanced HTTP level monitoring through network protection. When network protection is turned on, a new type of event is surfaced that exposes the real target domain names.
-## Use network protection to monitor network connection behind a firewall
+
+## Use network protection to monitor connections behind a forward proxy or firewall
Monitoring network connection behind a forward proxy is possible due to other network events that originate from network protection. To see these network events on a device timeline, turn on network protection (at the minimum in audit mode).
@@ -44,13 +45,14 @@ If you don't configure it, network blocking is turned off by default.
For more information, see [Enable network protection](enable-network-protection.md).
-## Investigation impact
+
+## How network protection reveals real targets behind forward proxies
-When network protection is turned on, you'll see that on a device's timeline the IP address keeps representing the proxy, while the real target address shows up.
+When network protection is turned on, a device's timeline shows the proxy IP address while also displaying the real target address.
:::image type="content" source="media/atp-proxy-investigation.png" alt-text="The network events on device's timeline" lightbox="media/atp-proxy-investigation.png":::
-Other events triggered by the network protection layer are now available to surface the real domain names even behind a proxy.
+Additional network protection connection events are available to surface the real domain names even behind a proxy.
Event's information:
@@ -58,9 +60,9 @@ Event's information:
## Hunt for connection events using advanced hunting
-All new connection events are available for you to hunt on through advanced hunting as well. Since these events are connection events, you can find them under the DeviceNetworkEvents table under the `ConnectionSuccess` action type.
+The network protection connection events are also available through advanced hunting. You can find them in the DeviceNetworkEvents table under the `ConnectionSuccess` action type.
-Using this simple query shows you all the relevant events:
+The following query returns all relevant ConnectionSuccess events:
```console
DeviceNetworkEvents
diff --git a/defender-endpoint/investigate-domain.md b/defender-endpoint/investigate-domain.md
index 4354aec27a5..2d6939123c8 100644
--- a/defender-endpoint/investigate-domain.md
+++ b/defender-endpoint/investigate-domain.md
@@ -10,14 +10,14 @@ ms.collection:
- tier2
- mde-edr
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/02/2026
ms.subservice: edr
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Investigate domains and URLs
@@ -58,9 +58,9 @@ The URL overview section lists the URL, a link to further details at whois, the
Displays the original URL (existing URL information), with the query parameters and the application-level protocol. The domain details section includes the full domain details, such as registration date, modification date, and registrant contact info.
-The page also shows the Microsoft verdict of the URL or domain, device prevalence, emails, and user clicks. In the device prevalence section, you can see the number of devices that communicated with the URL or domain in the last 30 days, and pivot to the first or last event in the device timeline right away. To investigate initial access or if there's still a malicious activity in your environment.
+The URL and domain page also shows the Microsoft verdict of the URL or domain, device prevalence, emails, and user clicks. In the device prevalence section, you can see the number of devices that communicated with the URL or domain in the last 30 days, and pivot to the first or last event in the device timeline right away. To investigate initial access or if there's still a malicious activity in your environment.
-### Incidents and alerts
+### Incidents and alerts overview
The Incident and alerts section displays a bar chart of all active alerts in incidents over the past 180 days.
@@ -75,9 +75,11 @@ The Prevalence section provides the details on the prevalence of the URL within
## Incidents and alerts
+Use the **Incidents and alerts** tab to review incidents associated with the URL or domain.
+
-The incident and alerts tab provides a list of incidents that are associated with the URL or domain. The table shown here is a filtered version of the incidents visible on the Incident queue screen, showing only incidents associated with the URL or domain, their severity, impacted assets and more.
+The incident and alerts tab provides a list of incidents that are associated with the URL or domain. The incidents table on the **Incidents and alerts** tab is a filtered version of the incidents visible on the Incident queue screen, showing only incidents associated with the URL or domain, their severity, impacted assets and more.
The incidents and alerts tab can be adjusted to show more or less information, by selecting **Customize columns** from the action menu above the column headers. The number of items displayed can also be adjusted, by selecting items per page on the same menu.
@@ -86,7 +88,7 @@ The incidents and alerts tab can be adjusted to show more or less information, b
-The Devices tab provides a chronological view of all the devices that were observed for a specific URL or a domain. The Devices tab includes a trend chart and a customizable table listing device details, such as risk level, domain, and more. The Devices tab also shows the first and last event times where the device interacted with the URL or domain, and the action type of this event. Using the menu next to the device name, you can quickly pivot to the device timeline to further investigate what happened before or after the event that involved this URL or domain.
+The Devices tab provides a chronological view of all the devices that were observed for a specific URL or a domain. The Devices tab includes a trend chart and a customizable table listing device details, such as risk level, domain, and more. The Devices tab also shows the first and last event times where the device interacted with the URL or domain, and the action type for each event. Using the menu next to the device name, you can quickly pivot to the device timeline to further investigate what happened before or after the event that involved this URL or domain.
Although the default time period is the past 30 days, you can customize the time period from the drop-down available at the corner of the card. The shortest range available is for prevalence over the past day, while the longest range is over the past six months.
diff --git a/defender-endpoint/investigate-ip.md b/defender-endpoint/investigate-ip.md
index 9d68dd94b43..35810b4674c 100644
--- a/defender-endpoint/investigate-ip.md
+++ b/defender-endpoint/investigate-ip.md
@@ -10,14 +10,14 @@ ms.collection:
- tier2
- mde-edr
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/02/2026
ms.subservice: edr
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Investigate an IP address associated with a Microsoft Defender for Endpoint alert
@@ -80,6 +80,8 @@ Clicking any of the device names will take you to that device's view, where you
## Related content
+For more information, see the following articles:
+
- [View and organize the Microsoft Defender for Endpoint Alerts queue](alerts-queue.md)
- [Manage Microsoft Defender for Endpoint alerts](/defender-xdr/investigate-alerts?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json#manage-alerts)
- [Investigate Microsoft Defender for Endpoint alerts](investigate-alerts.md)
diff --git a/defender-endpoint/investigate-machines.md b/defender-endpoint/investigate-machines.md
index 57d7b9bb8fa..ef3cb626816 100644
--- a/defender-endpoint/investigate-machines.md
+++ b/defender-endpoint/investigate-machines.md
@@ -1,4 +1,4 @@
----
+---
title: Investigate devices in Microsoft Defender for Endpoint
description: Learn how to investigate devices by reviewing alerts, timelines, network connections, and security assessments in Microsoft Defender for Endpoint.
keywords: investigate devices, device timeline, event flags, MITRE ATT&CK, internet-facing devices, device investigation, device details, network connections
@@ -13,7 +13,7 @@ ms.collection:
ms.topic: concept-article
ms.subservice: edr
search.appverid: met150
-ms.date: 02/25/2026
+ms.date: 07/23/2026
ai-usage: ai-assisted
appliesto:
- Microsoft Defender for Endpoint Plan 2
@@ -84,6 +84,9 @@ Response actions run along the top of a specific device page and include:
You can take response actions in the Action center, in a specific device page, or in a specific file page.
+> [!NOTE]
+> On devices onboarded as [high-value assets](restrict-response-actions-high-value-assets.md), some response actions might be unavailable or appear grayed out. The permitted actions are defined when the device is onboarded and can't be changed remotely. If an action you expect is missing, review the device's selective response actions configuration.
+
For more information on how to take action on a device, see [Take response action on a device](respond-machine-alerts.md).
For more information, see [Investigate user entities](investigate-user.md).
@@ -247,13 +250,13 @@ The device timeline includes several features to help you investigate events eff
:::image type="content" source="media/timeline-device.png" alt-text="Screenshot of the device timeline with events." lightbox="media/timeline-device.png":::
> [!NOTE]
-> For firewall events to be displayed, you need to enable the audit policy, see [Audit Filtering Platform connection](/windows/security/threat-protection/auditing/audit-filtering-platform-connection).
+> For firewall events to be displayed, you need to enable the audit policy, see [Audit Filtering Platform connection](/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-connection).
>
> Firewall covers the following events:
>
-> - [5025](/windows/security/threat-protection/auditing/event-5025) - firewall service stopped
-> - [5031](/windows/security/threat-protection/auditing/event-5031) - application blocked from accepting incoming connections on the network
-> - [5157](/windows/security/threat-protection/auditing/event-5157) - blocked connection
+> - [5025](/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5025) - firewall service stopped
+> - [5031](/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5031) - application blocked from accepting incoming connections on the network
+> - [5157](/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5157) - blocked connection
### Search, filter, and export events
diff --git a/defender-endpoint/investigate-user.md b/defender-endpoint/investigate-user.md
index f48844655e7..2c7c15d8851 100644
--- a/defender-endpoint/investigate-user.md
+++ b/defender-endpoint/investigate-user.md
@@ -1,6 +1,6 @@
---
title: Investigate a user account in Microsoft Defender for Endpoint
-description: Investigate a user account for potential compromised credentials or pivot on the associated user account during an investigation.
+description: Investigate a user account in Microsoft Defender for Endpoint to assess possible credential compromise, review related activity, and pivot to associated investigation data.
ms.service: defender-endpoint
ms.author: chrisda
author: chrisda
@@ -10,14 +10,14 @@ ms.collection:
- tier2
- mde-edr
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/02/2026
ms.subservice: edr
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Investigate a user account in Microsoft Defender for Endpoint
@@ -46,7 +46,7 @@ When you investigate a user account entity, you can see:
### Review user details
-The **User details** pane on left provides information about the user, such as related open incidents, active alerts, SAM name, SID, Microsoft Defender for Identity alerts, number of devices the user is logged on to, when the user was first and last seen, role, and logon types. Depending on the integration features you've enabled, you can see other details. For example, if you enable the Skype for business integration, you're able to contact the user from the portal. The **Azure ATP alerts** section contains a link that takes you to the Microsoft Defender for Identity page, if you've enabled the Microsoft Defender for Identity feature, and there are alerts related to the user. The Microsoft Defender for Identity page provides more information about the alerts.
+The **User details** pane on left provides information about the user, such as related open incidents, active alerts, Security Account Manager (SAM) name, security identifier (SID), Microsoft Defender for Identity alerts, number of devices the user is logged on to, when the user was first and last seen, role, and logon types. Depending on the integration features you've enabled, you can see other details. For example, if you enable the Skype for business integration, you're able to contact the user from the portal. The **Azure ATP alerts** section contains a link to the user's alerts page in Microsoft Defender for Identity, if you've enabled the Microsoft Defender for Identity feature and there are alerts related to the user. The user's alerts page in Microsoft Defender for Identity provides more information about the alerts.
> [!NOTE]
> You'll need to enable the integration on both Microsoft Defender for Identity and Defender for Endpoint to use this feature. In Defender for Endpoint, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features.md).
@@ -57,7 +57,7 @@ On the user account details page, the Overview, Alerts, and Observed in organiza
> For Linux devices, information about logged in users isn't displayed.
> [!NOTE]
-> Microsoft Defender for Business doesn't include Microsoft Defender for Identity (MDI) by default. In SMB-based environments, Logon User data won't be available unless MDI sensors are installed. To ensure visibility into logon events, customers must deploy MDI sensors.
+> Microsoft Defender for Business doesn't include Microsoft Defender for Identity (MDI) by default. In SMB-based environments, Logon User data won't be available unless MDI sensors (installed on domain controllers to collect identity-related signals) are deployed. To ensure visibility into logon events, customers must deploy MDI sensors.
### Overview
diff --git a/defender-endpoint/ios-configure-features.md b/defender-endpoint/ios-configure-features.md
index 59255f1b6d8..8a7a6d56d5d 100644
--- a/defender-endpoint/ios-configure-features.md
+++ b/defender-endpoint/ios-configure-features.md
@@ -11,11 +11,11 @@ ms.collection:
- mde-ios
ms.topic: how-to
ms.subservice: ios
-ms.date: 06/19/2026
+ms.date: 07/22/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -39,7 +39,7 @@ By default, Defender for Endpoint on iOS includes and enables [web protection](w
Defender for Endpoint on iOS uses a VPN in order to provide web protection. The VPN is local, and unlike traditional VPN, network traffic isn't sent outside the device.
-While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that don't work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following these steps:
+While the Defender for Endpoint local VPN is enabled by default, there might be some cases that require you to disable it. For example, if you need to run apps that don't work when a VPN is configured, you can disable the Defender for Endpoint VPN on the device by following these steps:
1. On your iOS device, open the **Settings** app, select **General** and then **VPN**.
@@ -54,7 +54,7 @@ While enabled by default, there might be some cases that require you to disable
## Disable web protection
-Web protection is one of the key features of Defender for Endpoint and it requires a VPN to provide web protection. The VPN used is a local/loopback VPN and not a traditional VPN, however there are several reasons for which customers might not prefer the VPN. If you don't want to set up a VPN, you can disable web protection and deploy Defender for Endpoint without that feature. Other Defender for Endpoint features continues to work.
+Web protection is one of the key features of Defender for Endpoint and it requires a VPN to provide web protection. The VPN used is a local/loopback VPN and not a traditional VPN, however there are several reasons for which customers might not prefer the VPN. If you don't want to set up a VPN, you can disable web protection and deploy Defender for Endpoint without web protection. Other Defender for Endpoint features continues to work.
The web protection configuration is available for both enrolled (MDM) devices and unenrolled (MAM) devices. For customers with MDM, admins can configure web protection through managed devices in the App Config. For customers without enrollment, using MAM, admins can configure the web protection through managed apps in the App Config.
@@ -162,14 +162,15 @@ Use the following procedure to set up MAM config for unenrolled devices for netw
1. Review and create the configuration policy.
> [!IMPORTANT]
-> Starting May 19, 2025, alerts in the Microsoft Defender portal are no longer generated when users connect to an open wireless network. Instead, this activity now generates events and are viewable in the device timeline. With this change, security operations center (SOC) analysts can now view connection/disconnection to open wireless networks as events. If auto-remediation key is enabled, old alerts are resolved automatically after the changes take effect.
+> Starting May 19, 2025, alerts in the Microsoft Defender portal are no longer generated when users connect to an open wireless network. Instead, this activity now generates events and are viewable in the device timeline. With this change, security operations center (SOC) analysts can now view connection/disconnection to open wireless networks as events. If the `DefenderNetworkProtectionAutoRemediation` key is enabled, old alerts are resolved automatically after the changes take effect.
> Here are key points about this change:
-> - For these changes to take effect, end-users must update to the latest version of Defender for Endpoint on iOS available on May 2025. Otherwise, the previous experience of generating alerts is still in place. If auto-remediation key is enabled by the admin, old alerts are resolved automatically after the changes take effect.
+> - For the open-network alert-to-event change to take effect, end-users must update to the latest version of Defender for Endpoint on iOS available on May 2025. Otherwise, the previous experience of generating alerts is still in place. If auto-remediation key is enabled by the admin, old alerts are resolved automatically after the changes take effect.
> - When an end-user connects or disconnects to an open wireless network multiple times within the same 24-hour period, only one event each for the connection and disconnection is generated in that 24-hour period and sent to the device timeline.
> - Enable Users to Trust Networks: After the update, connection and disconnection events to open wireless networks, including to user trusted networks, are sent to the device timeline as events.
> - This change doesn't impact GCC customers. The previous experience of receiving alerts while connecting to open wireless networks still apply to them.
-## Coexistence of multiple VPN profiles
+
+## Understand coexistence of multiple VPN profiles on iOS
Apple iOS doesn't support multiple device-wide VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time.
@@ -229,7 +230,7 @@ Use the following steps to enable privacy and not collect the domain name as par
#### Configure end-user privacy controls in the Microsoft Defender app
-These controls help the end user to configure the information shared to their organization.
+The end-user privacy controls in the Microsoft Defender app help the end user configure the information shared to their organization.
For supervised devices, end-user controls aren't visible. Your admin decides and controls the settings. However, for unsupervised devices, the control is displayed under the **Settings \> Privacy**.
@@ -245,7 +246,7 @@ Turning privacy controls on or off doesn't affect the device compliance check or
## Optional permissions
-Microsoft Defender for Endpoint on iOS enables optional permissions in the onboarding flow. Currently the permissions required by Defender for Endpoint are mandatory in the onboarding flow. With this feature, admins can deploy Defender for Endpoint on BYOD devices without enforcing the mandatory VPN permission during onboarding. End users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for enrolled devices (MDM).
+Microsoft Defender for Endpoint on iOS enables optional permissions in the onboarding flow. Currently the permissions required by Defender for Endpoint are mandatory in the onboarding flow. With optional VPN permissions, admins can deploy Defender for Endpoint on BYOD devices without enforcing the mandatory VPN permission during onboarding. End users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for enrolled devices (MDM).
### Configure optional permissions using MDM
@@ -278,7 +279,7 @@ End users install and open the Microsoft Defender app to start onboarding.
## Jailbreak detection
-Microsoft Defender for Endpoint has the capability of detecting unmanaged and managed devices that are jailbroken. These jailbreak checks are done periodically. If a device is detected as jailbroken, these events occur:
+Microsoft Defender for Endpoint has the capability of detecting unmanaged and managed devices that are jailbroken. These jailbreak checks are done periodically. If a device is detected as jailbroken, the following actions occur:
- A high-risk alert is reported to the Microsoft Defender portal. If device Compliance and Conditional Access are set up based on device risk score, then the device is blocked from accessing corporate data.
- User data on app is cleared. When user opens the app after jailbreaking, the VPN profile (only Defender for Endpoint loopback VPN Profile) also is deleted, and no web protection is offered. VPN profiles delivered by Intune aren't removed.
@@ -290,7 +291,7 @@ To protect corporate data from being accessed on jailbroken iOS devices, we reco
> [!NOTE]
> Jailbreak detection is a capability provided by Microsoft Defender for Endpoint on iOS. However, we recommend that you set up this policy as an extra layer of defense against jailbreak scenarios.
-Follow the steps below to create a compliance policy against jailbroken devices.
+To create a compliance policy against jailbroken devices, follow these steps:
1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** \> **Compliance policies** \> **Create Policy**. Select "iOS/iPadOS" as platform and select **Create**.
@@ -390,6 +391,8 @@ The disable sign-out configuration is available for both enrolled (MDM) devices
### Configure disable sign out using MDM
+Use the following steps to disable sign out for enrolled devices.
+
**For enrolled devices (MDM)**
1. In the Microsoft Intune admin center, go to **Apps** \> **App configuration policies** \> **Add** \> **Managed devices**.
@@ -407,6 +410,8 @@ The disable sign-out configuration is available for both enrolled (MDM) devices
### Configure disable sign out using MAM
+Use the following steps to disable sign out for unenrolled devices.
+
**For unenrolled devices (MAM)**
1. In the Microsoft Intune admin center, navigate to **Apps** > **App configuration policies** > **Add** > **Managed apps**.
@@ -422,7 +427,8 @@ The disable sign-out configuration is available for both enrolled (MDM) devices
1. Select **Next**, and then assign this policy to targeted devices/users.
-## Device tagging
+
+## Configure device tags on iOS
Defender for Endpoint on iOS enables bulk tagging the mobile devices during onboarding by allowing the admins to set up tags via Intune. Admin can configure the device tags through Intune via configuration policies and push them to user's devices. Once the User installs and activates Defender, the client app passes the device tags to the Microsoft Defender portal. The Device tags appear against the devices in the Device Inventory.
@@ -433,6 +439,8 @@ Device tag configuration is available for both enrolled (MDM) devices and unenro
### Configure device tags using MDM
+Use the following steps to configure device tags for enrolled devices.
+
**For enrolled devices (MDM)**
1. In the Microsoft Intune admin center, go to **Apps** \> **App configuration policies** \> **Add** \> **Managed devices**.
@@ -451,6 +459,8 @@ Device tag configuration is available for both enrolled (MDM) devices and unenro
### Configure device tags using MAM
+Use the following steps to configure device tags for unenrolled devices.
+
**For unenrolled devices (MAM)**
1. In the Microsoft Intune admin center, go to **Apps** > **App configuration policies** > **Add** > **Managed apps**.
@@ -472,12 +482,17 @@ Device tag configuration is available for both enrolled (MDM) devices and unenro
## Suppress OS update notifications
-A configuration is available for customers to suppress OS update notification in Defender for Endpoint on iOS. Once the config key is set in the Intune App configuration policies, Defender for Endpoint won't send any notifications on the device for OS updates. However, when you open the Microsoft Defender app, the Device Health card is visible and show the state of your OS.
+> [!NOTE]
+> OS update notifications are discontinued as of mid-July 2026. Starting late July 2026, you no longer need to configure anything to suppress them, and the settings in this section no longer apply.
+
+A configuration is available for customers to suppress OS update notification in Defender for Endpoint on iOS. Once the config key is set in the Intune App configuration policies, Defender for Endpoint won't send any notifications on the device for OS updates. However, when you open the Microsoft Defender app, the Device Health card is visible and show the state of your OS.
The OS update notification suppression configuration is available for both enrolled (MDM) devices and unenrolled (MAM) devices. Admins can use the following steps to suppress OS update notifications.
### Configure OS update notifications using MDM
+Use the following steps to suppress OS update notifications for enrolled devices.
+
**For enrolled devices (MDM)**
1. In the Microsoft Intune admin center, go to **Apps** \> **App configuration policies** \> **Add** \> **Managed devices**.
@@ -494,6 +509,8 @@ The OS update notification suppression configuration is available for both enrol
### Configure OS update notifications using MAM
+Use the following steps to suppress OS update notifications for unenrolled devices.
+
**For unenrolled devices (MAM)**
1. In the Microsoft Intune admin center, navigate to **Apps** > **App configuration policies** > **Add** > **Managed apps**.
@@ -535,5 +552,11 @@ Use the following steps to configure the option to send feedback data to Microso
Phishing websites impersonate trustworthy websites by obtaining your personal or financial information. Visit the [Provide feedback about network protection](https://www.microsoft.com/wdsi/filesubmission/exploitguard/networkprotection) page to report a website that could be a phishing site.
+## Related content
+
+- [Microsoft Defender for Endpoint on iOS](mtd.md)
+
+- [Configure Dynamic Preview Rings for Microsoft Defender on mobile](mobile-dynamic-preview-rings-configure.md)
+
diff --git a/defender-endpoint/ios-install.md b/defender-endpoint/ios-install.md
index 8dec7dd84b5..d09173b8522 100644
--- a/defender-endpoint/ios-install.md
+++ b/defender-endpoint/ios-install.md
@@ -12,7 +12,8 @@ ms.collection:
- mde-ios
ms.topic: install-set-up-deploy
ms.subservice: ios
-ms.date: 03/28/2025
+search.appverid: met150
+ms.date: 07/28/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -29,7 +30,7 @@ This article describes deploying the Defender for Endpoint on iOS (using the Mic
- Ensure iOS enrollment is done for your users. Users need to have a Defender for Endpoint license assigned in order to use the Microsoft Defender app. Refer to [Assign licenses to users](/azure/active-directory/users-groups-roles/licensing-groups-assign) for instructions on how to assign licenses.
-- Ensure that end users have the Company Portal app installed, have signed in, and have completed enrollment.
+- Ensure that end users have the Company Portal app installed, have signed in, and have completed enrollment. For [just-in-time (JIT) registration](/intune/device-enrollment/apple/setup-just-in-time-registration) scenarios where the Company Portal app isn't required, the device must be registered with the Microsoft Authenticator app.
> [!NOTE]
> The Microsoft Defender app is available in the [Apple App Store](https://aka.ms/mdatpiosappstore).
diff --git a/defender-endpoint/ios-new-ux.md b/defender-endpoint/ios-new-ux.md
index 77b0f954b25..952ea915b3d 100644
--- a/defender-endpoint/ios-new-ux.md
+++ b/defender-endpoint/ios-new-ux.md
@@ -6,14 +6,15 @@ ms.author: painbar
author: paulinbar
ms.reviewer: sunasing; denishdonga
ms.localizationpriority: medium
-ms.date: 11/06/2025
+ms.date: 07/22/2026
ms.collection:
- m365-security
- tier3
- mde-ios
ms.topic: reference
ms.subservice: ios
-ms.custom: sfi-image-nochange
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1015
+ai-usage: ai-assisted
---
# User Experiences in Microsoft Defender for Endpoint on iOS
@@ -77,6 +78,9 @@ We updated all the subordinating screens associated with the **Device Protection
1. **Device Health**
+ > [!NOTE]
+ > Microsoft is deprecating the Device Health feature. Deprecation begins in mid-July 2026 and finishes by late July 2026.
+
:::image type="content" source="media/mde-device-health-new.png" alt-text="Screenshot that shows the new device health feature on the Defender for Endpoint on iOS app." lightbox="media/mde-device-health-new.png":::
### Recommendation cards for alerts
@@ -89,6 +93,9 @@ The structure of the dashboard is updated to include a recommendation card that
1. **Device Health (iOS Update)**
+ > [!NOTE]
+ > Starting late July 2026, the Device Health (iOS Update) recommendation card no longer appears.
+
:::image type="content" source="media/mde-ios-device-health-rec-card.png" alt-text="Screenshot that shows the device health recommendation card feature on the MDE iOS app." lightbox="media/mde-ios-device-health-rec-card.png":::
### Onboarding screens
diff --git a/defender-endpoint/ios-privacy.md b/defender-endpoint/ios-privacy.md
index 19cfda2ad0b..19f18279d13 100644
--- a/defender-endpoint/ios-privacy.md
+++ b/defender-endpoint/ios-privacy.md
@@ -30,7 +30,7 @@ Defender for Endpoint on iOS collects information from your configured iOS devic
For more information about data storage, see [Microsoft Defender for Endpoint data storage and privacy](data-storage-privacy.md).
-For more information on most common privacy questions about Microsoft Defender for Endpoint on Android and iOS mobile devices, see [Microsoft Defender for Endpoint and your privacy on Android and iOS mobile devices](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-and-your-privacy-on-android-and-ios-mobile-devices-4109bc54-8ec5-4433-9c33-d359b75ac22a).
+For more information on most common privacy questions about Microsoft Defender for Endpoint on Android and iOS mobile devices, see [Microsoft Defender for Endpoint and your privacy on Android and iOS mobile devices](https://support.microsoft.com/defender/microsoft-defender-for-endpoint-and-your-privacy-on-android-and-ios-mobile-devices).
## Required data
diff --git a/defender-endpoint/isolation-exclusions.md b/defender-endpoint/isolation-exclusions.md
deleted file mode 100644
index 5828bcab698..00000000000
--- a/defender-endpoint/isolation-exclusions.md
+++ /dev/null
@@ -1,166 +0,0 @@
----
-title: Isolation exclusions in Microsoft Defender for Endpoint
-description: Learn how to exclude specific processes, IP addresses, or services from network isolation when applying selective isolation action to devices.
-ms.service: defender-endpoint
-ms.author: painbar
-author: paulinbar
-ms.localizationpriority: medium
-ms.collection:
-- m365-security
-- tier2
-- mde-edr
-ms.topic: how-to
-ms.subservice: edr
-ms.date: 06/17/2026
-appliesto:
- - Microsoft Defender for Endpoint Plan 1
- - Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
-
-ai-usage: ai-assisted
----
-# Isolation exclusions
-
-Isolation exclusion refers to the ability to exclude specific processes, IP addresses, or services from network isolation by applying the selective isolation response action to devices.
-
-Network isolation in Microsoft Defender for Endpoint (MDE) restricts a compromised device's communication to prevent threat spread. However, certain critical services, such as management tools or security solutions, might need to remain operational.
-
-Isolation exclusions allow designated processes or endpoints to bypass the restrictions of network isolation, ensuring essential functions (for example, remote remediation or monitoring) continue while limiting broader network exposure.
-
-## Prerequisites
-
-Before you use isolation exclusions, make sure the following prerequisites are met:
-
-* Isolation exclusion must be enabled.
-* Enabling isolation exclusion requires Security Admin or Manage Security settings permissions or above.
-
-### Supported operating systems
-
-Isolation exclusion is supported on the following operating systems:
-
-* Isolation exclusion is available on Windows 11, Windows 10 version 1703 or later, Windows Server 2016 and later, Windows Server 2012 R2, macOS and Azure Stack HCI OS, version 23H2 and later.
-
-> [!WARNING]
-> **Any exclusion weakens device isolation and increases security risks. To minimize risk, configure exclusions only when strictly necessary**.
-
-Regularly review and update exclusions to align with security policies.
-
-## Isolation modes
-
-There are two modes of isolation: **full isolation** and **selective isolation**.
-
-* **Full isolation**: In full isolation mode, the device is completely isolated from the network, and no exceptions are allowed. All traffic is blocked, except for essential communications with the Defender agent. Exclusions aren't applied in full isolation mode.
-
- Full isolation mode is the most secure option, suitable for scenarios where a high level of containment is necessary. For more information about full isolation mode, see [Isolate devices from the network](respond-machine-alerts.md#isolate-devices-from-the-network).
-
-* **Selective isolation**: Selective isolation mode allows administrators to apply exclusions to ensure that critical tools and network communications can still function, while maintaining the device's isolated state.
-
-## How to use isolation exclusion
-
-There are two steps to using isolation exclusion: defining isolation exclusion rules, and applying isolation exclusion on a device.
-
- :::image type="content" source="./media/isolation-exclusions/enable-exclusions.png" alt-text="Screenshot showing how to enable isolation exclusions." lightbox="./media/isolation-exclusions/enable-exclusions.png":::
-
- > [!NOTE]
- > Once the Isolation Exclusions feature has been enabled, the previously embedded exclusions for Microsoft Teams, Outlook, and Skype will no longer apply, and the exclusions list will start empty across all platforms. If Microsoft Teams, Outlook, and Skype still require access during isolation, you must manually define new exclusion rules for them.
- >
- > Note that Skype has been deprecated and is no longer included in any default exclusions.
-
-
-
-### Step 1: Define global exclusions in the settings
-
-To define global isolation exclusion rules, perform the following steps:
-
-1. In the [Microsoft Defender portal](https://security.microsoft.com), navigate to **Settings** > **Endpoints** > **Advanced features** > **Isolation Exclusion Rules**.
-
-1. Select the relevant OS tab (Windows rules or Mac rules).
-
-1. Select **+ Add exclusion rule**
-
- :::image type="content" source="./media/isolation-exclusions/add-new-exclusion-rule.png" alt-text="Screenshot showing how to add a new isolation exclusion rule.":::
-
-1. The **Add new exclusion rule** dialog appears:
-
- :::image type="content" source="./media/isolation-exclusions/exclusion-rule-definition.png" alt-text="Screenshot showing the fields required for defining an isolation exclusion rule." lightbox="./media/isolation-exclusions/exclusion-rule-definition.png":::
-
- Fill in the isolation exclusion parameters. Red asterisks denote mandatory parameters. The parameters and their valid values are described in the following table.
-
- | Parameter | Description and valid values |
- |:-----|:-----|
- | **Rule name** | Provide a name for the rule. |
- | **Rule description** | Describe the purpose of the rule. |
- |**Process path** (Windows only) | The file path of an executable is simply its location on the endpoint. You can define one executable to be used in each rule.
Examples:
`C:\Windows\System\Notepad.exe`
`%WINDIR%\Notepad.exe.`
**Notes**:
- The executable must exist when isolation is applied, otherwise the exclusion rule will be ignored.
- Exclusion won't apply to any child processes created by the specified process. |
- | **Service name** (Windows only) | Windows service short names can be used in cases you want to exclude a service (not an application) that is sending or receiving traffic. Service short names can be retrieved by running the *Get-Service* command from PowerShell. You can define one service to be used in each rule.
Example: termservice |
- | **Package family name** (Windows only) | The Package Family Name (PFN) is a unique identifier assigned to Windows app packages. The PFN format follows this structure: `
Package family names can be retrieved by running the *Get-AppxPackage* command from PowerShell. For example, to get the new Microsoft Teams PFN, run `Get-AppxPackage MSTeams`, and look for the value of the **PackageFamilyName** property.
Supported on:
- Windows 11 (24H2)
- Windows Server 2025
- Windows 11 (22H2) Windows 11, version 23H2 KB5050092
- Windows Server, Version 23H2
- Windows 10 22H2 - KB 5050081
- Azure Stack HCI OS, version 23H2 and later|
- | **Direction** | The connection direction (Inbound/Outbound). Examples:
**Outbound connection**: If the device initiates a connection, for instance, an HTTPS connection to a remote backend server, define only an outbound rule. Example: The device sends a request to 1.1.1.1 (outbound). In this case, no inbound rule is needed, as the response from the server is automatically accepted as part of the connection.
**Inbound connection**: If the device is listening to incoming connections, define an **inbound rule**.|
- | **Remote IP** | The IP (or IPs) with which communication is allowed while the device is isolated from the network.
Supported IP formats:
- IPv4/IPv6, with optional CIDR notation
- A comma-separated list of valid IPs
Up to 20 IP addresses can be defined per rule.
Valid input examples:
- Single IP address: `1.1.1.1`
- IPV6 address: `2001:db8:85a3::8a2e:370:7334`
- IP address with CIDR notation (IPv4 or IPv6): `1.1.1.1/24`
This example defines a range of IP addresses. In this case, it includes all IPs from 1.1.1.0 to 1.1.1.255. The /24 represents the subnet mask, which specifies that the first 24 bits of the address are fixed, and the remaining 8 bits define the address range.|
-
-1. Save and apply changes.
-
-**The global isolation exclusion rules you define in the portal apply whenever selective isolation is enabled for a device.**
-
-### Step 2: Apply selective isolation to a specific device
-
-1. Navigate to the device page in the portal.
-1. Select **Isolate device** and choose **Selective isolation**.
-1. Check **Use isolation exclusions to allow specific communication while the device is isolated** and enter a comment.
-
- :::image type="content" source="./media/isolation-exclusions/apply-exclusion-rule.png" alt-text="Screenshot showing how to apply an exclusion rule to a device.":::
-
-1. Select **Confirm**.
-
-Exclusions that were applied to a specific device can be reviewed in the Action Center history.
-
-:::image type="content" source="./media/isolation-exclusions/review-exclusions.png" alt-text="Screenshot showing exclusions in the Action Center history." lightbox="./media/isolation-exclusions/review-exclusions.png":::
-
-#### Apply selective isolation via API
-
-Alternatively, you can apply selective isolation via API. To do so, set the **IsolationType** parameter to *Selective*. For more information, see [Isolate machine API](api/isolate-machine.md).
-
-## Exclusion Logic
-
-Isolation exclusions are evaluated according to the following logic:
-
-* All rules that match will be applied.
-* Within a single rule, conditions use AND logic (all must match).
-* Undefined conditions in a rule are treated as "any" (that is, unrestricted for that parameter).
-
-For example, if the following rules are defined:
-
-```
-Rule 1:
-
- Process path = c:\example.exe
- Remote IP = 1.1.1.1
- Direction = Outbound
-
-Rule 2:
-
- Process path = c:\example_2.exe
- Direction = Outbound
-
-Rule 3:
-
- Remote IP = 18.18.18.18
- Direction = Inbound
-
-```
-* *example.exe* will only be able to initiate network connections to remote IP 1.1.1.1.
-* *example_2.exe* can initiate network connections to every IP address.
-* The device can receive inbound connection from IP address 18.18.18.18.
-
-## Considerations and limitations
-
-Changes to exclusion rules only impact new isolation requests. Devices that were already isolated remain with the exclusions that were defined when they were applied. To apply updated exclusion rules to isolated devices, release those devices from isolation and then reisolate them.
-
-Keeping existing exclusions unchanged for already-isolated devices ensures that isolation rules remain consistent throughout the duration of an active isolation session.
-
-## Related content
-
-- [Take response actions on a device](respond-machine-alerts.md)
-- [Investigate files](investigate-files.md)
-- [Manual response actions in Microsoft Defender for Endpoint Plan 1](defender-endpoint-plan-1.md#manual-response-actions)
-
-
-
diff --git a/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus.md b/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus.md
index 1a265b29c04..32fac5567e4 100644
--- a/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus.md
+++ b/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus.md
@@ -6,8 +6,8 @@ ms.localizationpriority: medium
ms.topic: how-to
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: yongrhee
ms.subservice: ngp
ms.collection:
@@ -24,14 +24,17 @@ ai-usage: ai-assisted
---
# Use limited periodic scanning in Microsoft Defender Antivirus
+## Overview
> [!NOTE]
-> **Microsoft does not support using this feature in Enterprise environments.** This feature only uses a limited subset of the Microsoft Defender Antivirus capabilities to detect malware, and can't detect most malware and potentially unwanted software. Management of the feature isn't supported, the feature can't be enabled or disabled through policies, and reporting capabilities are limited. Microsoft recommends that enterprise organizations choose a primary antivirus/antimalware solution, and use it exclusively.
+> **Microsoft does not support this feature in enterprise settings.** This feature uses only a small part of Microsoft Defender Antivirus to find threats. It can't detect most malware or unwanted software. You can't manage this feature or control it through policies. Reporting is also limited. Microsoft recommends that enterprises pick one antivirus product and use it alone.
-Limited periodic scanning is a special type of threat detection and remediation that can be enabled when another antivirus product is installed on a Windows 10 or Windows 11 device. It can only be enabled in certain situations. For more information about limited periodic scanning and how Microsoft Defender Antivirus works with other antivirus products, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md).
+Limited periodic scanning is a threat detection mode that works when another antivirus product is installed on a Windows 10 or Windows 11 device. You can turn it on only in certain cases. This article covers the prerequisites and steps to enable limited periodic scanning on your device. For more information, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md).
## Prerequisites
+Before you enable limited periodic scanning, make sure your device meets the following requirements.
+
### Supported operating systems
Limited periodic scanning is supported on the following operating systems:
@@ -40,13 +43,13 @@ Limited periodic scanning is supported on the following operating systems:
## How to enable limited periodic scanning
-By default, Microsoft Defender Antivirus enables itself on a Windows 10 or a Windows 11 device if there's no other antivirus product installed, or if the other product is out-of-date, expired, or not working correctly. If Microsoft Defender Antivirus is enabled, the usual options to configure it are available on that device:
+By default, Microsoft Defender Antivirus turns on when no other antivirus product is installed on a Windows 10 or Windows 11 device. It also turns on if the other product is out-of-date, expired, or not working. When Microsoft Defender Antivirus is on, you can configure it as usual on that device:
:::image type="content" source="media/vtp-wdav.png" alt-text="The Windows Security app showing Microsoft Defender Antivirus options, including scan options, settings, and update options" lightbox="media/vtp-wdav.png":::
-If another antivirus product is installed and working correctly, Microsoft Defender Antivirus disables itself. When Microsoft Defender Antivirus is disabled, the Windows Security app changes the **Virus & threat protection** section to show status about the antivirus product, and provides a link to the product's configuration options.
+If another antivirus product is installed and working, Microsoft Defender Antivirus turns itself off. The Windows Security app then shows the status of the other antivirus product in the **Virus & threat protection** section. It also provides a link to that product's settings.
-Underneath the name of a non-Microsoft antivirus product, a link appears as **Microsoft Defender Antivirus options**. Select this link to show the toggle that enables limited periodic scanning. The limited periodic option is a toggle to enable or disable periodic scanning. Sliding the switch to **On** shows the standard Microsoft Defender Antivirus options underneath the non-Microsoft antivirus product. The limited periodic scanning option appears at the bottom of the page.
+Below the non-Microsoft antivirus product name, select **Microsoft Defender Antivirus options**. Turn on the toggle to enable limited periodic scanning. When you slide the switch to **On**, the standard Microsoft Defender Antivirus options appear below the other product. The limited periodic scanning option is at the bottom of the page.
## Related articles
diff --git a/defender-endpoint/linux-exclusions.md b/defender-endpoint/linux-exclusions.md
index 37d1e2b9e90..b0b0b24c97c 100644
--- a/defender-endpoint/linux-exclusions.md
+++ b/defender-endpoint/linux-exclusions.md
@@ -12,13 +12,13 @@ ms.collection:
- mde-linux
ms.topic: how-to
ms.subservice: linux
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
@@ -26,7 +26,7 @@ ms.custom: msecd-doc-authoring-1014
This article provides information on how to define antivirus and global exclusions for Microsoft Defender for Endpoint. Antivirus exclusions apply to on-demand scans, real-time protection (RTP), and behavior monitoring (BM). Global exclusions apply to real-time protection (RTP), behavior monitoring (BM), and endpoint detection and response (EDR), thus stopping all the associated antivirus detections, EDR alerts, and visibility for the excluded item.
> [!IMPORTANT]
-> The antivirus exclusions described in this article apply to only antivirus capabilities, and not to endpoint detection and response (EDR). Files that you exclude by using the antivirus exclusions described in this article can still result in EDR alerts and other detections. Global exclusions described in this section apply to antivirus and EDR capabilities, thus stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are available in production for Defender for Endpoint on Linux, version `101.23092.0012` or later. For EDR-only exclusions, [get help and support in the Microsoft 365 admin center](/microsoft-365/admin/get-help-support).
+> The antivirus exclusions described in this article apply to only antivirus capabilities, and not to endpoint detection and response (EDR). Files that you exclude by using the antivirus exclusions described in this article can still result in EDR alerts and other detections. Global exclusions apply to antivirus and EDR capabilities, stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are available in production for Defender for Endpoint on Linux, version `101.23092.0012` or later. For EDR-only exclusions, [get help and support in the Microsoft 365 admin center](/microsoft-365/admin/get-help-support).
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux.
@@ -90,7 +90,9 @@ You can configure exclusions using a management JSON configuration, Defender for
### Configure exclusions using a management console
-In enterprise environments, exclusions can also be managed through a configuration profile. Typically, you would use a configuration management tool like Puppet, Ansible, or another management console to push a file with the name `mdatp_managed.json` at the location `/etc/opt/microsoft/mdatp/managed/`. For more information, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md). The following `mdatp_managed.json` example shows how to configure antivirus and global exclusions for files, folders, extensions, and processes:
+In enterprise environments, exclusions can also be managed through a configuration profile. Typically, you would use a configuration management tool like Puppet, Ansible, or another management console to push a file with the name `mdatp_managed.json` at the location `/etc/opt/microsoft/mdatp/managed/`. For more information, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md).
+
+The following `mdatp_managed.json` example shows how to configure antivirus and global exclusions for files, folders, extensions, and processes:
```JSON
{
@@ -153,7 +155,7 @@ You can use the Microsoft Intune admin center or the Microsoft Defender portal t
#### 2. Create a Microsoft Entra group
-Create a dynamic Microsoft Entra group based on the operating system type to ensure that all devices onboarded to Defender for Endpoint receive the appropriate policies. This dynamic group automatically includes devices managed by Defender for Endpoint, eliminating the need for admins to manually create new policies. For more information, see the following article: [Create Microsoft Entra Groups](/intune/intune-service/protect/mde-security-integration#create-microsoft-entra-groups)
+Create a dynamic Microsoft Entra group based on the operating system type to ensure that all devices onboarded to Defender for Endpoint receive the appropriate policies. This dynamic group automatically includes devices managed by Defender for Endpoint, eliminating the need for admins to manually create new policies. For more information, see [Create Microsoft Entra Groups](/intune/intune-service/protect/mde-security-integration#create-microsoft-entra-groups).
#### 3. Create an endpoint security policy
@@ -173,12 +175,12 @@ Create a dynamic Microsoft Entra group based on the operating system type to ens
1. On the **Review + create** page, when you're done, select **Save**. The new profile is displayed in the list when you select the policy type for the profile you created.
-For more information about creating endpoint security policies, see [Manage endpoint security policies in Microsoft Defender for Endpoint](manage-security-policies.md#create-an-endpoint-security-policy).
+For more information about creating endpoint security policies, see [Manage endpoint security policies in Microsoft Defender for Endpoint](endpoint-security-policies-configure.md#create-an-endpoint-security-policy).
### Configure exclusions using the command line
-Run the following command to see the available switches for managing exclusions:
+To view the available subcommands and switches for managing exclusions, run the `mdatp exclusion` command:
```bash
mdatp exclusion
@@ -191,96 +193,134 @@ mdatp exclusion
> [!TIP]
> When configuring exclusions with wildcards, enclose the parameter in double-quotes to prevent globbing.
-This section includes several examples.
+The following examples show how to configure exclusions by using the command line.
#### Example 1: Add an exclusion for a file extension
You can add an exclusion for a file extension. Keep in mind that extension exclusions aren't supported for the global exclusion scope.
+To add an antivirus exclusion for the `.txt` file extension, run the following command:
+
```bash
mdatp exclusion extension add --name .txt
```
+If the command succeeds, the output confirms the exclusion was added:
+
```console
Extension exclusion configured successfully
```
-
+
+To remove the `.txt` extension exclusion, run the following command:
+
```bash
mdatp exclusion extension remove --name .txt
```
+If the exclusion is removed successfully, you see the following output:
+
```console
Extension exclusion removed successfully
- ```
+```
#### Example 2: Add or remove a file exclusion
You can add or remove an exclusion for a file. The file path should already be present if you're adding or removing an exclusion with the global scope.
+To add a file exclusion with the antivirus (`epp`) scope, which excludes the file from on-demand scans, real-time protection, and behavior monitoring, run the following command:
+
```bash
mdatp exclusion file add --path /var/log/dummy.log --scope epp
```
+If the command succeeds, you see the following output:
+
```console
File exclusion configured successfully
```
+To remove the antivirus file exclusion, run the following command:
+
```bash
mdatp exclusion file remove --path /var/log/dummy.log --scope epp
```
-
+
+On success, the CLI returns output similar to the following:
+
```console
File exclusion removed successfully"
```
-
+
+To add the same file exclusion with the global scope, which excludes the file from both antivirus and EDR processing, run the following command:
+
```bash
mdatp exclusion file add --path /var/log/dummy.log --scope global
```
+On success, the CLI returns output similar to the following:
+
```console
File exclusion configured successfully
```
+To remove the global file exclusion, run the following command:
+
```bash
mdatp exclusion file remove --path /var/log/dummy.log --scope global
```
+If the exclusion is removed successfully, you see the following output:
+
```console
File exclusion removed successfully"
```
#### Example 3: Add or remove a folder exclusion
-You can add or remove an exclusion for a folder.
+You can add or remove an exclusion for a folder. The following command adds a folder exclusion with the antivirus (`epp`) scope:
```bash
mdatp exclusion folder add --path /var/log/ --scope epp
```
+If the command succeeds, you see the following output:
+
```console
Folder exclusion configured successfully
```
-
+
+To remove the antivirus folder exclusion, run the following command:
+
```bash
mdatp exclusion folder remove --path /var/log/ --scope epp
```
+If the exclusion is removed successfully, you see the following output:
+
```console
Folder exclusion removed successfully
```
+To add the same folder exclusion with the global scope, run the following command:
+
```bash
mdatp exclusion folder add --path /var/log/ --scope global
```
+On success, the CLI returns output similar to the following:
+
```console
Folder exclusion configured successfully
```
+To remove the global folder exclusion, run the following command:
+
```bash
mdatp exclusion folder remove --path /var/log/ --scope global
```
+If the exclusion is removed successfully, you see the following output:
+
```console
Folder exclusion removed successfully
```
@@ -306,7 +346,7 @@ You can add an exclusion for a folder with a wildcard. Keep in mind that Wildcar
mdatp exclusion folder add --path "/var/*/tmp"
```
-The previous command excludes paths under `*/var/*/tmp/*`, but not folders that are siblings of `*tmp*`. For example, `*/var/this-subfolder/tmp*` is excluded, but `*/var/this-subfolder/log*` isn't excluded.
+Using the path `"/var/*/tmp"` excludes paths under `*/var/*/tmp/*`, but not folders that are siblings of `*tmp*`. For example, `*/var/this-subfolder/tmp*` is excluded, but `*/var/this-subfolder/log*` isn't excluded.
```bash
mdatp exclusion folder add --path "/var/" --scope epp
@@ -318,7 +358,7 @@ OR
mdatp exclusion folder add --path "/var/*/" --scope epp
```
-The previous command excludes all paths whose parent is `*/var/*`, such as `*/var/this-subfolder/and-this-subfolder-as-well*`.
+Either of these commands excludes all paths whose parent is `*/var/*`, such as `*/var/this-subfolder/and-this-subfolder-as-well*`.
```console
Folder exclusion configured successfully
@@ -348,31 +388,41 @@ mdatp exclusion process remove --path /usr/bin/cat --scope global
Process exclusion removed successfully
```
+For antivirus exclusions, you can also use just the process name instead of the full path with the `--name` flag. The following command adds an antivirus process exclusion by name:
+
```bash
mdatp exclusion process add --name cat --scope epp
```
+If the command succeeds, you see the following output:
+
```console
Process exclusion configured successfully
```
+To remove the antivirus process exclusion by name, run the following command:
+
```bash
mdatp exclusion process remove --name cat --scope epp
```
+If the exclusion is removed successfully, you see the following output:
+
```console
Process exclusion removed successfully
```
#### Example 7: Add an exclusion for a second process
-You can add an exclusion for a second process.
+You can add exclusions for multiple processes with different scopes. The following commands add an antivirus (`epp`) exclusion by process name and a global exclusion by full path:
```bash
mdatp exclusion process add --name cat --scope epp
mdatp exclusion process add --path /usr/bin/dog --scope global
```
+If the commands succeed, you see the following output:
+
```console
Process exclusion configured successfully
```
@@ -422,7 +472,10 @@ For example, to add `EICAR-Test-File (not a virus)` to the allowlist, run the fo
mdatp threat allowed add --name "EICAR-Test-File (not a virus)"
```
-## See also
+
+## Related content
+
+The following articles provide more information about configuring and managing Defender for Endpoint on Linux:
- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
- [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md)
diff --git a/defender-endpoint/linux-install-manually.md b/defender-endpoint/linux-install-manually.md
index b4070e58852..1594ed550e1 100644
--- a/defender-endpoint/linux-install-manually.md
+++ b/defender-endpoint/linux-install-manually.md
@@ -362,6 +362,8 @@ sudo apt install mdatp
> [!NOTE]
> If you have multiple Microsoft repositories configured on your device, you can be specific about which repository to install the package from. The following example shows how to install the package from the `production` channel if you also have the `insiders-fast` repository channel configured on this device. This situation can happen if you're using multiple Microsoft products on your device.
+>
+> The version numbers and release codenames in the following code snippets are examples. Use the actual release codename the bash command returns.
```bash
cat /etc/apt/sources.list.d/*
diff --git a/defender-endpoint/linux-install-with-defender-deployment-tool.md b/defender-endpoint/linux-install-with-defender-deployment-tool.md
index c08774faca5..63bb1df71cc 100644
--- a/defender-endpoint/linux-install-with-defender-deployment-tool.md
+++ b/defender-endpoint/linux-install-with-defender-deployment-tool.md
@@ -19,7 +19,7 @@ appliesto:
- Microsoft Defender for Endpoint Plan 2
---
-# Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool (preview)
+# Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool
The Defender deployment tool provides an efficient, user-friendly onboarding process for Microsoft Defender for Endpoint on Linux devices. It allows users to install and onboard Microsoft Defender for Endpoint using a single package that can be downloaded from the Microsoft Defender portal. This eliminates the need to install Defender using installer script/cli commands and then, separately, to onboard the device using the onboarding package from the portal.
@@ -29,7 +29,7 @@ The defender-deployment tool supports both manual and bulk onboarding through th
Before you get started, see [Prerequisites for Microsoft Defender for Endpoint on Linux](./mde-linux-prerequisites.md) for a description of prerequisites and system requirements. Additionally, the following requirements also need to be met:
-- Allow connection to the URL: `msdefender.download.prss.microsoft.com`. Before you begin deployment, make sure to run the [connectivity test](#check-connectivity-issues), which checks if the URLs Defender for Endpoint uses are accessible or not.
+- Allow connection to the URL: `msdefender.download.prss.microsoft.com`. Before you begin deployment, make sure to run the [connectivity test](#troubleshoot-deployment-issues), which checks if the URLs Defender for Endpoint uses are accessible or not.
- The endpoint must have either **wget** or **curl** installed.
The deployment tool enforces the following set of prerequisites checks, which if not met will abort the deployment process:
@@ -37,7 +37,7 @@ The deployment tool enforces the following set of prerequisites checks, which if
- Device memory: Greater than 1 GB
- Available disk space on the device: Greater than 2GB
- Glibc library version on the device: Newer than 2.17
-- mdatp version on the device: Must be a supported version and not expired. To check product expiration date, run the command `-mdatp health`.
+- Defender build version: Must be supported and not expired. To check the product expiration date, run the command `-mdatp health`.
> [!TIP]
> Before running the deployment tool to onboard Defender onto your Linux server, it's recommended to run the tool with the `--pre-req` option to help identify and fix any potential issues that might impact the deployment.
@@ -48,12 +48,12 @@ The deployment tool enforces the following set of prerequisites checks, which if
1. Go to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
- 1. In the Step 1 drop-down menu, select **Linux Server (Preview)** as the operating system.
+ 1. In the Step 1 drop-down menu, select **Linux** as the operating system.
- 1. Under **Download and apply onboarding packages or files**, select the **Download package** button.
+ 1. Under **Download and apply onboarding packages or files**, select the **Download package** button under **Defender deployment tool**.
- >[!NOTE]
- >Since this package installs and onboards the agent, it's a tenant specific package and must not be used across tenants.
+ > [!NOTE]
+ > Since this package installs and onboards the agent, it's a tenant specific package and must not be used across tenants.
:::image type="content" source="./media/linux-install-with-defender-deployment-tool/deployment-tool-download-package.png" alt-text="Screenshot showing the download package button." lightbox="./media/linux-install-with-defender-deployment-tool/deployment-tool-download-package.png":::
@@ -97,10 +97,11 @@ The deployment tool enforces the following set of prerequisites checks, which if
| **Scenario** | **Command** |
|:-------------|:------------|
- | Check for unmet non-blocking prerequisites | `sudo ./defender_deployment_tool.sh --pre-req-non-blocking` |
+ | Check for unmet prerequisites | `sudo ./defender_deployment_tool.sh --pre-req` |
| Run the connectivity test | `sudo ./defender_deployment_tool.sh --connectivity-test` |
| Deploy to a custom location | `sudo ./defender_deployment_tool.sh --install-path /usr/microsoft/` |
- | Deploy from the insider-slow channel | `sudo ./defender_deployment_tool.sh --channel insiders-slow` |
+ | Deploy from a locally configured package repository | `sudo ./defender_deployment_tool.sh --use-local-repo`
This option can't be combined with `--channel` or `--clean`. |
+ | Deploy from a specific channel | `sudo ./defender_deployment_tool.sh --channel insiders-slow` |
| Deploy using a proxy | `sudo ./defender_deployment_tool.sh --http-proxy
*(Note: Before using the --offboard option, you must first download the latest offboarding script from the Defender portal at System > Settings > Endpoints > Offboarding). For other methods of offboarding, see [Offboard or uninstall Microsoft Defender for Endpoint on Linux](linux-off-board-endpoints.md).* |
-## Verify deployment status
+## Monitor deployment progress in the Microsoft Defender portal
+
+As the Defender deployment tool runs, it sends a progress event to the Defender portal at the start and end of each deployment step. These events let you track deployment status for all your devices without signing in to each one, and pinpoint the step where a failed deployment stopped.
+
+Check the onboarding status for a device in **Device inventory**. To check fleet-wide onboarding status, use an advanced hunting query. To see the stepwise progress, see the device timeline. Go to **Device inventory**, select the device, and then select **Timeline**.
+
+To filter deployment events on the timeline, enter `DefenderDeployment` in the timeline search box. Each event reads `Defender deployment tool:
`audit`
`on_demand`
`passive`|Not configured
Real-time
Audit
On-demand
Passive|
For descriptions of the dictionary contents and policy properties, see [Enforcement level for Microsoft Defender Antivirus](#enforcement-level-for-microsoft-defender-antivirus), [Scan exclusions](#scan-exclusions), [Threat type settings](#threat-type-settings), and [Exclusion merge policy](#exclusion-merge-policy).
#### Enforcement level for Microsoft Defender Antivirus
-Specifies the enforcement preference of the antivirus engine. There are three values for setting enforcement level:
+Specifies the enforcement preference of the antivirus engine. There are four values for setting enforcement level:
> [!IMPORTANT]
-> Only one enforcement level can be configured at a time. You can configure either `passive` or `real-time` mode, but not both.
-
-- **Real-time** (`real_time`): Real-time protection (scan files as they're modified) is enabled.
+> By default, Microsoft Defender Antivirus is set to `passive`. You can change the enforcement level based on your requirements.
-- **On-demand** (`on_demand`): Files are scanned only on demand:
- - Real-time protection is off.
- - Definition updates occur only when a scan starts, even if `automaticDefinitionUpdateEnabled` is set to `true` in on-demand mode.
+|Enforcement level|Description|
+|---|---|
+|**Real-time**|Actively monitors, detects, and remediates threats in real time.|
+|**Audit**|Actively monitors and detects threats in real time without automatically remediating them.|
+|**On-demand**|Detects and remediates threats only during manual or scheduled scans.|
+|**Passive**|Doesn't provide real-time threat detection. Threats can still be detected during manual or scheduled scans.|
-- **Passive** (`passive`): Runs the antivirus engine in passive mode:
- - Real-time protection is off. Microsoft Defender Antivirus doesn't remediate threats.
- - On-demand scanning is on. Scan capabilities are still available on the device.
- - Automatic threat remediation is off. No files are moved and your security administrator is expected to take required action.
- - Security intelligence updates are on. Alerts are available in the security administrator's organization.
- - Definition updates occur only when a scan starts, even if `automaticDefinitionUpdateEnabled` is set to `true`.
- - [Endpoint detection and response (EDR)](overview-endpoint-detection-response.md) is on. The output of the `mdatp health` command on the device shows `engine not loaded` for the `engine_load_version` property. The engine is related to antivirus, not EDR.
+##### Verify the enforcement level
-To verify whether real-time protection is enabled on the device, run:
+To verify the active antivirus enforcement level, run:
```bash
-mdatp health --field real_time_protection_enabled
+mdatp health --field antivirus_enforcement_level
```
+The command returns the active enforcement level (`real_time`, `audit`, `on_demand`, or `passive`).
+
> [!NOTE]
>
-> - Available in Defender for Endpoint version `101.10.72` or later.
-> - In version `101.23062.0001` or later, the default value is `passive`. In previous versions, the default was `real_time`.
-> - We also recommended using [scheduled scans](schedule-antivirus-scans-linux.md) as per requirement.
+> - Audit mode is available in Defender for Endpoint version `101.26062.0007` or later.
+> - Before enabling real-time protection, we recommend running a full scan to identify and remediate any existing threats. This helps ensure the device is in a clean state before real-time monitoring and protection are enabled. For information about scheduling scans, see [Schedule antivirus scans on Linux (preview)](schedule-antivirus-scans-linux.md).
#### Enable or disable behavior monitoring (if RTP is enabled)
@@ -379,7 +378,8 @@ Specifies whether to use user-defined exclusions on the device. Valid values are
> [!NOTE]
> Available in Defender for Endpoint version `100.83.73` or later.
-### Scan exclusions
+
+### Configure scan exclusions
Entities excluded from scans. You specify exclusions as an array of items. Admins can specify as many elements as necessary, in any order. You specify exclusions using full paths, extensions, or file names.
@@ -486,6 +486,7 @@ When you add or remove a filesystem from the unmonitored list, Microsoft validat
- `ramfs`
- `reiserfs`
- `tmpfs`
+ - `udf`
- `vfat`
- `xfs`
- By default, the following filesystems are unmonitored by RTP:
@@ -499,7 +500,7 @@ When you add or remove a filesystem from the unmonitored list, Microsoft validat
\* Currently, RTP monitoring of this filesystem is in Preview.
-For example, to remove `nfs` and `nfs4` from the list of unmonitored filesystems (which means `nfs` and `nfs4` are monitored by RTP after validation), update the managed config file with the following entry:
+To configure the `unmonitoredFilesystems` setting, add it to the `antivirusEngine` section of your managed configuration file. Filesystems included in this array are excluded from real-time protection (RTP) monitoring. For example, to remove `nfs` and `nfs4` from the unmonitored list so that RTP monitors them after validation, update the managed config file with the following entry:
```json
{
@@ -509,7 +510,7 @@ For example, to remove `nfs` and `nfs4` from the list of unmonitored filesystems
}
```
-To remove all entries from the list of unmonitored filesystems, use the following entry:
+To clear the unmonitored filesystems list so that RTP monitors all supported filesystem types, set `unmonitoredFilesystems` to an empty array. This configuration ensures that no filesystems are excluded from real-time protection monitoring:
```json
{
@@ -532,7 +533,8 @@ Enables or disables file hash computation for files scanned by Defender for Endp
> [!NOTE]
> Available in Defender for Endpoint version `101.85.27` or later.
-### Allowed threats
+
+### Configure allowed threats
Specifies the names of threats that aren't blocked by Defender for Endpoint. Instead, these threats are allowed to run.
@@ -541,7 +543,8 @@ Specifies the names of threats that aren't blocked by Defender for Endpoint. Ins
|**Key**|`allowedThreats`|Allowed threats|
|**Data type**|Array of strings|Dynamic String List|
-### Disallowed threat actions
+
+### Configure disallowed threat actions
Restricts the allowed actions by the device user when threats are detected. The actions included in this list aren't displayed in the user interface.
@@ -682,7 +685,7 @@ Entities excluded from scans. You specify exclusions as an array of items. Admin
|**Key**|`exclusions`|
|**Data type**|Dictionary (nested preference)|
-See the following subsections for a description of the dictionary contents.
+The exclusion dictionary includes entries for type of exclusion, scope of exclusion, path to excluded content, path type (file or directory), file extension, and process name.
#### Type of exclusion
@@ -837,7 +840,7 @@ The `scheduledScan` section of the configuration profile configures built-in sch
|**Key**|`scheduledScan`|
|**Data type**|Dictionary (nested preference)|
-See the following subsections for a description of the dictionary contents.
+For a description of the scheduled scan dictionary contents, see [Enable scheduled scans](#enable-scheduled-scans), [Weekly scan configuration](#weekly-scan-configuration), [Daily scan configuration](#daily-scan-configuration), and [Advanced scheduled scan settings](#advanced-scheduled-scan-settings).
For the full details on scheduled scan configuration, including how to use Security Settings Management policies and the command line, see [Schedule antivirus scans on Linux (preview)](schedule-antivirus-scans-linux.md).
@@ -976,7 +979,8 @@ Randomizes the scan start time within a defined window (in hours) to avoid simul
|**Data type**|Integer|
|**Possible values**|`0`–`23`. Default: `0` (no randomization)|
-### Cloud-delivered protection preferences
+
+### Configure cloud-delivered protection preferences
The *cloudService* entry in the configuration profile configures the cloud-driven protection feature.
@@ -1106,7 +1110,8 @@ Specifies whether infected processes that open or load infected files get remedi
> [!NOTE]
> Available in Defender for Endpoint version `101.24122.0001` or later.
-### Supplementary sensor configurations
+
+### Configure supplementary sensor settings
Use the following settings to configure certain advanced supplementary sensor features.
@@ -1286,7 +1291,8 @@ Specifies whether suspicious events from Antivirus are reported to EDR.
> [!NOTE]
> Available in Defender for Endpoint version `101.23062.0010` or later.
-### Network protection configurations
+
+### Configure network protection settings
> [!NOTE]
>
@@ -1368,9 +1374,11 @@ When you first run the `mdatp health` command, the tag and group ID values are b
## Configuration profile validation
+Before you deploy the configuration profile, validate that the managed JSON file is correctly formatted and confirm that Defender for Endpoint applies the settings as expected.
+
### Validate the managed JSON file
-The configuration profile must be a valid JSON-formatted file. Many tools are available for you to verify the configuration profile. For example, run the following command if you have `python` installed on your device:
+The configuration profile must be a valid JSON-formatted file. Before you deploy the profile, verify that the JSON syntax is correct and the file can be parsed without errors. Many tools are available for this validation. For example, the following command uses the Python `json.tool` module to check the file for valid JSON syntax and pretty-print its contents for inspection. Run this command if you have `python` installed on your device:
```bash
python -m json.tool mdatp_managed.json
@@ -1396,4 +1404,4 @@ To verify that your `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json` is wor
## Configuration profile deployment
-After you create the configuration profile for your organization, you can deploy it using your current management tools. Defender for Endpoint on Linux reads the managed configuration from `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`.
+After you create the configuration profile for your organization, you can deploy it using your current management tools. Defender for Endpoint on Linux reads the managed configuration from `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`.
\ No newline at end of file
diff --git a/defender-endpoint/linux-static-proxy-configuration.md b/defender-endpoint/linux-static-proxy-configuration.md
index 50343ac348d..e94d40e2ad7 100644
--- a/defender-endpoint/linux-static-proxy-configuration.md
+++ b/defender-endpoint/linux-static-proxy-configuration.md
@@ -12,13 +12,13 @@ ms.collection:
- mde-linux
ms.topic: how-to
ms.subservice: linux
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Configure Microsoft Defender for Endpoint on Linux for static proxy discovery
@@ -28,24 +28,24 @@ Microsoft Defender for Endpoint can discover a proxy server using the `HTTPS_PRO
## Configure static proxy discovery during installation
-During installation, the `HTTPS_PROXY` environment variable must be passed to the package manager. The package manager can read this variable in any of the following ways:
+During installation, the `HTTPS_PROXY` environment variable must be passed to the Linux package manager (such as APT, YUM, or Zypper) that installs the Defender for Endpoint package. The package manager reads this variable so it can download packages through the specified proxy. You can configure the variable in any of the following ways:
-- The `HTTPS_PROXY` variable is defined in `/etc/environment` with the following line:
+- The `HTTPS_PROXY` variable is defined in `/etc/environment` with the following line. This sets the proxy globally so that all processes, including the package manager, can route traffic through the specified proxy server:
```bash
HTTPS_PROXY="http://proxy.server:port/"
```
-- The `HTTPS_PROXY` variable is defined in the package manager global configuration. For example, in Ubuntu 18.04, you can add the following line to `/etc/apt/apt.conf.d/proxy.conf`:
+- The `HTTPS_PROXY` variable is defined in the package manager global configuration. This setting routes package downloads through the specified HTTPS proxy during installation. For example, in Ubuntu 18.04, you can add the following line to `/etc/apt/apt.conf.d/proxy.conf`:
```bash
Acquire::https::Proxy "http://proxy.server:port/";
```
> [!CAUTION]
- > The above two methods could define the proxy to use for other applications on your system. Use this method with caution, or only if this is meant to be a global configuration.
+ > Defining `HTTPS_PROXY` in `/etc/environment` or in the package manager global configuration could define the proxy for other applications on your system. Use either of these methods with caution, and only if you intend the proxy setting to be global.
-- The `HTTPS_PROXY` variable is prepended to the installation or uninstallation commands. For example, with the APT package manager, prepend the variable as follows when installing Microsoft Defender for Endpoint:
+- The `HTTPS_PROXY` variable is prepended to the installation or uninstallation commands. This approach applies the proxy setting only for that single command invocation without affecting other applications. For example, with the APT package manager, prepend the variable as follows when installing Microsoft Defender for Endpoint:
```bash
HTTPS_PROXY="http://proxy.server:port/" apt install mdatp
@@ -66,7 +66,7 @@ After installation, configure Defender for Endpoint with a static proxy. You can
### Method 1: Configure static proxy discovery using the mdatp command-line tool
-Run the following command on the endpoint to configure proxy for Defender for Endpoint.
+Run the following command on the endpoint to set the Defender for Endpoint runtime proxy through the `mdatp` CLI, enabling ongoing cloud connectivity through the specified proxy server.
```bash
mdatp config proxy set --value http://address:port
@@ -75,7 +75,7 @@ mdatp config proxy set --value http://address:port
### Method 2: Configure static proxy discovery using managed configuration
-Set the proxy in the managed configuration at `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`. This is an example of the json schema:
+Set the proxy in the managed configuration at `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`. This approach is suited for centrally managed deployments where a management tool distributes the configuration file. The following example shows the JSON schema for setting the cloud service proxy:
```json
{
@@ -85,7 +85,7 @@ Set the proxy in the managed configuration at `/etc/opt/microsoft/mdatp/managed/
}
```
-A management tool of choice can be used to deploy the managed configuration in `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`. Please check [Set preferences for Microsoft Defender for Endpoint on Linux](./linux-preferences.md) for more details on managed configuration.
+A management tool of choice can be used to deploy the managed configuration in `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`. For details about the managed configuration file format and deployment, see [Set preferences for Microsoft Defender for Endpoint on Linux](./linux-preferences.md).
diff --git a/defender-endpoint/linux-support-ebpf.md b/defender-endpoint/linux-support-ebpf.md
index e528794639d..51284ec3d6f 100644
--- a/defender-endpoint/linux-support-ebpf.md
+++ b/defender-endpoint/linux-support-ebpf.md
@@ -12,13 +12,13 @@ ms.collection:
- mde-linux
ms.topic: how-to
ms.subservice: linux
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux
@@ -76,13 +76,13 @@ The eBPF sensor is automatically enabled for all customers by default for agent
:::image type="content" source="/defender/media/defender-endpoint/ebpf-subsystem-linux.png" alt-text="ebpf subsystem highlight in the mdatp health command" lightbox="/defender/media/defender-endpoint/ebpf-subsystem-linux.png":::
-In case you want to manually disable eBPF then you can run the following command:
+To enable or disable the eBPF supplementary event provider, run the following command:
```bash
sudo mdatp config ebpf-supplementary-event-provider --value [enabled/disabled]
```
-You can also update the mdatp_managed.json file:
+Alternatively, you can disable the eBPF supplementary event provider by setting `ebpfSupplementaryEventProvider` to `disabled` in the mdatp_managed.json file:
```JSON
{
@@ -111,9 +111,9 @@ You can also check the status of eBPF (enabled/disabled) on your linux endpoints
## Immutable mode of AuditD
-For customers using AuditD in immutable mode, a reboot is required post enablement of eBPF in order to clear the audit rules added by Microsoft Defender for Endpoint. This requirement is a limitation in immutable mode of AuditD, which freezes the rules file and prohibits editing/overwriting. This issue is resolved with the reboot.
+For customers using AuditD in immutable mode, a reboot is required post enablement of eBPF in order to clear the audit rules added by Microsoft Defender for Endpoint. This requirement is a limitation in immutable mode of AuditD, which freezes the rules file and prohibits editing/overwriting. Rebooting clears the Microsoft Defender for Endpoint audit rules that can't be removed while AuditD is in immutable mode.
-Post reboot, run the following command to check if audit rules were cleared:
+After the reboot, list the current AuditD rules to confirm that the Defender for Endpoint audit rules were successfully cleared:
```bash
% sudo auditctl -l
@@ -129,7 +129,7 @@ The output of previous command should show no rules or any user added rules. In
### Troubleshooting and Diagnostics
-You can check the agent health status by running the `mdatp` health command. Make sure that the eBPF sensor for Defender for Endpoint on Linux is supported by checking the current kernel version by using the following command line:
+You can check the agent health status by running the `mdatp` health command. To verify that your kernel version meets the eBPF sensor requirements listed in [System prerequisites](#system-prerequisites), check the current kernel version by running the following command:
```bash
uname -a
@@ -139,7 +139,7 @@ uname -a
Be aware of the following known issues when using the eBPF sensor on Linux:
-1. Enabling eBPF on RHEL 8.1 version with SAP might result in kernel panic. To mitigate this issue, you can take one of the following steps:
+1. **Warning:** On RHEL 8.1 with SAP, enabling eBPF can cause a kernel panic. Before enabling eBPF on this configuration, take one of the following mitigation steps:
- Use a distro version higher than RHEL 8.1.
- Switch to AuditD mode if you need to use RHEL 8.1 version.
@@ -173,8 +173,9 @@ If you see increased resource consumption by Microsoft Defender on your endpoint
sudo mdatp diagnostic ebpf-statistics
```
+The following sample output shows the eBPF statistics collected over a 20-second monitoring interval, including the top file paths, initiator processes, and system call IDs:
+
```console
-Output
Monitor 20 seconds
Top file paths:
/var/log/microsoft/mdatp/microsoft_defender.log : 10
@@ -198,7 +199,7 @@ Top syscall ids:
87 : 3
```
-In the previous output, you can see that stress-ng is the top process generating large number of events and might result into performance issues. Most likely stress-ng is generating the system call with ID 82. You can create a ticket with Microsoft to get this process excluded.
+In the `mdatp diagnostic ebpf-statistics` output, stress-ng is the top process generating a large number of events and might result in performance issues. Most likely stress-ng is generating the system call with ID 82. You can create a ticket with Microsoft to get this process excluded.
Exclusions applied to AuditD can't be migrated or copied to eBPF. Common concerns such as noisy logs, kernel panic, noisy syscalls are already taken care of by eBPF internally. In case you want to add any further exclusions, then reach out to Microsoft to get the necessary exclusions applied.
diff --git a/defender-endpoint/linux-support-offline-security-intelligence-update.md b/defender-endpoint/linux-support-offline-security-intelligence-update.md
index 09c578beb58..5b1c504f554 100644
--- a/defender-endpoint/linux-support-offline-security-intelligence-update.md
+++ b/defender-endpoint/linux-support-offline-security-intelligence-update.md
@@ -12,18 +12,20 @@ ms.collection:
- tier3
- mde-linux
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux
[!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)]
+This article walks you through setting up offline security intelligence updates for Microsoft Defender for Endpoint on Linux. Use this approach to keep antivirus definitions current on Linux devices that have limited or no internet connectivity, by downloading updates to a local mirror server and distributing them across your fleet. Before you begin, review the [Prerequisites](#prerequisites) to ensure your environment meets the requirements.
+
## How offline security intelligence updates work
This article describes how to configure offline security intelligence updates in Defender for Endpoint on Linux. This capability enables you to update security intelligence (also referred to as *definitions* or *signatures*) on Linux devices that have limited or no exposure to the internet. With this configuration, you use a local hosting server, called a *mirror server*, that connects to the Microsoft cloud to download security intelligence updates. Other Linux devices pull these updates from your mirror server at predefined intervals.
@@ -121,7 +123,7 @@ To use the zip package instead of cloning the repository, follow these steps:
#### Local directory structure after cloning the repo or downloading the zipped file
-After cloning the repo or downloading the zipped file, the local directory structure should be as follows:
+Use the following example directory listing to verify that your local copy contains the expected `linux/definition_downloader` structure and scripts:
```console
user@vm:~/mdatp-xplat$ tree linux/definition_downloader/
@@ -153,13 +155,13 @@ The `settings.json` file consists of a few variables that the user can configure
To manually execute the downloader script, configure the parameters in the `settings.json` file as per the description in the previous section, and use one of the following commands based on the OS of the mirror server:
-- Bash:
+- Bash: Run the following command to fetch the latest offline definition updates into the configured download folder:
```bash
./xplat_offline_updates_download.sh
```
-- PowerShell:
+- PowerShell: If your mirror server runs Windows, use the PowerShell downloader script to retrieve the offline definition package:
```powershell
./xplat_offline_updates_download.ps1
@@ -209,7 +211,7 @@ In the **Configuration settings** step, you can find the configuration settings
# [Managed JSON](#tab/managed-json)
-Use the following sample `mdatp_managed.json` and update the parameters as per the configuration and copy the file to the location `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`.
+The `mdatp_managed.json` file is the managed configuration file that Defender for Endpoint on Linux reads at startup to apply policy settings. Use the following sample `mdatp_managed.json`, update the parameters as per your configuration, and copy the file to the location `/etc/opt/microsoft/mdatp/managed/mdatp_managed.json`.
```json
{
@@ -221,9 +223,6 @@ Use the following sample `mdatp_managed.json` and update the parameters as per t
"offlineDefinitionUpdateUrl": "http://172.22.199.67:8000/linux/production/",
"offlineDefinitionUpdateFallbackToCloud":false,
"offlineDefinitionUpdate": "enabled"
- },
- "features": {
- "offlineDefinitionUpdateVerifySig": "enabled"
}
}
```
@@ -235,10 +234,35 @@ Use the following sample `mdatp_managed.json` and update the parameters as per t
| `offlineDefinitionUpdateUrl` | String | URL value generated as part of the mirror server setup. This can be either in terms of the remote server URL or a directory (local/remote mount point). See [Host the offline security intelligence updates on the mirror server](#host-the-offline-security-intelligence-updates-on-the-mirror-server) for information about how to specify this path.|
| `offlineDefinitionUpdate` | `enabled`/`disabled` | When set to `enabled`, the offline security intelligence update feature is enabled, and vice versa. |
| `offlineDefinitionUpdateFallbackToCloud` | `True`/`False` | Determine Defender for Endpoint security intelligence update approach when offline mirror server fails to serve the update request. If set to `true`, the update is retried via the Microsoft cloud when offline security intelligence update failed; else, vice versa. |
-| `offlineDefinitionUpdateVerifySig` | `enabled`/`disabled` | When set to `enabled`, downloaded definitions are verified on the endpoints; else, vice versa. **This setting is enabled by default starting from version 101.25092.0005, and therefore is not available for configuration in the Defender portal**. |
---
+## Engine signature verification
+
+Starting with release `101.26062.0005`, Defender for Endpoint on Linux verifies the antivirus engine's digital signature before loading it. This default-on behavior helps protect your devices against tampered or unsigned engine files.
+
+### What you need to know
+
+- Signature verification is enabled automatically on new installations and upgrades. No separate action is required.
+- If an engine file fails signature verification, Defender for Endpoint doesn't load it.
+- The `offlineDefinitionUpdateVerifySig` setting is deprecated and no longer has any effect. If your managed configuration uses this setting, no replacement action is required because engine signature verification is enabled by default.
+
+Run the following commands to view the signature verification state:
+
+```bash
+mdatp health --details definitions
+mdatp health --details features
+```
+
+The relevant fields appear in both command outputs:
+
+```console
+offline_definition_update_verify_sig : "DEPRECATED"
+engine_signature_verification : "enabled"
+```
+
+Values such as the definitions version, timestamps, and update source URI vary by device.
+
### Verify the configuration
To test if the settings are applied correctly on the Linux endpoints, run the following command:
@@ -247,7 +271,7 @@ To test if the settings are applied correctly on the Linux endpoints, run the fo
mdatp health --details definitions
```
-A sample output would look like the following code snippet:
+The following example output shows the fields that confirm definitions were updated successfully and the offline update configuration is applied:
```console
user@vm:~$ mdatp health --details definitions
@@ -260,7 +284,8 @@ definitions_update_source_uri : "https://go.microsoft.com/fwlink/?
definitions_update_fail_reason : ""
offline_definition_url_configured : "http://172.XX.XXX.XX:8000/linux/production/" [managed]
offline_definition_update : "enabled" [managed]
-offline_definition_update_verify_sig : "enabled"
+offline_definition_update_verify_sig : "DEPRECATED"
+engine_signature_verification : "enabled"
offline_definition_update_fallback_to_cloud : false[managed]
```
@@ -272,12 +297,12 @@ You can trigger offline security intelligence updates automatically or manually.
Automatic updates occur under the following conditions:
-- If the [enforcement level for the antivirus engine](linux-preferences.md#enforcement-level-for-microsoft-defender-antivirus) is set to `real_time`, and the fields `automaticDefinitionUpdateEnabled` and `offline_definition_update` in the managed json are set to `true`, then the offline security intelligence updates are triggered automatically at periodic intervals.
-- By default, this periodic interval is **8 hours**. But it can be configured by setting the `definitionUpdatesInterval` parameter in the managed json.
+- If the [enforcement level for the antivirus engine](linux-preferences.md#enforcement-level-for-microsoft-defender-antivirus) is set to `real_time`, and the fields `automaticDefinitionUpdateEnabled` and `offline_definition_update` in the `mdatp_managed.json` managed configuration file are set to `true`, then the offline security intelligence updates are triggered automatically at periodic intervals.
+- By default, this periodic interval is **8 hours**. But it can be configured by setting the `definitionUpdatesInterval` parameter in the `mdatp_managed.json` file.
### Manual update
-To trigger the offline security intelligence update manually to download the signatures from the mirror server on the Linux endpoints, run the following command:
+To trigger the offline security intelligence update manually to download the signatures from the mirror server on the Linux endpoints, run the following command to force an immediate definition update from the configured source:
```bash
mdatp definitions update
@@ -289,7 +314,7 @@ After triggering an update, use the following checks to confirm success:
1. Verify that the update was successful by running the command: `mdatp health --details --definitions`.
-1. Verify the following fields:
+1. Verify the following fields. The following sample output shows the definition health fields that indicate a successful update:
```console
user@vm:~$ mdatp health --details definitions
@@ -304,7 +329,7 @@ After triggering an update, use the following checks to confirm success:
If updates fail, are stuck, or don't start, follow these steps to troubleshoot:
-1. Check the status of offline security intelligence updates by using the following command:
+1. Check the status of offline security intelligence updates. Use the following command to review the current definition state and update source:
```bash
mdatp health --details definitions
@@ -312,20 +337,20 @@ If updates fail, are stuck, or don't start, follow these steps to troubleshoot:
Look for information in the `definitions_update_fail_reason` section.
-1. Make sure that `offline_definition_update` and `offline_definition_update_verify_sig` are enabled.
+1. Make sure that `offline_definition_update` and `engine_signature_verification` are enabled.
1. Make sure that `definitions_update_source_uri` is equal to `offline_definition_url_configured`.
- `definitions_update_source_uri` is the source from where the signatures were downloaded.
- `offline_definition_url_configured` is the source from where signatures should be downloaded, the one mentioned in the managed config file.
-1. Try performing the connectivity test to check if mirror server is reachable from the host:
+1. Run a connectivity test to confirm the endpoint can reach the mirror server and required Defender services:
```bash
mdatp connectivity test
```
-1. Try to initiate a manual update using the following command:
+1. If connectivity succeeds, manually retry the definition update with the following command:
```bash
mdatp definitions update
@@ -337,4 +362,3 @@ If updates fail, are stuck, or don't start, follow these steps to troubleshoot:
- [Linux resources](linux-resources.md)
- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
- [Configure security settings and policies for Microsoft Defender for Endpoint on Linux](linux-preferences.md)
-
diff --git a/defender-endpoint/linux-tamper-protection-audit-mode.md b/defender-endpoint/linux-tamper-protection-audit-mode.md
new file mode 100644
index 00000000000..aa83d674257
--- /dev/null
+++ b/defender-endpoint/linux-tamper-protection-audit-mode.md
@@ -0,0 +1,228 @@
+---
+title: Tamper protection in audit mode for Microsoft Defender for Endpoint on Linux (Preview)
+description: Learn how tamper protection in audit mode detects and alerts on tampering attempts against Microsoft Defender for Endpoint on Linux.
+ms.service: defender-endpoint
+ms.author: monaberdugo
+author: mberdugo
+ms.localizationpriority: medium
+ms.collection:
+- m365-security
+- tier3
+- mde-linux
+ms.topic: how-to
+ms.subservice: linux
+ms.date: 08/20/2026
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1014
+---
+
+# Tamper protection in audit mode for Microsoft Defender for Endpoint on Linux (Preview)
+
+[!INCLUDE [Prerelease information](../includes/prerelease.md)]
+
+Tamper protection in audit mode for Microsoft Defender for Endpoint on Linux detects unauthorized modifications to Defender for Endpoint assets, including configuration files, directories, processes, and services, even when changes are made by the root user.
+
+Audit mode detects and alerts on the following tampering activities:
+
+- Modification of Defender for Endpoint configuration files.
+- Deletion of Defender for Endpoint configuration files, state files, and binaries.
+- Renaming or moving Defender for Endpoint configuration files, state files, and binaries.
+- Termination of Defender for Endpoint processes, including restarting Defender for Endpoint services.
+
+Audit mode provides visibility into tampering attempts through alerts and Advanced Hunting in the Microsoft Defender portal without blocking the activity.
+
+## Prerequisites
+
+Before you use tamper protection in audit mode, make sure your device meets the following requirements:
+
+- Defender for Endpoint version `101.26072.0004` or later from the Insiders-Slow ring.
+- Allow access to `https://config.edge.skype.com/config/v1`. For more information, see [Microsoft Defender for Endpoint streamlined connectivity URLs - commercial](streamlined-device-connectivity-urls-commercial.md#urls-used-for-core-functionality).
+- Use a supported Linux distribution and kernel version.
+
+| Distribution | Supported version | Minimum kernel version |
+| --- | --- | --- |
+| Ubuntu LTS | 20.04 | 5.15.0* |
+| Ubuntu LTS | 22.04 | 5.15.0* |
+| Ubuntu LTS | 24.04 | 6.8.0 |
+| Ubuntu Pro | 22.04 | 5.15.0* |
+| Ubuntu Pro | 24.04 | 6.8.0 |
+| CentOS Stream | 8 | 4.18.0-553 |
+| CentOS Stream | 9 | 5.14.0 |
+| CentOS Stream | 10 | 6.12.0 |
+| RHEL 8 | 8.4+ | 4.18.0-305 |
+| RHEL 9 | 9.x | 5.14.0-70 |
+| RHEL 10 | 10.x | 6.12.0-55 |
+| SLES 15 | 15.5+ | 5.14.21-150500 |
+| SLES 16 | 16 | 6.12.0-160000 |
+| Debian | 12 | 6.1.0-9 |
+| Debian | 13 | 6.12 |
+| Oracle Linux 8 | 8.10 (UEK7) | 5.15.0 |
+| Oracle Linux 8 | 8.10 (RHCK) | 4.18.0-553 |
+| Oracle Linux 9 | 9.x (UEK7) | 5.15.0 |
+| Oracle Linux 9 | 9.x (UEK8) | 6.12.0 |
+| Oracle Linux 9 | 9.x (RHCK) | 5.14.0-70 |
+| Oracle Linux 10 | 10.x (UEK8) | 6.12.0 |
+| Oracle Linux 10 | 10.x (RHCK) | 6.12.0-55 |
+| Mariner 2 | 2 | 5.15 |
+| Fedora | x86_64: 33-43 | 5.8.15 |
+| Fedora | arm64: 40-43 | 6.8.5 |
+| Alma Linux 8 | 8.8+ | 4.18.0-477 |
+| Alma Linux 9 | 9.2+ | 5.14.0-284 |
+| Alma Linux 10 | 10.x | 6.12.0-55 |
+| Amazon Linux | 2023 | 6.1.132-147.221.amzn2023 |
+| Rocky Linux 8 | 8.9+ | 4.18.0-513 |
+| Rocky Linux 9 | 9.3+ | 5.14.0-362 |
+| Rocky Linux 10 | 10.x | 6.12.0-55 |
+| Azure Linux 3 | 3 | 6.6.78.1-3.azl3 |
+
+> [!IMPORTANT]
+> For Ubuntu 20.04 and Ubuntu 22.04, the following generic kernel versions aren't supported: `5.15.0-144`, `5.15.0-150`, `5.15.0-151`, and `5.15.0-152`.
+
+Tamper protection support is limited to kernel versions that support extended Berkeley Packet Filter (eBPF) with BPF Type Format (BTF). BTF provides enhanced event enrichment that enables Defender for Endpoint to capture the file and process context required to detect tampering attempts.
+
+## Enable tamper protection in audit mode
+
+During preview, tamper protection in audit mode is enabled by default. No manual configuration is required.
+
+The feature rolls out gradually over two weeks to eligible devices in the Insiders-Slow ring that meet the prerequisites.
+
+After audit mode is enabled, the `tamper_protection_enforcement_level` field is available in the `mdatp health` output.
+
+## Verify audit mode enablement
+
+To verify that tamper protection is enabled in audit mode:
+
+1. Run the following command:
+
+ ```bash
+ mdatp health
+ ```
+
+1. Locate `tamper_protection_enforcement_level` in the output.
+
+1. Verify that the value is set to `audit`:
+
+ ```text
+ tamper_protection_enforcement_level : "audit"
+ ```
+
+1. Alternatively, run the following command to check the tamper protection status:
+
+ ```bash
+ mdatp health --details tamper_protection
+ ```
+
+ ```bash
+ tamper_protection_enforcement_level : "audit"
+ tamper_protection_errors : []
+ ```
+
+ If `tamper_protection_errors` is empty, tamper protection is successfully enabled in audit mode.
+
+ If tamper protection can't be enabled, `tamper_protection_enforcement_level` is displayed as `disabled`.
+
+ The following errors can indicate why audit mode isn't enabled:
+
+ | Error | Description |
+ | --- | --- |
+ | `tamper_protection_unsupported_kernel_version` | The device kernel version doesn't support tamper protection. |
+ | `not_supported_in_the_current_configuration` | Tamper protection can't be enabled because a required internal configuration isn't available. |
+
+### Troubleshoot audit mode enablement
+
+If the device meets the prerequisites but `tamper_protection_enforcement_level` is set to `disabled`:
+
+1. Run the following command:
+
+ ```bash
+ mdatp health --details cloud
+ ```
+
+1. Locate `ecs_configuration_version` in the output.
+
+1. Check whether the value is `unavailable`:
+
+ ```text
+ ecs_configuration_version : unavailable
+ ```
+
+ If the value is `unavailable`, verify that `https://config.edge.skype.com/config/v1` is allowlisted. For more information, see [Microsoft Defender for Endpoint streamlined connectivity URLs - commercial](streamlined-device-connectivity-urls-commercial.md#urls-used-for-core-functionality).
+
+## View tampering alerts in the Microsoft Defender portal
+
+On the device page in the Microsoft Defender portal, tampering alerts are available in **Timeline** and **Incidents and alerts**.
+
+Open a tampering alert to review more information about the activity, including the process tree and alert timeline.
+
+## Query tampering attempts with Advanced Hunting
+
+You can use Advanced Hunting to investigate tampering events and alerts.
+
+### Query tampering events for a device
+
+To query tampering attempts for a specific device:
+
+1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com).
+
+1. Select **Hunting** > **Advanced hunting**.
+
+1. Find the ID of the device you want to investigate in the device inventory, or run the following command on the device:
+
+ ```bash
+ mdatp health --field edr_device_id
+ ```
+
+1. Run the following query, replacing `
Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should be used only as a final fallback source, and not the primary source. It's only to be used if updates can't be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](manage-outdated-endpoints-microsoft-defender-antivirus.md#set-the-number-of-days-before-protection-is-reported-as-out-of-date).|
+|Security intelligence updates and platform updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|[Make sure devices are updated to support SHA-2](https://support.microsoft.com/servicing/os/windows/2020/09/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence and platform updates are delivered through Windows Update. As of October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively.
Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). The security intelligence updates source should be used only as a final fallback source, and not the primary source. It's only to be used if updates can't be downloaded from Windows Server Update Service or Microsoft Update for [the configured number of days before protection is reported as out-of-date](manage-outdated-endpoints-microsoft-defender-antivirus.md#set-the-number-of-days-before-protection-is-reported-as-out-of-date).|
You can manage the order in which update sources are used with Group Policy, Microsoft Configuration Manager, PowerShell cmdlets, and WMI.
@@ -95,33 +98,54 @@ The procedures in this article first describe how to set the order, and then how
## Use Group Policy to manage the update location
-1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). Right-click the Group Policy Object you want to configure and then select **Edit**.
+Perform the following steps to configure the update location by using Group Policy:
+
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
-1. In the **Group Policy Management Editor**, go to **Computer configuration**.
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
-1. Select **Policies** then **Administrative templates**.
+1. Right-click the GPO, and then select **Edit**.
-1. Expand the tree to **Windows components** > **Windows Defender** > **Signature updates**.
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**.
> [!NOTE]
- > - For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Microsoft Defender Antivirus > Signature Updates**
- > - For Windows 10, version 1903, the policy path is **Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates**
+ > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Antivirus instead of _Microsoft_ Defender Antivirus. Group Policy paths before Windows 10, version 1909 (November 2019) might use _Signature Updates_ instead of _Security Intelligence Updates_. The older and newer names refer to the same policy locations.
+
+1. In the details pane of **Security Intelligence Updates**, the available settings are:
+ - [Define the order of sources for downloading security intelligence updates](#enable-and-configure-the-security-intelligence-update-source-order)
+ - [Define file shares for downloading security intelligence updates](#enable-and-configure-security-intelligence-update-file-shares)
+
+ To open and configure a security intelligence update source setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
+
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Security Intelligence Updates**.
+
+### Enable and configure the security intelligence update source order
+
+1. In the details pane of **Security Intelligence Updates**, open the **Define the order of sources for downloading security intelligence updates** setting.
-1. Edit the **Define the order of sources for downloading security intelligence updates** setting. Set the option to **Enabled**.
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Define the order of sources for downloading security intelligence updates** in the **Options** section: Enter the update sources in the order in which they should be contacted, separated by a single pipe (`|`). The available values are `InternalDefinitionUpdateServer`, `MicrosoftUpdateServer`, `MMPC`, and `FileShares`. For example, `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`.
-1. Specify the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot.
+ :::image type="content" source="/defender/media/wdav-order-update-sources.png" alt-text="Screenshot of the Group Policy setting that defines the order of security intelligence update sources." lightbox="/defender/media/wdav-order-update-sources.png":::
- :::image type="content" source="/defender/media/wdav-order-update-sources.png" alt-text="Group policy setting listing the order of sources" lightbox="/defender/media/wdav-order-update-sources.png":::
+ When you're finished, select **OK**.
-1. Select **OK**. This action sets the order of protection update sources.
+### Enable and configure security intelligence update file shares
-1. Edit the **Define file shares for downloading security intelligence updates** setting and then set the option to **Enabled**.
+1. In the details pane of **Security Intelligence Updates**, open the **Define file shares for downloading security intelligence updates** setting.
-1. On a Windows Server, specify the file share source. If you have multiple sources, specify each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path. For example: `\\WindowsFileServer\share-name\object-name|\\host-name2\share-name\object-name`.
+1. In the setting window that opens, configure the following options:
+ 1. Select **Enabled**.
+ 1. **Define file shares for downloading security intelligence updates** in the **Options** section: Enter the file share sources in the order in which they should be contacted, separated by a single pipe (`|`). Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for each path. For example, `\\WindowsFileServer\share-name\object-name|\\host-name2\share-name\object-name`.
- If you don't enter any paths, then this source is skipped when the VM downloads updates.
+ If you don't enter any paths, the file share source is skipped when the VM downloads updates.
-1. Select **OK**. This action sets the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting.
+ When you're finished, select **OK**.
@@ -175,7 +199,7 @@ For example, suppose that Contoso has hired Fabrikam to manage their security so
## Create a UNC share for security intelligence
-On a Windows File Server set up a network file share (UNC/mapped drive) to download security intelligence from the Microsoft Malware Protection Center (MMPC) site by using a scheduled task.
+On a Windows File Server, set up a UNC (Universal Naming Convention) network file share (also known as a mapped drive) to download security intelligence from the Microsoft Malware Protection Center (MMPC) site by using a scheduled task.
1. On the system for which you want to provision the share and download the updates, create a folder for the script.
@@ -285,7 +309,7 @@ On a Windows File Server set up a network file share (UNC/mapped drive) to downl
## Enable platform updates using UNC share
-To enable platform updates using UNC share, download KB4052623 and copy it into the architecture folders as `updateplatform.exe`. These files are updated monthly and need to get manually updated by you.
+To enable platform updates using UNC share, download KB4052623 and copy it into the architecture folders as `updateplatform.exe`. The `updateplatform.exe` files are updated monthly and must be manually replaced each month.
KB4052623 is available for the following architectures:
diff --git a/defender-endpoint/manage-security-policies.md b/defender-endpoint/manage-security-policies.md
deleted file mode 100644
index 9a9e76c8128..00000000000
--- a/defender-endpoint/manage-security-policies.md
+++ /dev/null
@@ -1,108 +0,0 @@
----
-title: Manage endpoint security policies in Microsoft Defender for Endpoint
-description: Learn how to set windows, mac, and linux endpoint security policies such as antivirus, firewall, endpoint detection and response in Microsoft Defender for Endpoint.
-ms.service: defender-endpoint
-ms.author: lwainstein
-author: limwainstein
-ms.localizationpriority: medium
-ms.collection:
-- m365-security
-- tier2
-ms.topic: how-to
-ms.date: 06/16/2026
-appliesto:
- - Microsoft Defender for Endpoint Plan 1
- - Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
-
-ai-usage: ai-assisted
----
-# Manage endpoint security policies in Microsoft Defender for Endpoint
-
-[!Include[Prerelease information](../includes/prerelease.md)]
-
-
-
-Use security policies to manage security settings on devices. As a Security Administrator, you can configure security policy settings in the Microsoft Defender portal.
-
-> [!IMPORTANT]
-> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
-
-You'll find endpoint security policies under **Endpoints** > **Configuration management** > **Endpoint security policies**.
-
-> [!NOTE]
-> The **Endpoint Security Policies** page in the [Microsoft Defender portal](https://security.microsoft.com) is available only for users who have access to all devices and possess `Core security settings (manage)` permissions. Any user role without these permissions, such as `Security Reader`, cannot access the portal. When a user has the required permissions to view policies in the Microsoft Defender portal, the data is presented based on Intune permissions. If the user is in scope for Intune role-based access control, it applies to the list of policies presented in the Microsoft Defender portal. We recommend granting security administrators with the [Intune built-in role, "Endpoint Security Manager"](/intune/intune-service/fundamentals/role-based-access-control#built-in-roles) to effectively align the level of permissions between Intune and the Microsoft Defender portal.
-
-:::image type="content" source="./media/endpoint-security-policies.png" alt-text="Managing Endpoint security policies in the Microsoft Defender portal":::
-
-The following list provides a brief description of each endpoint security policy type:
-
-- **Antivirus** - Antivirus policies help security admins focus on managing the discrete group of antivirus settings for managed devices.
-
-- **Disk encryption** - Endpoint security disk encryption profiles focus on only the settings that are relevant for a devices built-in encryption method, like FileVault or BitLocker. This focus makes it easy for security admins to manage disk encryption settings without having to navigate a host of unrelated settings.
-
-- **Firewall** - Use the endpoint security Firewall policy in Intune to configure a devices built-in firewall for devices that run macOS and Windows 10/11.
-
-- **Endpoint detection and response** - When you integrate Microsoft Defender for Endpoint with Intune, use the endpoint security policies for endpoint detection and response (EDR) to manage the EDR settings and onboard devices to Microsoft Defender for Endpoint.
-
-- **Attack surface reduction** - When Microsoft Defender Antivirus is in use on your Windows 10/11 devices, use Intune endpoint security policies for attack surface reduction to manage those settings for your devices.
-
-
-## Create an endpoint security policy
-
-To create an endpoint security policy, perform the following steps:
-
-1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com) using at least a Security Administrator role.
-
-1. Select **Endpoints > Configuration management > Endpoint security policies** and then select **Create new Policy**.
-
-1. Select a platform from the dropdown list.
-
-1. Select a template, then select **Create policy**.
-
-
-1. On the **Basics** page, enter a name and description for the profile, then choose **Next**.
-
-1. On the **Settings** page, expand each group of settings, and configure the settings you want to manage with this profile.
-
- When you're done configuring settings, select **Next**.
-
-1. On the **Assignments** page, select the groups that will receive this profile.
-
- Select **Next**.
-
-1. On the **Review + create** page, when you're done, select **Save**. The new profile is displayed in the list when you select the policy type for the profile you created.
-
-> [!NOTE]
-> To edit the scope tags, you'll need to go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
-
-
-## Edit an endpoint security policy
-
-1. Select the new policy, and then select **Edit**.
-
-1. Select **Settings** to expand a list of the configuration settings in the policy. You can't modify the settings from this view, but you can review how they're configured.
-
-1. To modify the policy, select **Edit** for each category where you want to make a change:
- - Basics
- - Settings
- - Assignments
-
-1. After you've made changes, select **Save** to save your edits. Edits to one category must be saved before you can introduce edits to additional categories.
-
-## Verify endpoint security policies
-
-To verify that you have successfully created a policy, select a policy name from the list of endpoint security policies.
-
-> [!NOTE]
-> It can take up to 90 minutes for a policy to reach a device. To expedite the process, for devices Managed by Defender for Endpoint, you can select **Policy sync** from the actions menu so that it is applied in approximately 10 minutes.
-> :::image type="content" source="./media/policy-sync.png" alt-text="Image showing policy sync button":::
-
-The policy page displays details that summarize the status of the policy. You can view a policy's status, which devices it has been applied to, and assigned groups.
-
-During an investigation, you can also view the **Security policies** tab in the device page to view the list of policies that are being applied to a particular device. For more information, see [Investigating devices](investigate-machines.md).
-
-:::image type="content" source="./media/security-policies-list.png" alt-text="Security policies tab with list of policies":::
-
-
-
diff --git a/defender-endpoint/manage-suppression-rules.md b/defender-endpoint/manage-suppression-rules.md
index 2578d732d47..e28a7a84eae 100644
--- a/defender-endpoint/manage-suppression-rules.md
+++ b/defender-endpoint/manage-suppression-rules.md
@@ -10,11 +10,11 @@ ms.collection:
- tier2
ms.topic: how-to
ms.subservice: edr
-ms.date: 06/16/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -40,6 +40,8 @@ You can view a list of all the suppression rules and manage them in one place. Y
## View details of a suppression rule
+To view the details of a suppression rule, perform the following steps:
+
1. In the navigation pane, select **Settings** \> **Endpoints** \> **Rules** \> **Alert suppression**. The list of suppression rules that users in your organization have created is displayed.
1. Select a rule name. Details of the rule is displayed. You'll see the rule details such as status, scope, action, number of matching alerts, created by, and date when the rule was created. You can also view associated alerts and the rule conditions.
diff --git a/defender-endpoint/manage-sys-extensions-manual-deployment.md b/defender-endpoint/manage-sys-extensions-manual-deployment.md
index 56350c371a0..be0fa3648bd 100644
--- a/defender-endpoint/manage-sys-extensions-manual-deployment.md
+++ b/defender-endpoint/manage-sys-extensions-manual-deployment.md
@@ -10,8 +10,8 @@ ms.collection:
- tier3
ms.topic: how-to
ms.subservice: onboard
-ms.date: 06/17/2026
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.date: 07/02/2026
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -49,7 +49,7 @@ You might see the prompt that's shown in the following screenshot:
:::image type="content" source="media/virus-and-threat-protection-screen.png" alt-text="The Virus & threat protection screen containing the Fix button." lightbox="media/virus-and-threat-protection-screen.png":::
-1. Select **Fix** on the top-right corner of this screen. You get a prompt, as shown in the following screenshot:
+1. Select **Fix** in the upper-right corner of the **Virus & threat protection** screen. You get a prompt, as shown in the following screenshot:
:::image type="content" source="media/prompt-on-virus-and-threat-protection-screen.png" alt-text="The prompt dialog box on the Virus & threat protection screen." lightbox="media/prompt-on-virus-and-threat-protection-screen.png":::
@@ -102,11 +102,11 @@ Perform the following steps to grant Accessibility access to Microsoft Defender:
:::image type="content" source="media/accessibility-and-plus-icon.png" alt-text="The Accessibility menu item and the Plus icon." lightbox="media/accessibility-and-plus-icon.png":::
-1. From the resultant screen, select **Applications** from the **Favorites** pane in the left-side of the screen; select **Microsoft Defender**; and then select **Open** at the bottom-right of the screen.
+1. In the file selection dialog, select **Applications** from the **Favorites** pane in the left-side of the screen; select **Microsoft Defender**; and then select **Open** at the bottom-right of the screen.
:::image type="content" source="media/applications-md-options.png" alt-text="The process of selecting Applications and Microsoft Defender." lightbox="media/applications-md-options.png":::
-1. From the resultant screen, check the **Microsoft Defender** checkbox.
+1. In the **Accessibility** list, check the **Microsoft Defender** checkbox.
:::image type="content" source="media/checking-md-checkbox.png" alt-text="Checking the Microsoft Defender checkbox." lightbox="media/checking-md-checkbox.png":::
@@ -144,7 +144,8 @@ Use the following steps to enable notifications for Microsoft Defender:
### Verify a healthy system state
-#### Mdatp health output
+
+#### Review mdatp health output
After completing the manual deployment steps, run `mdatp health` in Terminal to confirm that Microsoft Defender for Endpoint is running correctly. The following screenshot shows an example of healthy output. In a healthy system, real-time protection is enabled, definitions are up to date, and the system extensions are active.
diff --git a/defender-endpoint/manage-sys-extensions-using-jamf.md b/defender-endpoint/manage-sys-extensions-using-jamf.md
index b35033050fd..f6090472896 100644
--- a/defender-endpoint/manage-sys-extensions-using-jamf.md
+++ b/defender-endpoint/manage-sys-extensions-using-jamf.md
@@ -1,6 +1,6 @@
---
title: Manage system extensions using Jamf
-description: Manage system extensions using Jamf for Microsoft Defender for Endpoint to work properly on macOS.
+description: Configure Jamf policies to approve system extensions, grant Full Disk Access, and enable network extensions for Microsoft Defender for Endpoint on macOS.
ms.service: defender-endpoint
ms.author: painbar
author: paulinbar
@@ -12,16 +12,17 @@ ms.collection:
- mde-macos
ms.topic: how-to
ms.subservice: macos
-ms.date: 06/17/2026
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.date: 07/02/2026
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
# Manage system extensions using Jamf
-This article describes the procedures to implement in the process of managing the system extensions to ensure Microsoft Defender for Endpoint works properly on macOS.
+This article describes how to use Jamf to approve system extensions, grant Full Disk Access through Privacy Preferences Policy Control, and configure the network extension policy for Microsoft Defender for Endpoint on macOS. Complete the prerequisites for deploying Microsoft Defender for Endpoint before you follow these procedures.
-## Jamf
+
+## Configure system extensions in Jamf
### Configure the Jamf system extensions policy
@@ -44,13 +45,17 @@ To approve the system extensions, perform the following steps:
### Configure Privacy Preferences Policy Control for Full Disk Access
-Add the following Jamf payload to grant Full Disk Access to the Microsoft Defender for Endpoint Security Extension. This policy is a prerequisite for running the extension on your device.
+Add the following Jamf payload to grant Full Disk Access to the Microsoft Defender for Endpoint Security Extension. The Privacy Preferences Policy Control payload is a prerequisite for running the extension on your device.
1. Select **Options > Privacy Preferences Policy Control**.
1. Use **com.microsoft.wdav.epsext** as the Identifier and **Bundle ID** as Bundle type.
-1. Set Code Requirement to **identifier com.microsoft.wdav.epsext and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9**.
+1. Set Code Requirement to the following value:
+
+ ```text
+ identifier com.microsoft.wdav.epsext and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
+ ```
1. Set **App or service** to **SystemPolicyAllFiles** and access to **Allow**.
@@ -59,14 +64,14 @@ Add the following Jamf payload to grant Full Disk Access to the Microsoft Defend
### Configure the Network Extension policy in Jamf
-As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint on macOS inspects socket traffic and reports this information to the Microsoft Defender portal. The following policy allows the network extension to perform this functionality:
+As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint on macOS inspects socket traffic and reports this information to the Microsoft Defender portal. The following policy allows the network extension to inspect socket traffic and report this information to the Microsoft Defender portal:
> [!NOTE]
> Jamf doesn't have built-in support for content filtering policies, which are a prerequisite for enabling the network extensions that Microsoft Defender for Endpoint on macOS installs on the device. Furthermore, Jamf sometimes changes the content of the policies being deployed. Because of these limitations, the following steps provide a workaround that involves signing the configuration profile.
1. Save the following content to your device as **com.microsoft.network-extension.mobileconfig** using a text editor:
-```powershell
+```xml
2. Select **Create New Policy**.
3. For **Platform**, select **Windows 10, Windows 11, and Windows Server**.
4. Select a template and define your exclusions. Both **Microsoft Defender Antivirus exclusions** and **Microsoft Defender Antivirus** support custom antivirus exclusions.|
-|Global exclusions for all attack surface reduction (ASR) rules only|1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Endpoints** > **Configuration Management** > **Endpoint security policies** > **Windows policies**.
2. Select **Create New Policy**
3. For **Platform**, select **Windows 10, Windows 11, and Windows Server**.
4. Select the **Attack Surface Reduction Rules** template.
5. Scroll down to **Attack Surface Reduction Only Exclusions** and define your exclusions.|
-|Per-ASR rule exclusions|1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Endpoints** > **Configuration Management** > **Endpoint security policies** > **Windows policies**.
2. Select **Create New Policy**
3. For **Platform**, select **Windows 10, Windows 11, and Windows Server**.
4. Select the **Attack Surface Reduction Rules** template.
5. Scroll down to the rule to create an exclusion.
6. Change it from **Not configured** to `Block`,`Audit`, or `Warn`.
7. Select **Add** to specify the path to be excluded.|
-|Controlled folder access exclusion|1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Endpoints** > **Configuration Management** > **Endpoint security policies** > **Windows policies**.
2. Select **Create New Policy**
3. For **Platform**, select **Windows 10, Windows 11, and Windows Server**.
4. Select the **Attack Surface Reduction Rules** template.
5. Scroll down to **Controlled Folder Access Allowed Applications** and define your exclusions.|
-|Automation folder exclusions|1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Rules** > **Automation folder exclusions**
2. Select **New Folder Exclusion** and define your exclusions.|
-|Automatic antivirus exclusions|Not supported in the [Microsoft Defender portal](https://security.microsoft.com).|
-
-> [!NOTE]
-> You can't configure **IP Address Exclusions** in the Microsoft Defender portal.
-
-**Learn More**:
-
-- Use Microsoft Defender for Endpoint Security Settings Management to manage Microsoft Defender Antivirus
-- [Add automatic folder exclusions](manage-automation-folder-exclusions.md#add-an-automation-folder-exclusion)
-
-
-### Manage exclusions with Intune
-
-Many exclusions can be managed in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
-
-|Exclusion Type|Instructions|
-|---|---|
-|Custom antivirus exclusions|1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Home** > **Endpoint security** > **Antivirus**.
2. Select **Create Policy**.
3. For **Platform**, select **Windows**.
4. Select a template. Both **Microsoft Defender Antivirus exclusions** and **Microsoft Defender Antivirus** support custom antivirus exclusions|
-|Global exclusions for all attack surface reduction (ASR) rules only|For complete instructions, see [Configure ASR rules and exclusions in Intune using endpoint security policies](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies).|
-|Per-ASR rule exclusions|For complete instructions, see [Configure ASR rules and exclusions in Intune using endpoint security policies](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies).|
-|Controlled folder access exclusion|You configure controlled folder access exclusions (**Controlled Folder Access Allowed Applications**) in the same policies where you configure ASR rules (**Attack surface reduction** endpoint security policies). For complete instructions, see [Configure ASR rules and exclusions in Intune using endpoint security policies](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies).|
-|Automation folder exclusions|Not supported|
-|Automatic antivirus exclusions|Not supported in the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).|
-
-**Learn More**:
-
-- [Create Microsoft Defender antivirus exclusion policies in Intune](configure-exclusions-microsoft-defender-antivirus.md#create-microsoft-defender-antivirus-exclusion-policies-in-intune)
-
-
-### Manage exclusions with MDM CSP
-
-The following table lists the Defender Policy CSP OMA-URI settings for supported exclusion types.
-
-|Exclusion type|OMA-URI|
-|--|--|
-|Custom antivirus exclusion:
[ExcludedProcesses](/windows/client-management/mdm/policy-csp-defender#excludedprocesses)|`./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedProcesses`|
-|Custom antivirus exclusion:
[ExcludedPaths](/windows/client-management/mdm/policy-csp-defender#excludedpaths)|`./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedPaths`|
-|Custom antivirus exclusion:
[ExcludedExtensions](/windows/client-management/mdm/policy-csp-defender#excludedextensions)|`./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedExtensions`|
-|Attack surface reduction only exclusions:
[AttackSurfaceReductionOnlyExclusions](/windows/client-management/mdm/policy-csp-defender#attacksurfacereductiononlyexclusions)|`./Device/Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions`|
-|Controlled folder access exclusion:
[ControlledFolderAccessAllowedApplications](/windows/client-management/mdm/policy-csp-defender#controlledfolderaccessallowedapplications)|`./Device/Vendor/MSFT/Policy/Config/Defender/ControlledFolderAccessAllowedApplications`|
-
-**Learn more**:
-
-- [Defender CSP](/windows/client-management/mdm/defender-csp)
-- [Defender Policy CSP](/windows/client-management/mdm/policy-csp-defender)
-- [Use custom settings for Windows client devices in Intune](/intune/intune-service/configuration/custom-settings-windows-10)
-
-
-### Manage exclusions with PowerShell
-
-Use `Set-MpPreference` or `Get-MpPreference` in the [Defender PowerShell Module](/powershell/module/defender/?view=windowsserver2022-ps&preserve-view=true).
-
-|Exclusion type|Flag|Description|
-|---|---|---|
-|Custom antivirus exclusion|`ExclusionIpAddress`|[IP addresses to exclude from scheduled and real-time scanning](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-exclusionipaddress)|
-|Custom antivirus exclusion|`ExclusionPath`|[File paths to exclude from scheduled and real-time scanning](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-exclusionpath)|
-|Custom antivirus exclusion|`ExclusionProcess`|[Files opened by these processes are excluded from scheduled and real-time scanning](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-exclusionprocess)|
-|Custom antivirus exclusion|`ExclusionExtension`|[File name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-exclusionextension)|
-|Attack surface reduction only exclusion|`AttackSurfaceReductionOnlyExclusions`|[Specifies the files and paths to exclude](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-attacksurfacereductiononlyexclusions)|
-|Attack surface reduction per-rule exclusion|N/A|Not supported|
-|Controlled Folder Access exception|`ControlledFolderAccessAllowedApplications`|[Specifies applications that can make changes in controlled folders](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-controlledfolderaccessallowedapplications)|
-|Automation folder exclusions|N/A|Not supported|
-|Automatic antivirus exclusions
(*Only available on Windows Server 2016 and later*)|`DisableAutoExclusions`|[Disable automatic antivirus exclusions](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true#-disableautoexclusions)|
-
-
-### Manage exclusions with Group Policy Object (GPO)
-
-The following table lists the Group Policy locations for supported exclusion settings.
-
-|Exclusion Type|Setting location|Reference|
-|---|---|---|
-|Custom antivirus exclusion - Path|**Windows components** > **Microsoft Defender Antivirus** > **Exclusions** > **Path Exclusions**|See [Use Group Policy to configure folder or file extension exclusions](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-group-policy-to-configure-folder-or-file-extension-exclusions)|
-|Custom antivirus exclusions - Process|**Windows components** > **Microsoft Defender Antivirus** > **Exclusions** > **Process Exclusions**|See [Use Group Policy to exclude files that have been opened by specified processes from scans](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md#use-group-policy-to-exclude-files-that-have-been-opened-by-specified-processes-from-scans)|
-|Attack Surface Reduction only exclusions|**Windows components** > **Microsoft Defender Antivirus** > **Microsoft Defender Exploit Guard** > **Attack Surface Reduction** > **Exclude files and paths from Attack Surface Reduction rules**|See [Group Policy](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-group-policy)|
-|Attack surface reduction rule per rule exclusion|**Windows components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack surface reduction > Apply a list of exclusions to specific Attack Surface Reduction (ASR) rules**|See [Group Policy](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-group-policy)|
-|Automatic antivirus exclusions|**Windows components** > **Microsoft Defender Antivirus** > **Exclusions** > **Enabled**|See [Use Group Policy to disable the auto-exclusions list on Windows Server 2016, Windows Server 2019, and later](configure-server-exclusions-microsoft-defender-antivirus.md#use-group-policy-to-disable-the-auto-exclusions-list-on-windows-server-2016-windows-server-2019-and-later)|
-|Automation folder exclusions|Not supported||
-|Controlled Folder Access exclusions|**Windows components** > **Microsoft Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Configure allowed applications**|See [Use group policy to allow specific apps](customize-controlled-folders.md#use-group-policy-to-allow-specific-apps)|
-
-
-### Manage exclusions with Windows Management Instrumentation (WMI)
-
-The following table lists the WMI properties used for supported exclusion types.
-
-|Exclusion Type|Property|
-|---|---|
-|Custom antivirus exclusion - Path|`ExclusionPath`|
-|Custom antivirus exclusion - Extension|`ExclusionExtension`|
-|Custom antivirus exclusion - Process|`ExclusionProcess`|
-|Attack Surface Reduction only exclusions|Not supported|
-|Attack surface reduction rule per rule exclusion|Not supported|
-|Automatic antivirus exclusions|`DisableAutoExclusions`|
-|Controlled Folder Access exclusions|Not supported|
-|Automation folder exclusions|Not supported|
-
-**Learn more**:
-
-- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)
-
-
-### Manage exclusions with Configuration Manager
-
-The following table links to Configuration Manager guidance for supported exclusion types.
-
-|Exclusion Type|Reference|
-|---|---|
-|Custom antivirus exclusion|For more information, see [exclusion settings](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings)|
-|Global exclusions for attack surface reduction (ASR) rules only|For more information, see [Configure ASR rules and global ASR rule exclusions in Microsoft Configuration Manager](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-global-asr-rule-exclusions-in-microsoft-configuration-manager)|
-|Per-ASR rule exclusion|Not supported|
-|Controlled Folder Access exclusions|For more information, see [Microsoft Configuration Manager](enable-controlled-folders.md#microsoft-configuration-manager)|
-|Automation folder exclusions|Not supported|
-
-## Manage exclusions for Linux
-
-You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux.
-
-See [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md).
-
-## Manage exclusions for macOS
-
-You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Mac scans.
-
-See [Configure and validate exclusions for Microsoft Defender for Endpoint on macOS](mac-exclusions.md).
-
-## See also
-
-- [Add exclusions to network protection](troubleshoot-np.md#add-exclusions)
-- [Important points about exclusions](configure-exclusions-microsoft-defender-antivirus.md#important-points-about-exclusions)
-- [Isolation exclusions](isolation-exclusions.md)
diff --git a/defender-endpoint/mde-demonstration-amsi.md b/defender-endpoint/mde-demonstration-amsi.md
index 098a54e4797..e734e4c91a9 100644
--- a/defender-endpoint/mde-demonstration-amsi.md
+++ b/defender-endpoint/mde-demonstration-amsi.md
@@ -10,9 +10,9 @@ ms.subservice: ngp
ms.collection:
- m365-security
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 07/03/2026
ms.custom:
-- msecd-doc-authoring-1014
+- msecd-doc-authoring-1016
- partner-contribution
appliesto:
- Microsoft Defender for Endpoint Plan 1
@@ -28,6 +28,8 @@ Microsoft Defender for Endpoint uses the [Antimalware Scan Interface (AMSI)](ams
## Prerequisites
+Before you begin, make sure the following prerequisites are met:
+
- Microsoft Defender Antivirus (as primary) must be enabled, along with the following capabilities:
- Real-Time Protection (RTP)
- Behavior Monitoring (BM)
@@ -42,7 +44,7 @@ The following operating systems support this AMSI test scenario:
## Testing AMSI with Defender for Endpoint
-In this demonstration article, you can choose from three engines to test AMSI:
+In this article, you can choose from three engines to test AMSI:
- PowerShell
- VBScript
@@ -57,7 +59,7 @@ Perform the following steps to test AMSI by using PowerShell:
```powershell
$testString = "AMSI Test Sample: " + "7e72c3ce-861b-4339-8740-0ac1484c1386"
Invoke-Expression $testString
- ```powershell
+ ```
1. On your device, open PowerShell as an administrator.
@@ -144,7 +146,7 @@ The expected JavaScript output is as follows:
### Verifying the test results
-In your protection history, you should see the following information:
+In your protection history, the following sample output confirms that AMSI detected and blocked the test payload:
```text
diff --git a/defender-endpoint/mde-linux-deployment-on-sap.md b/defender-endpoint/mde-linux-deployment-on-sap.md
index 3587a32b85f..399479314ea 100644
--- a/defender-endpoint/mde-linux-deployment-on-sap.md
+++ b/defender-endpoint/mde-linux-deployment-on-sap.md
@@ -1,33 +1,35 @@
---
-title: Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP
-description: Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP
+title: Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP
+description: Deploy Microsoft Defender for Endpoint on Linux for SAP with recommended OSS notes, prerequisites, configuration settings, and antivirus exclusions.
ms.service: defender-endpoint
ms.author: painbar
author: paulinbar
-ms.reviewer: cgardin
+ms.reviewer: cgardin
ms.localizationpriority: medium
-ms.collection:
+ms.collection:
- m365-security
- tier3
- mde-linux
ms.topic: install-set-up-deploy
ms.subservice: linux
-ms.date: 03/28/2025
-ms.custom:
+ms.date: 07/20/2026
+ms.custom:
- partner-contribution
+- msecd-doc-authoring-1015
+ai-usage: ai-assisted
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-
+#customer intent: As an SAP or security administrator, I want to deploy Microsoft Defender for Endpoint on Linux for SAP so that I can protect SAP systems without impacting performance.
---
-# Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP
+# Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP
-This article provides deployment guidance for Microsoft Defender for Endpoint on Linux for SAP. This article includes recommended SAP OSS (Online Services System) notes, the system requirements, prerequisites, important configuration settings, recommended antivirus exclusions, and guidance on scheduling antivirus scans.
+This deployment guidance for Microsoft Defender for Endpoint on Linux for SAP includes recommended SAP OSS (Online Services System) notes, the system requirements, prerequisites, important configuration settings, recommended antivirus exclusions, and guidance on scheduling antivirus scans.
-Conventional security defenses that have been commonly used to protect SAP systems, such as isolating infrastructure behind firewalls and limiting interactive operating system logons, are no longer considered sufficient to mitigate modern sophisticated threats. It's essential to deploy modern defenses to detect and contain threats in real-time. SAP applications unlike most other workloads require basic assessment and validation before deploying Microsoft Defender for Endpoint. The enterprise security administrators should contact the SAP Basis team before deploying Defender for Endpoint. The SAP Basis Team should be cross trained with a basic level of knowledge about Defender for Endpoint.
+Conventional security defenses that have been commonly used to protect SAP systems, such as isolating infrastructure behind firewalls and limiting interactive operating system logons, are no longer considered sufficient to mitigate modern sophisticated threats. It's essential to deploy modern defenses to detect and contain threats in real time. SAP applications, unlike most other workloads, require basic assessment and validation before you deploy Microsoft Defender for Endpoint. The enterprise security administrators should contact the SAP Basis team before deploying Defender for Endpoint. The SAP Basis Team should be cross-trained with a basic level of knowledge about Defender for Endpoint.
-## Recommended SAP OSS Notes
+## Recommended SAP OSS notes
- [2248916 - Which files and directories should be excluded from an antivirus scan for SAP BusinessObjects Business Intelligence Platform products in Linux/Unix? - SAP ONE Support Launchpad](https://launchpad.support.sap.com/#/notes/2248916)
- [1984459 - Which files and directories should be excluded from an antivirus scan for SAP Data Services - SAP ONE Support Launchpad](https://launchpad.support.sap.com/#/notes/1984459)
@@ -35,158 +37,145 @@ Conventional security defenses that have been commonly used to protect SAP syste
- [1730930 - Using antivirus software in an SAP HANA appliance - SAP ONE Support Launchpad](https://launchpad.support.sap.com/#/notes/1730930)
- [1730997 - Unrecommended versions of antivirus software - SAP ONE Support Launchpad](https://launchpad.support.sap.com/#/notes/1730997)
-## SAP Applications on Linux
+## SAP applications on Linux
> [!IMPORTANT]
> When you deploy Defender for Endpoint on Linux, eBPF is advised. For more information, see [eBPF Documentation](https://ebpf.io/what-is-ebpf/). Defender for Endpoint has been enhanced to use the eBPF framework.
->
-> The supported distributions include all common Linux distributions but not SUSE 12.x. SUSE 12.x customers are advised to upgrade to SUSE 15. SUSE 12.x uses an old `Audit.D` based sensor that has performance limitations.
->
+>
+> The supported distributions include all common Linux distributions but not SUSE 12.x. SUSE 12.x customers are advised to upgrade to SUSE 15. SUSE 12.x uses an old `auditd` based sensor that has performance limitations.
+>
> For more information about support distributions, see [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](linux-support-ebpf.md).
->
-Here are some important point about SAP applications on Linux Server:
+Here are some important points about SAP applications on Linux Server:
-- SAP only supports SUSE, Redhat, and Oracle Linux. Other distributions aren't supported for SAP S4 or NetWeaver applications.
-- SUSE 15.x, Redhat 9.x and Oracle Linux 9.x are recommended. The supported distributions include all common Linux distributions but not SUSE 12.x.
-- SUSE 11.x, Redhat 6.x and Oracle Linux 6.x aren't supported.
-- Redhat 7.x and 8.x, and Oracle Linux 7.x and 8.x are technically supported, but are no longer tested in combination with SAP software.
-- SUSE and Redhat offer tailored distributions for SAP. These "for SAP" versions of SUSE and Redhat might have different packages preinstalled and possibly different kernels.
+- SAP only supports SUSE, Red Hat, and Oracle Linux. Other distributions aren't supported for SAP S4 or NetWeaver applications.
+- SUSE 15.x, Red Hat 9.x, and Oracle Linux 9.x are recommended. The supported distributions include all common Linux distributions but not SUSE 12.x.
+- SUSE 11.x, Red Hat 6.x, and Oracle Linux 6.x aren't supported.
+- Red Hat 7.x and 8.x, and Oracle Linux 7.x and 8.x are technically supported, but are no longer tested in combination with SAP software.
+- SUSE and Red Hat offer tailored distributions for SAP. These "for SAP" versions of SUSE and Red Hat might have different packages preinstalled and possibly different kernels.
- SAP only supports certain Linux File systems. In general, XFS and EXT3 are used. Oracle Automatic Storage Management (ASM) filesystem is sometimes used for Oracle DBMS and can't be read by Defender for Endpoint.
- Some SAP applications use standalone engines, such as TREX, Adobe Document Server, Content Server, and LiveCache. These engines require specific configuration and file exclusions.
-- SAP applications often have Transport and Interface directories with many thousands of small files. If the number of files is larger than 100,000, it might and affect performance. It's recommended to archive files.
+- SAP applications often have Transport and Interface directories with many thousands of small files. If the number of files is larger than 100,000, it might affect performance. It's recommended to archive files.
- It's recommended to deploy Defender for Endpoint to nonproductive SAP landscapes for several weeks before deploying to production. The SAP Basis Team should use tools, such as `sysstat`, `KSAR`, and `nmon` to verify if CPU and other performance parameters are impacted. It's also possible to configure broad exclusions with the global scope parameter and then incrementally reduce the number of directories that are excluded.
## Prerequisites for deploying Microsoft Defender for Endpoint on Linux on SAP VMs
-- Microsoft Defender for Endpoint [Build: 101.24082.0004 | Release version: 30.124082.0004.0](linux-whatsnew.md#oct-2024-build-101240820004--release-version-3012408200040) or later must be deployed.
+- Microsoft Defender for Endpoint [Build: 101.24082.0004 | Release version: 30.124082.0004.0](release-notes-mde-archive.md#oct-2024-build-101240820004--release-version-3012408200040) or later must be deployed.
- Microsoft Defender for Endpoint on Linux supports [Linux releases](mde-linux-prerequisites.md) used by SAP applications.
-- Microsoft Defender for Endpoint on Linux requires connectivity to specific Internet endpoints from VMs to update antivirus definitions. For more information, see [Verify that devices can connect to Defender for Endpoint cloud services](mde-linux-prerequisites.md#verify-if-devices-can-connect-to-defender-for-endpoint-cloud-services).
+- Microsoft Defender for Endpoint on Linux requires connectivity to specific internet endpoints from VMs to update antivirus definitions. For more information, see [Verify that devices can connect to Defender for Endpoint cloud services](mde-linux-prerequisites.md#verify-if-devices-can-connect-to-defender-for-endpoint-cloud-services).
- Microsoft Defender for Endpoint on Linux requires some `crontab` (or other task scheduler) entries to schedule scans, log rotation, and Microsoft Defender for Endpoint updates. Enterprise security teams normally manage these entries. For more information, see [How to schedule an update for Microsoft Defender for Endpoint on Linux](linux-update-mde-linux.md).
-As of December 2024, Defender for Endpoint on Linux can safely be configured with real-time protection enabled.
+As of December 2024, Defender for Endpoint on Linux can safely be configured with real-time protection enabled.
-The default configuration option for deployment as an Azure Extension for Antivirus is *passive mode*. This means that Microsoft Defender Antivirus, the antivirus/anti-malware component of Microsoft Defender for Endpoint, doesn't intercept IO calls. We recommend running Defender for Endpoint in with real-time protection enabled on all SAP applications. As such:
+The default configuration option for deployment as an Azure Extension for Antivirus is _passive mode_. This means that Microsoft Defender Antivirus, the antivirus/antimalware component of Microsoft Defender for Endpoint, doesn't intercept IO calls. We recommend running Defender for Endpoint with real-time protection enabled on all SAP applications. As such:
- **Real-time protection is turned on**: Microsoft Defender Antivirus intercepts IO calls in real time.
- **On-demand scanning is turned on**: You can use scan capabilities on the endpoint.
- **Automatic threat remediation is turned on**: Files are moved and the security administrator is alerted.
- **Security intelligence updates are turned on**: Alerts are available in the [Microsoft Defender portal](https://security.microsoft.com).
-Online Kernel patching tools, such as Ksplice or similar, can lead to unpredictable OS stability if Defender for Endpoint is running. It's recommended to temporarily stop the Defender for Endpoint daemon before performing online Kernel patching. After the Kernel is updated, Defender for Endpoint on Linux can be safely restarted. This action is especially important on large SAP HANA VMs with huge memory contexts.
+Online kernel patching tools, such as Ksplice or similar, can lead to unpredictable OS stability if Defender for Endpoint is running. It's recommended to temporarily stop the Defender for Endpoint daemon before performing online kernel patching. After the kernel is updated, Defender for Endpoint on Linux can be safely restarted. This action is especially important on large SAP HANA VMs with huge memory contexts.
When Microsoft Defender Antivirus is running with real-time protection, it's no longer required to schedule scans. You should run a scan at least once to set a baseline. Then, if necessary, the Linux crontab is typically used to schedule Microsoft Defender Antivirus scans and log rotation tasks. For more information, see [How to schedule scans with Microsoft Defender for Endpoint (Linux)](schedule-antivirus-scan-crontab.md).
-[Endpoint detection and response](overview-endpoint-detection-response.md) (EDR) functionality is active whenever Microsoft Defender for Endpoint on Linux is installed. EDR functionality can be disabled through command line or configuration by using [global exclusions](linux-exclusions.md#supported-exclusion-scopes). For more information on troubleshooting EDR, see the sections [Useful Commands](#useful-commands) and [Useful Links](#useful-links) (in this article).
+[Endpoint detection and response](overview-endpoint-detection-response.md) (EDR) functionality is active whenever Microsoft Defender for Endpoint on Linux is installed. EDR functionality can be disabled through command line or configuration by using [global exclusions](linux-exclusions.md#supported-exclusion-scopes). For more information on troubleshooting EDR, see the sections [Useful commands](#useful-commands) and [Useful links](#useful-links) (in this article).
-## Important configuration settings for Microsoft Defender for Endpoint on SAP on Linux
+## Important configuration settings for Microsoft Defender for Endpoint on SAP on Linux
It's recommended to check the installation and configuration of Defender for Endpoint with the command `mdatp health`.
The key parameters recommended for SAP applications are as follows:
-```properties
-
+```output
healthy = true
release_ring = Production (Prerelease and insider rings shouldn't be used with SAP Applications.)
-real_time_protection_enabled = true (Real-time protection can be enabled for SAP NetWeaver applications and enables real-time IO interception.)
+real_time_protection_enabled = true (Real-time protection can be enabled for SAP NetWeaver applications and enables real-time IO interception.)
automatic_definition_update_enabled = true
definition_status = "up_to_date" (Run a manual update if a new value is identified.)
edr_early_preview_enabled = "disabled" (If enabled on SAP systems it might lead to system instability.)
conflicting_applications = [ ] (Other antivirus or security software installed on a VM such as Clam.)
supplementary_events_subsystem = "ebpf" (Don't proceed if ebpf isn't displayed. Contact the security admin team.)
-
```
For information about troubleshooting installation issues, see [Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux](linux-support-install.md#installation-failed).
-## Recommended Microsoft Defender for Endpoint Antivirus Exclusions for SAP on Linux
+## Recommended Microsoft Defender for Endpoint antivirus exclusions for SAP on Linux
-Your enterprise security team must obtain a full list of antivirus [exclusions](linux-exclusions.md) from the SAP Administrators (typically the SAP Basis Team). It's recommended to initially exclude:
+Your enterprise security team should get a full list of antivirus [exclusions](linux-exclusions.md) from the SAP administrators (typically the SAP Basis Team). It's recommended to initially exclude:
- DBMS data files, log files, and temp files, including disks containing backup files
- The entire contents of the SAPMNT directory
- The entire contents of the SAPLOC directory
- The entire contents of the TRANS directory
-- Hana – exclude /hana/shared, /hana/data, and /hana/log - see Note 1730930
-- SQL Server – [Configure antivirus software to work with SQL Server](/troubleshoot/sql/database-engine/security/antivirus-and-sql-server)
-- Oracle – See How To Configure Anti-Virus On Oracle Database Server (Doc ID 782354.1)
-- DB2 – [IBM documentation: Which DB2 directories to exclude with antivirus software](https://www.ibm.com/support/pages/which-db2-directories-exclude-linux-anti-virus-software)
-- SAP ASE – contact SAP
-- MaxDB – contact SAP
-- Adobe Document Server, SAP Archive Directories, TREX, LiveCache, Content Server, and other standalone engines must be tested carefully in nonproduction landscapes before deploying Defender for Endpoint in production
+- **HANA**: exclude /hana/shared, /hana/data, and /hana/log. See Note 1730930.
+- **SQL Server**: [Configure antivirus software to work with SQL Server](/troubleshoot/sql/database-engine/security/antivirus-and-sql-server)
+- **Oracle**: See How To Configure Anti-Virus On Oracle Database Server (Doc ID 782354.1).
+- **DB2**: [IBM documentation: Which DB2 directories to exclude with antivirus software](https://www.ibm.com/support/pages/which-db2-directories-exclude-linux-anti-virus-software)
+- **SAP ASE**: contact SAP.
+- **MaxDB**: contact SAP.
+- Adobe Document Server, SAP Archive Directories, TREX, LiveCache, Content Server, and other standalone engines must be tested carefully in nonproduction landscapes before you deploy Defender for Endpoint in production
Oracle ASM systems don't need exclusions as Microsoft Defender for Endpoint can't read ASM disks.
Customers with Pacemaker clusters should also configure these exclusions:
```bash
-
mdatp exclusion folder add --path /usr/lib/pacemaker/ (for RedHat /var/lib/pacemaker/)
-```
-
-```bash
-
mdatp exclusion process add --name pacemakerd
-```
+mdatp exclusion process add --name pacemaker-controld
-```bash
+mdatp exclusion process add --name pacemaker-schedulerd
-mdatp exclusion process add --name crm_*
+mdatp exclusion process add --name pacemaker-attrd
-```
-
-Customers running the Azure Security security policy might trigger a scan using the Freeware Clam AV solution. It's recommended to disable Clam AV scan after a VM has been protected with Microsoft Defender for Endpoint using following commands:
+mdatp exclusion process add --name pacemaker-based
-```bash
+mdatp exclusion process add --name pacemaker-execd
-sudo azsecd config -s clamav -d "Disabled"
+mdatp exclusion process add --name pacemaker-fenced
+mdatp exclusion process add --name crm_*
```
-```bash
-
-sudo service azsecd restart
-
-```
+Customers running the Azure Security security policy might trigger a scan using the Freeware Clam AV solution. It's recommended to disable Clam AV scan after a VM has been protected with Microsoft Defender for Endpoint by using the following commands:
```bash
+sudo azsecd config -s clamav -d "Disabled"
-sudo azsecd status
+sudo service azsecd restart
+sudo azsecd status
```
The following articles detail how to configure antivirus exclusions for processes, files, and folders per individual VM:
-- [Set up exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
-- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
+- [Set up exclusions for Microsoft Defender Antivirus scans](microsoft-defender-antivirus-exclusions-configure.md)
+- [Exclusions to avoid in Microsoft Defender Antivirus and Defender for Endpoint](defender-endpoint-exclusions-common-mistakes.md)
-## Scheduling a daily antivirus scan (optional)
+## Schedule a daily antivirus scan (optional)
-The recommended configuration for SAP applications enables real-time interception of IO calls for antivirus scanning. The recommended setting is passive mode in which `real_time_protection_enabled = true`.
+The recommended configuration for SAP applications enables real-time interception of IO calls for antivirus scanning. The recommended setting is real-time protection, in which `real_time_protection_enabled = true`.
SAP applications running on older versions of Linux or on hardware that's overloaded might consider using `real_time_protection_enabled = false`. In this case, antivirus scans should be scheduled.
For more information, see [How to schedule scans with Microsoft Defender for Endpoint (Linux)](schedule-antivirus-scan-crontab.md).
-Large SAP systems might have more than 20 SAP application servers, each with a connection to the SAPMNT NFS share. Twenty or more application servers simultaneously scanning the same NFS server will likely overload the NFS server. By default, Defender for Endpoint on Linux doesn't scan NFS sources.
+Large SAP systems might have more than 20 SAP application servers, each with a connection to the SAPMNT NFS share. Twenty or more application servers simultaneously scanning the same NFS server likely overload the NFS server. By default, Defender for Endpoint on Linux doesn't scan NFS sources.
If there's a requirement to scan SAPMNT, then this scan should be configured on one or two VMs only.
-Scheduled scans for SAP ECC, BW, CRM, SCM, Solution Manager, and other components should be staggered at different times to avoid all SAP components from overloading a shared NFS storage source shared by all SAP components.
+Scheduled scans for SAP ECC, BW, CRM, SCM, Solution Manager, and other components should be staggered at different times to prevent all SAP components from overloading a shared NFS storage source.
-## Useful Commands
+## Useful commands
If, during manual zypper installation on SUSE an error "Nothing provides 'policycoreutils'" occurs, see [Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux](linux-support-install.md).
-There are several command-line commands that can control the operation of mdatp. To enable passive mode, you can use the following command:
+Several command-line commands can control the operation of mdatp. To enable passive mode, you can use the following command:
```bash
-
mdatp config passive-mode --value enabled
-
```
> [!NOTE]
@@ -195,73 +184,51 @@ mdatp config passive-mode --value enabled
To turn on real-time protection, you can use the command:
```bash
-
mdatp config real-time-protection --value enabled
-
```
This command tells mdatp to retrieve the latest definitions from the cloud:
```bash
-
-mdatp definitions update
-
+mdatp definitions update
```
This command tests whether mdatp can connect to the cloud-based endpoints on the network:
```bash
-
mdatp connectivity test
-
```
These commands update the mdatp software, if needed:
```bash
-
yum update mdatp
-```
-
-```bash
-
zypper update mdatp
-
```
-Since mdatp runs as a linux system service, you can control mdatp using the service command, for example:
+Because mdatp runs as a Linux system service, you can control mdatp using the service command, for example:
```bash
-
-service mdatp status
-
+service mdatp status
```
This command creates a diagnostic file that can be uploaded to Microsoft support:
```bash
-
sudo mdatp diagnostic create
-
```
-## Useful Links
+## Useful links
- To analyze performance or other issues, see [Run the client analyzer on Linux](run-analyzer-linux.md).
-
- Microsoft Intune doesn't support Linux at this time. See [Learn how to use Intune endpoint security policies to manage Microsoft Defender for Endpoint on devices that aren't enrolled with Intune](/intune/intune-service/protect/mde-security-integration).
-
- [Microsoft Tech Community: Microsoft Defender for Endpoint Linux - Configuration and Operation Command List](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-defender-for-endpoint-linux-configuration-and/ba-p/1577902)
-
- [Microsoft Tech Community: Deploying Microsoft Defender for Endpoint on Linux Servers](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/deploying-microsoft-defender-for-endpoint-on-linux-servers/ba-p/1560326)
-
- [Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux](linux-support-connectivity.md#run-the-connectivity-test)
-
- [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](linux-support-perf.md)
## Related articles
- [Onboard servers to Microsoft Defender for Endpoint](onboard-server.md)
- [Microsoft Defender for Endpoint on Windows Server with SAP](mde-sap-windows-server.md)
-
diff --git a/defender-endpoint/mde-linux-prerequisites.md b/defender-endpoint/mde-linux-prerequisites.md
index 156f2e336db..a28c7570bb1 100644
--- a/defender-endpoint/mde-linux-prerequisites.md
+++ b/defender-endpoint/mde-linux-prerequisites.md
@@ -99,12 +99,12 @@ The following Linux server distributions are supported:
| Ubuntu LTS | 16.04, 18.04, 20.04, 22.04,24.04 | 20.04, 22.04, 24.04 |
| Ubuntu Pro | 22.04, 24.04 | 22.04, 24.04 |
| Debian | 9–13 | 11, 12, 13 |
-| SUSE Linux Enterprise Server | 12.x, 15.x | 15 (SP5, SP6) |
-| Oracle Linux | 7.2+, 8.x, 9.x | 8.x, 9.x |
+| SUSE Linux Enterprise Server | 12.x, 15.x, 16.x | 15 (SP5, SP6), 16.x |
+| Oracle Linux | 7.2+, 8.x, 9.x, 10.x | 8.x, 9.x, 10.x |
| Amazon Linux | 2, 2023 | 2 (Support retiring 31 October 2026. See notice below.)
2023 |
-| Fedora | 33–42 | - |
-| Rocky Linux | 8.7+, 9.2+ | 8.7+, 9.2+ |
-| Alma Linux | 8.4+, 9.2+ | 8.4+, 9.2+ |
+| Fedora | 33–43 | 40-43 |
+| Rocky Linux | 8.7+, 9.2+, 10.x | 8.7+, 9.2+, 10.x |
+| Alma Linux | 8.4+, 9.2+, 10.x | 8.4+, 9.2+, 10.x |
| Mariner | 2 | 2 |
> [!IMPORTANT]
diff --git a/defender-endpoint/mde-p1-setup-configuration.md b/defender-endpoint/mde-p1-setup-configuration.md
index 16f8fdfc5e9..ffe165df63a 100644
--- a/defender-endpoint/mde-p1-setup-configuration.md
+++ b/defender-endpoint/mde-p1-setup-configuration.md
@@ -137,11 +137,7 @@ We recommend using [Intune](/mem) to manage your organization's devices and secu
:::image type="content" source="/defender/media/mde-p1/endpoint-policies.png" alt-text="Screenshot of endpoint security policies in the Intune portal." lightbox="/defender/media/mde-p1/endpoint-policies.png":::
-To configure your next-generation protection in Intune, follow these steps:
-
-1. Go to the Intune admin center ([https://intune.microsoft.com](https://intune.microsoft.com)) and sign in.
-
-1. Select **Endpoint security** > **Antivirus**, and then select an existing policy. (If you don't have an existing policy, create a new policy.)
+To configure your next-generation protection in Intune, see Modify existing policies (opens in a new tab in the Intune documentation). Choose the following options:
1. Set or change your antivirus configuration settings. Need help? Refer to the following resources:
- [Settings for Windows 10 Microsoft Defender Antivirus policy in Microsoft Intune](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows)
@@ -156,7 +152,7 @@ Attack surface reduction is all about reducing the places and ways your organiza
|Feature/capability|Description|
|---|---|
|[Attack surface reduction (ASR) rules](#attack-surface-reduction-asr-rules)|ASR rules target risky software behavior on Windows devices that attackers commonly exploit through malware (for example, launching scripts that download files, running obfuscated scripts, and injecting code into other processes).|
-|[Ransomware mitigation](#ransomware-mitigation)|Set up ransomware mitigation by configuring controlled folder access, which helps protect your organization's valuable data from malicious apps and threats, such as ransomware.|
+|[Ransomware mitigation](#ransomware-mitigation)|Set up ransomware mitigation by configuring controlled folder access (CFA), which helps protect your organization's valuable data from malicious apps and threats, such as ransomware.|
|[Device control](#device-control)|Configure device control settings for your organization to allow or block removable devices (such as USB drives).|
|[Network protection](#network-protection)|Set up network protection to prevent people in your organization from using applications that access dangerous domains or malicious content on the Internet.|
|[Web protection](#web-protection)|Set up web threat protection to protect your organization's devices from phishing sites, exploit sites, and other untrusted or low-reputation sites. Set up web content filtering to track and regulate access to websites based on their content categories (such as Leisure, High bandwidth, Adult content, or Legal liability).|
@@ -173,76 +169,42 @@ Typically, you can enable the [standard protection rules](attack-surface-reducti
### Ransomware mitigation
-You get ransomware mitigation through [controlled folder access](controlled-folders.md#what-is-controlled-folder-access), which allows only trusted apps to access protected folders on your endpoints.
+You get ransomware mitigation through [controlled folder access](controlled-folder-access-overview.md), which allows only trusted apps to access protected folders on your endpoints.
To configure controlled folder access in Intune, see [Configure ASR rules and exclusions in Intune using endpoint security policies](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-intune-using-endpoint-security-policies). Use the **Enable controlled folder access**, **Controlled folder access protected folders**, and **Controlled folder access allowed applications** settings in the policy.
-For more information, see [Protect important folders with controlled folder access](controlled-folders.md).
+For more information, see [Controlled folder access (CFA) overview](controlled-folder-access-overview.md).
### Device control
-You can configure Defender for Endpoint to block or allow removable devices and files on removable devices. We recommend using Intune to configure your device control settings.
-
-:::image type="content" source="/defender/media/mde-p1/mem-admintemplates.png" alt-text="Screenshot of Intune administrative templates." lightbox="/defender/media/mde-p1/mem-admintemplates.png":::
-
-1. Go to the [Intune admin center](https://intune.microsoft.com) and sign in.
-
-1. Select **Devices** > **Configuration** > **+ Create** > **Create policy**.
-
-1. For **Platform**, select a profile, such as **Windows 10 and later**, and for **Profile type**, select **Templates**.
-
-1. Under **Template name**, select **Administrative Templates**, and then choose **Create**.
+You can configure Defender for Endpoint to block or allow removable devices and files on removable devices. To use Intune to configure your device control settings, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:
-1. On the **Basics** tab, name the policy and add a description. Select **Next**.
-
-1. On the **Configuration settings** tab, select **All Settings**. Then in the search box, type `Removable` to see all the settings that pertain to removable devices.
-
-1. Select an item in the list, such as **All Removable Storage classes, Deny all access**, to open its flyout pane. The flyout for each setting explains what happens when it's enabled, disabled, or not configured. Select a setting, and then choose **OK**.
-
-1. Repeat step 6 for each setting that you want to configure. Then choose **Next**.
-
-1. On the **Scope tags** tab, if your organization is using scope tags, choose **+ Select scope tags**, and then select the tags you want to use. Then, choose **Next**.
-
-1. To learn more about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/intune/intune-service/fundamentals/scope-tags).
+- **Platform**: Windows 10 or later
+- **Profile type**: Templates
+- **Template name** Administrative templates
+- **Configuration settings**: **All Settings**, then type `Removable` in the search box to see all the settings that pertain to removable devices.
+ Select an item in the list, such as **All Removable Storage classes, Deny all access**, to open its flyout pane. The flyout for each setting explains what happens when it's enabled, disabled, or not configured. Select a setting and choose **OK**.
+- **Scope tags**: **+ Select scope tags**, then select the tags you want to use.
+- **Assignments**: **Add all users** and **+ Add all devices**.
-1. On the **Assignments** tab, select **Add all users** and **+ Add all devices**, and then choose **Next**. (You can alternately specify specific groups of users or devices.)
-
-1. On the **Review + create** tab, review the settings for your policy, and then choose **Create**. The policy is applied to any endpoints that were onboarded to Defender for Endpoint shortly.
+On the **Review + create** tab, review the settings for your policy, and then choose **Create**. The policy is applied to any endpoints that were onboarded to Defender for Endpoint shortly.
> [!TIP]
> For more information, see [How to control USB devices and other removable media using Microsoft Defender for Endpoint](device-control-overview.md).
### Network protection
-With network protection, you can help protect your organization against dangerous domains that might host phishing scams, exploits, and other malicious content on the Internet. We recommend using Intune to turn on network protection.
-
-:::image type="content" source="/defender/media/mde-p1/mem-endpointprotectionprofile.png" alt-text="Screenshot of endpoint protection profile in the Intune portal." lightbox="/defender/media/mde-p1/mem-endpointprotectionprofile.png":::
-
-1. Go to the [Intune admin center](https://intune.microsoft.com) and sign in.
-
-1. Select **Devices** > **Configuration** > **+ Create** > **Create policy**.
-
-1. For **Platform**, select a profile, such as **Windows 10 and later**, and for **Profile type**, select **Templates**.
-
-1. Under **Template name**, select **Endpoint protection**, and then choose **Create**.
-
-1. On the **Basics** tab, name the policy and add a description. Select **Next**.
-
-1. On the **Configuration settings** tab, expand **Microsoft Defender Exploit Guard**, and then expand **Network filtering**.
-
- a. Set **Network protection** to **Enable**. (You can alternately choose **Audit** to see how network protection works in your environment at first.)
-
- a. Then choose **Next**.
-
-1. On the **Assignments** tab, select **Add all users** and **+ Add all devices**, and then choose **Next**. (You can alternately specify specific groups of users or devices.)
-
-1. On the **Applicability Rules** tab, set up a rule. The profile you're configuring is applied only to devices that meet the combined criteria you specify.
-
- a. For example, you might choose to assign the policy to endpoints that are running a certain OS edition only.
+With network protection, you can help protect your organization against dangerous domains that might host phishing scams, exploits, and other malicious content on the Internet. To use Intune to turn on network protection, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:
- a. Then choose **Next**.
+- **Platform**: **Windows 10 and later**
+- **Profile type**: **Templates**
+- **Template name**: **Endpoint protection**
+- **Configuration settings**: Expand **Microsoft Defender Exploit Guard**, then expand **Network filtering**
+ - Set **Network protection** to **Enable**. (You can alternately choose **Audit** to see how network protection works in your environment at first.)
+- **Assignments**: **Add all users** and **+ Add all devices** (You can alternately specify specific groups of users or devices.)
+- **Applicability Rules** : Set up a rule. The profile you're configuring is applied only to devices that meet the combined criteria you specify. For example, you might choose to assign the policy to endpoints that are running a certain OS edition only.
-1. On the **Review + create** tab, review the settings for your policy, and then choose **Create**. The policy is applied to any endpoints that were onboarded to Defender for Endpoint shortly.
+On the **Review + create** tab, review the settings for your policy, and then choose **Create**. The policy is applied to any endpoints that were onboarded to Defender for Endpoint shortly.
> [!TIP]
> You can use other methods, such as Windows PowerShell or Group Policy, to enable network protection. To learn more, see [Turn on network protection](enable-network-protection.md).
@@ -317,7 +279,7 @@ To configure network firewall using a Microsoft Intune Endpoint Security **Firew
For more information about network firewall profiles available in Microsoft Intune, see [Firewall policy for endpoint security in Intune](/intune/intune-service/protect/endpoint-security-firewall-policy).
> [!TIP]
-> Firewall settings are detailed and can seem complex. Refer to [Best practices for configuring Windows Defender Firewall](/windows/security/threat-protection/windows-firewall/best-practices-configuring).
+> Firewall settings are detailed and can seem complex. Refer to [Best practices for configuring Windows Defender Firewall](/windows/security/operating-system-security/network-security/windows-firewall/configure).
### Application control
@@ -325,11 +287,11 @@ Windows Defender Application Control (WDAC) helps protect your Windows endpoints
To help with planning your WDAC deployment, see the following resources:
-- [Application Control for Windows](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)
+- [Application Control for Windows](/windows/security/application-security/application-control/app-control-for-business/appcontrol)
-- [Windows Defender Application Control policy design decisions](/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions)
+- [Windows Defender Application Control policy design decisions](/windows/security/application-security/application-control/app-control-for-business/design/understand-appcontrol-policy-design-decisions)
-- [Windows Defender Application Control deployment in different scenarios: types of devices](/windows/security/threat-protection/windows-defender-application-control/types-of-devices)
+- [Windows Defender Application Control deployment in different scenarios: types of devices](/windows/security/application-security/application-control/app-control-for-business/design/common-appcontrol-use-cases)
## Next steps
diff --git a/defender-endpoint/mde-plugin-wsl.md b/defender-endpoint/mde-plugin-wsl.md
index 2df69867b9c..c0f3b328374 100644
--- a/defender-endpoint/mde-plugin-wsl.md
+++ b/defender-endpoint/mde-plugin-wsl.md
@@ -8,30 +8,36 @@ ms.service: defender-endpoint
ms.subservice: onboard
ms.topic: how-to
ms.localizationpriority: medium
-ms.collection:
+ms.collection:
- m365-security
- tier2
ms.custom:
- - msecd-doc-authoring-1014
+ - msecd-doc-authoring-1016
- partner-contribution
- sfi-image-nochange
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 2
-
ai-usage: ai-assisted
---
+
# Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL)
+This article explains how to install, configure, and troubleshoot the Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) 2. The plug-in supports both traditional WSL 2 distributions and WSL containers (WSLc) running on supported Windows devices and are onboarded to Microsoft Defender for Endpoint Plan 2.
+
+> [!NOTE]
+> WSL container (WSLc) support is currently in [Public Preview](https://devblogs.microsoft.com/commandline/wsl-container-is-now-available-for-public-preview/). To participate in the Public Preview and obtain the WSLc-compatible preview version of the Microsoft Defender for Endpoint plug-in for WSL, complete the [registration form](https://aka.ms/WSLcpublicpreviewregistration)
## Overview
-Windows Subsystem for Linux (WSL) 2, which replaces the previous version of WSL (supported by Microsoft Defender for Endpoint without a plug-in), provides a Linux environment that is seamlessly integrated with Windows, yet is isolated using virtualization technology. The Defender for Endpoint for WSL plug-in enables Defender for Endpoint to provide more visibility into all running WSL containers by plugging into the isolated subsystem.
+Windows Subsystem for Linux (WSL) 2, which replaces the previous version of WSL (supported by Microsoft Defender for Endpoint without a plug-in), provides a Linux environment that is seamlessly integrated with Windows, yet is isolated using virtualization technology. The Microsoft Defender for Endpoint plug-in supports both the traditional WSL 2 Linux distributions and the new WSL containers (WSLc). The Defender for Endpoint for WSL plug-in enables Defender for Endpoint to provide more visibility into all running WSL containers by plugging into the isolated subsystem.
## Prerequisites
-- WSL version `2.0.7.0` or later must be running with at least one active distro. Run `wsl --update` to make sure you are on the latest version. If `wsl -–version` shows a version older than `2.0.7.0`, run `wsl --update --pre-release` to get the latest update.
+Before you install the Defender for Endpoint WSL plug-in, make sure the following prerequisites are met:
+- WSL version `2.0.7.0` or later must be running with at least one active distro. Run `wsl --update` to make sure you are on the latest version. If `wsl -–version` shows a version older than `2.0.7.0`, run `wsl --update --pre-release` to get the latest update.
+- For WSL containers (WSLc), WSL version 2.9.5 or later is required. WSLc support is currently in Public Preview and requires a supported preview version of the Microsoft Defender for Endpoint plug-in for WSL.
- The Windows client device must be onboarded to Defender for Endpoint.
### Supported operating systems
@@ -46,32 +52,30 @@ The following operating systems support the Defender for Endpoint WSL plug-in:
Be aware of the following considerations before you start:
- The plug-in doesn't support automatic updates on versions prior to `1.24.522.2`. On version `1.24.522.2` and later. Updates are supported through Windows Update across all rings. Updates through Windows Server Update Services (WSUS), System Center Configuration Manager (SCCM), and Microsoft Update catalog are supported only in the Production ring to ensure package stability.
-
- It takes a few minutes for the plug-in to fully instantiate, and up to 30 minutes for a WSL2 instance to onboard itself. Short-lived WSL container instances might result in the WSL2 instance not showing up in the [Microsoft Defender portal](https://security.microsoft.com). When any distribution has been running long enough (at least 30 minutes), the WSL2 instance does show up in the Microsoft Defender portal.
-
- Running a custom kernel and custom kernel command line is not supported. Although the plug-in does not block running in that configuration, it does not guarantee visibility within WSL when you're running a custom kernel and custom kernel command line. We recommend blocking such configurations with [Microsoft Intune wsl settings](/windows/wsl/intune).
-
- The plug-in is not supported on machines with an ARM64 processor.
-
- The plug-in is not supported on multi-session variants of Windows 10 and 11.
-
- The plug-in provides visibility into events from WSL, but other features like antimalware, threat and vulnerability management, and response commands are not available for the WSL logical device.
-
+- Detection and alerting behavior can vary between Linux distributions.
## Software components and installer file names
-Installer: `DefenderPlugin-x64-0.24.426.1.msi`. You can download it from the onboarding page in the [Microsoft Defender portal](https://security.microsoft.com). (Go to **Settings** > **Endpoints** > **Onboarding**.)
+Installer: `Defenderplugin-x64-1.26.813.1.msi`. You can download the installer from the onboarding page in the [Microsoft Defender portal](https://security.microsoft.com). (Go to **Settings** \> **Endpoints** \> **Onboarding** \> **Windows Subsystem for Linux 2 (plug-in)**.)
+
+> [!NOTE]
+> The installer referenced above is intended for WSL 2 deployments.
+>
+> Support for WSL containers (WSLc) is currently in Public Preview and requires a preview version of the Microsoft Defender for Endpoint plug-in for WSL. To participate in the WSLc Public Preview and obtain the preview installer, complete the following [registration form](https://aka.ms/WSLcpublicpreviewregistration)
Installation directories:
- `%ProgramFiles%`
-
- `%ProgramData%`
Components installed:
- `DefenderforEndpointPlug-in.dll`. This DLL is the library to load Defender for Endpoint to work within WSL. You can find it at `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\plug-in`.
-
- `healthcheck.exe`. This program checks the health status of Defender for Endpoint and enables you to see the installed versions of WSL, plug-in, and Defender for Endpoint. You can find it at `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
@@ -79,7 +83,7 @@ Components installed:
If your Windows Subsystem for Linux isn't installed yet, follow these steps:
-1. Open Terminal or Command Prompt. (In Windows, go to **Start** > **Command Prompt**. Or, right-click the start button and then select **Terminal**.)
+1. Open Terminal or Command Prompt. (In Windows, go to **Start** \> **Command Prompt**. Or, right-click the start button and then select **Terminal**.)
1. Run the command `wsl -–install`.
@@ -87,22 +91,28 @@ If your Windows Subsystem for Linux isn't installed yet, follow these steps:
1. Using Terminal or Command Prompt, run `wsl –-update` to make sure you have the latest version.
+ For WSL containers (WSLc), run `wsl --update --pre-release` to install the latest WSL preview release required for WSLc functionality.
+
1. Run the `wsl` command to ensure WSL is running before testing.
1. Install the plug-in by following these steps:
1. Install the MSI file downloaded from the onboarding section in the Microsoft Defender portal (**Settings** > **Endpoints** > **Onboarding** > **Windows Subsystem for Linux 2 (plug-in)**).
+ For WSL containers (WSLc), install the WSLc-compatible Public Preview version of the Microsoft Defender for Endpoint plug-in.
+
1. Open a command prompt/terminal and run `wsl`.
You can [deploy the package using Microsoft Intune](/intune/intune-service/apps/lob-apps-windows).
> [!NOTE]
> If `WslService` is running, it stops during the installation process. You do not need to onboard the subsystem separately. Instead, the plug-in automatically onboards to the tenant the Windows host is onboarded to.
-> Microsoft Defender for Endpoint update for plug-in for WSL [KB Update](https://support.microsoft.com/en-us/topic/microsoft-defender-for-endpoint-update-for-plug-in-for-wsl-9f4b2ddc-c47f-4c59-bd02-a3456c667966).
+> Microsoft Defender for Endpoint update for plug-in for WSL [KB Update](https://support.microsoft.com/security/microsoft-defender-for-endpoint-update-for-plug-in-for-wsl).
## Installation validation checklist
+Use the following checklist to verify that the plug-in installed correctly and is running as expected:
+
1. After update or installation, wait for at least five minutes for the plug-in to fully initialize and write log output.
1. Open Terminal or Command Prompt. (In Windows, go to **Start** > **Command Prompt**. Or, right-click the start button and then select **Terminal**.)
@@ -110,6 +120,9 @@ If your Windows Subsystem for Linux isn't installed yet, follow these steps:
1. Run the command: `cd "%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools"`.
1. Run the command `.\healthcheck.exe`.
+
+ For WSL containers (WSLc), verify that all active WSLc VMs are listed in the HealthCheck output and that each VM reports a healthy Defender status.
+
1. Review the details of Defender and WSL and make sure they match or exceed the following requirements:
- **Plug-in Version**: `1.24.522.2`
@@ -125,7 +138,7 @@ If you want to use the host [windows EDR telemetry proxy](configure-proxy-intern
If you want to use the host [winhttp proxy](configure-proxy-internet.md#configure-the-proxy-server-manually-using-netsh-command) configuration for MDE for WSL plug-in, nothing more is required. The host WinHTTP proxy configuration is adopted by the plug-in automatically.
-If you want to use the host [network and network proxy setting](https://support.microsoft.com/windows/use-a-proxy-server-in-windows-03096c53-0554-4ffe-b6ab-8b1deee8dae1#ID0EFD=Windows_11&preserve-view=true) for MDE for WSL plug-in, nothing more is required. The host network proxy configuration is adopted by the plug-in automatically.
+If you want to use the host [network and network proxy setting](https://support.microsoft.com/Windows/Experience/Connectivity-Networking/use-a-proxy-server-in-windows) for MDE for WSL plug-in, nothing more is required. The host network proxy configuration is adopted by the plug-in automatically.
> [!NOTE]
> WSL defender supports only `http` proxy.
@@ -154,10 +167,14 @@ On starting your wsl machine, wait for 5 minutes and then run `healthcheck.exe`
> [!NOTE]
> The `ConnectivityTest` registry key is no longer supported.
+>
> To set a proxy for use in WSL containers (the distributions running on the subsystem), see [Advanced settings configuration in WSL](/windows/wsl/wsl-config).
## Verifying functionality and SOC analyst experience
+> [!NOTE]
+> The investigation experience, including Device Timeline, Alerts, Incidents, and Advanced Hunting, is the same for WSL 2 and WSLc workloads.
+
After installing the plug-in, the subsystem and all its running containers are onboarded to the [Microsoft Defender portal](https://security.microsoft.com).
1. Sign into the Microsoft Defender portal, and open the **Devices** view.
@@ -168,15 +185,15 @@ After installing the plug-in, the subsystem and all its running containers are o
You can see all WSL instances in your environment with an active Defender for Endpoint plug-in for WSL. These instances represent all distributions running inside WSL on a given host. The hostname of a *device* matches that of the Windows host. However, it's represented as a Linux device.
-1. Open the device page. In the **Overview** pane, there's a link for where the device is hosted. The link enables you to understand that the device is running on a Windows host. You can then pivot to the Windows host for further investigation and/or response.
+1. Open the device page. In the **Overview** pane, the hosting link shows that the device is running on a Windows host. You can select this link to pivot to the Windows host for further investigation and/or response.
- :::image type="content" source="media/mdeplugin-wsl/wsl-ui-overview.png" alt-text="Screenshot showing device overview." lightbox="media/mdeplugin-wsl/wsl-ui-overview.png":::
+ :::image type="content" source="media/mdeplugin-wsl/wsl-ui-overview.png" alt-text="Screenshot showing device overview." lightbox="media/mdeplugin-wsl/wsl-ui-overview.png":::
The timeline is populated, similar to Defender for Endpoint on Linux, with events from inside the subsystem (file, process, network). You can observe activity and detections in the timeline view. Alerts and incidents are generated as appropriate as well.
## Setting up custom tag for your WSL machine
-The plug-in onboards the WSL machine with the tag `WSL2`. Should you or your organization need a custom tag, please follow the steps outlined below:
+The plug-in onboards the WSL machine with the tag `WSL2`. If you or your organization need a custom tag, follow these steps to configure one:
1. Open Registry Editor as an administrator.
@@ -193,11 +210,10 @@ The plug-in onboards the WSL machine with the tag `WSL2`. Should you or your org
1. Run the `wsl` command.
-1. Wait for 5-10 minutes for the portal to reflect the changes.
+1. Wait for 5-10 minutes for the portal to reflect the changes.
> [!NOTE]
-> The custom tag value configured in the `GROUP` registry entry is suffixed with `_WSL2`.
-> For example, if the `GROUP` registry value is `Microsoft`, the custom tag appears as `Microsoft_WSL2` in the portal.
+> The custom tag value configured in the `GROUP` registry entry is suffixed with `_WSL2`. For example, if the `GROUP` registry value is `Microsoft`, the custom tag appears as `Microsoft_WSL2` in the portal.
### Test the plug-in
@@ -220,6 +236,8 @@ Treat the machine as if it were a regular Linux host in your environment to perf
### Use advanced hunting to investigate WSL devices
+The Advanced Hunting experience is identical for WSL 2 and WSL container workloads. Existing queries continue to work without modification.
+
In the Advanced Hunting schema, under the `DeviceInfo` table, there's a new attribute called `HostDeviceId` that you can use to map a WSL instance to its Windows host device. Here are a few sample hunting queries:
#### Get all WSL device IDs for the current organization/tenant
@@ -227,10 +245,10 @@ In the Advanced Hunting schema, under the `DeviceInfo` table, there's a new attr
Use the following query to list all WSL device IDs in your tenant:
```kusto
-//Get all WSL device ids for the current organization/tenant
-let wsl_endpoints = DeviceInfo
+//Get all WSL device ids for the current organization/tenant
+let wsl_endpoints = DeviceInfo
| where OSPlatform == "Linux" and isnotempty(HostDeviceId)
-| distinct DeviceId;
+| distinct DeviceId;
wsl_endpoints
```
@@ -239,8 +257,8 @@ wsl_endpoints
Use the following query to map each WSL device ID to its corresponding Windows host device ID:
```kusto
-//Get WSL device ids and their corresponding host device ids
-DeviceInfo
+//Get WSL device ids and their corresponding host device ids
+DeviceInfo
| where OSPlatform == "Linux" and isnotempty(HostDeviceId)
| distinct WSLDeviceId=DeviceId, HostDeviceId
```
@@ -251,17 +269,19 @@ Use the following query to find WSL devices where `curl` or `wget` was executed:
```kusto
//Get a list of WSL device ids where curl or wget was run
-let wsl_endpoints = DeviceInfo
+let wsl_endpoints = DeviceInfo
| where OSPlatform == "Linux" and isnotempty(HostDeviceId)
-| distinct DeviceId;
-DeviceProcessEvents
-| where FileName == "curl" or FileName == "wget"
-| where DeviceId in (wsl_endpoints)
+| distinct DeviceId;
+DeviceProcessEvents
+| where FileName == "curl" or FileName == "wget"
+| where DeviceId in (wsl_endpoints)
| sort by Timestamp desc
```
## Troubleshooting
+[!NOTE] For troubleshooting related to WSLc, check this [section](/windows/wsl/tutorials/wsl-containers#troubleshooting).
+
Use the following troubleshooting steps to diagnose and resolve common issues with the Defender for Endpoint WSL plug-in.
### Installation failure
@@ -279,7 +299,7 @@ If you see an error on launching WSL, such as `A fatal error was returned by plu
If you see this message, start a WSL distribution and wait before rerunning the health check:
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check.png" alt-text="Screenshot showing PowerShell output." lightbox="media/mdeplugin-wsl/wsl-health-check.png":::
-
+
1. Open a terminal instance and run the command `wsl`.
1. Wait for at least five minutes before rerunning the health check.
@@ -289,7 +309,7 @@ If you see this message, start a WSL distribution and wait before rerunning the
You might see the following message while telemetry is still initializing:
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-telemetry.png" alt-text="Screenshot showing health telemetry status." lightbox="media/mdeplugin-wsl/wsl-health-check-telemetry.png":::
-
+
If the "Waiting for Telemetry" message occurs, wait for five minutes and rerun `healthcheck.exe`.
### You don't see any devices in the Microsoft Defender portal, or you don't see any events in the timeline
@@ -297,13 +317,13 @@ If the "Waiting for Telemetry" message occurs, wait for five minutes and rerun `
Check the following things:
- If you aren't seeing a machine object, make sure sufficient time has passed for onboarding to complete (typically up to 10 minutes).
-
+
- Make sure to use the right filters, and that you have the appropriate permissions assigned to view all device objects. (For example, is your account/group is restricted to a specific group?)
-
+
- Use the health check tool to provide an overview of overall plug-in health. Open Terminal, and run the `healthcheck.exe` tool from `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
-
+
:::image type="content" source="media/mdeplugin-wsl/wsl-health-check-support.png" alt-text="Screenshot showing status in PowerShell." lightbox="media/mdeplugin-wsl/wsl-health-check-support.png":::
-
+
- Enable the connectivity test and check for Defender for Endpoint connectivity in WSL. If the connectivity test fails, provide the output of the health check tool to our support team.
### Connectivity test reports "invalid" in health check
@@ -312,30 +332,33 @@ If the connectivity test reports `invalid`, use the following checks to diagnose
- If your machine has a proxy setup, run the command `healthCheck --extendedProxy`. This will provide information on which proxy(s) is set on your machine and whether these configurations are invalid for WSL defender.
- 
-
-- If running `healthCheck --extendedProxy` does not resolve the issue, include the following configuration settings in the `.wslconfig` located in your `%UserProfile%` and restart WSL. Details about settings can be found in [WSL Settings](/windows/wsl/wsl-config#main-wsl-settings).
+ 
+
+- If running `healthCheck --extendedProxy` does not resolve the connectivity test failure, include the following configuration settings in the `.wslconfig` file located in your `%UserProfile%` and restart WSL. Details about settings can be found in [WSL Settings](/windows/wsl/wsl-config#main-wsl-settings).
**In Windows 11**
- ```
+ Add the following settings to your `.wslconfig` file to enable DNS tunneling and mirrored networking:
+
+ ```ini
# Settings apply across all Linux distros running on WSL 2
[wsl2]
dnsTunneling=true
- networkingMode=mirrored
+ networkingMode=mirrored
```
**In Windows 10**
- ```bash
+ Add the following setting to your `.wslconfig` file to disable the DNS proxy:
+
+ ```ini
# Settings apply across all Linux distros running on WSL 2
[wsl2]
-
+
dnsProxy=false
-
```
### Connectivity issues persist
@@ -347,20 +370,19 @@ Collect the networking logs by following these steps:
1. Download and run: `.\collect-networking-logs.ps1`
```powershell
-
Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-networking-logs.ps1" -OutFile collect-networking-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-networking-logs.ps1
-
```
1. Open a new command prompt and run the following command: `wsl`.
-
+
1. Open an elevated(admin) command prompt and run the following command: `wsl --debug-shell`.
1. In debug shell, run: `mdatp connectivity test`.
1. Allow the connectivity test to be completed.
+
1. Stop the .ps1 ran in step #2.
1. Share the generated .zip file along with a support bundle collected by running `healthcheck.exe --supportBundle` from `%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools`.
@@ -369,14 +391,16 @@ Collect the networking logs by following these steps:
To collect diagnostic information for support, generate a support bundle using the following steps:
-1. If you run into any other challenges or issues, open Terminal, and run the following commands to generate a support bundle:
+1. If you run into any other challenges or issues, open Terminal. First, navigate to the Defender for Endpoint WSL plug-in tools directory, and then run the `healthcheck.exe` tool to generate a support bundle:
```powershell
cd "%ProgramFiles%\Microsoft Defender for Endpoint plug-in for WSL\tools"
```
+ Then, run the following command to generate a support bundle that collects diagnostic information for troubleshooting:
+
```powershell
- .\healthcheck.exe --supportBundle
+ .\healthcheck.exe --supportBundle
```
The support bundle can be found in the path provided by the previous command.
@@ -397,28 +421,25 @@ Microsoft Defender Endpoint plug-in for WSL supports Linux distributions running
1. Set the **Allow WSL1** setting to **Disabled**, to ensure that only WSL 2 distributions can be used.
- Alternately, if you want to keep using WSL 1, or not use the Intune Policy, you can selectively associate your installed distributions to run on WSL 2, by running the command in PowerShell:
+ Alternately, if you want to keep using WSL 1, or not use the Intune Policy, you can selectively upgrade a specific installed distribution from WSL 1 to WSL 2 by running the following command in PowerShell:
```powershell
wsl --set-version
Windows 11|Microsoft Defender Antivirus|Active mode|
-|Windows 10
Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically)
Note that in Windows 11, if SmartAppControl is enabled, you may observe that Microsoft Defender Antivirus goes into passive mode instead of remaining in disabled mode. However, this is not the same scenario as for devices onboarded to Microsoft Defender for Endpoint.|
+|Windows 10
Windows 11|A non-Microsoft antivirus/antimalware solution|Disabled mode (happens automatically)
Note that in Windows 11, if SmartAppControl is enabled, you may observe that Microsoft Defender Antivirus goes into passive mode instead of remaining in disabled mode. However, Microsoft Defender Antivirus entering passive mode because of SmartAppControl is not the same as passive mode on devices onboarded to Microsoft Defender for Endpoint.|
|Windows Server 2025
Windows Server 2022
Windows Server 2019
Windows Server, version 1803, or newer
Windows Server 2016
Windows Server 2012 R2
Azure Stack HCI OS, version 23H2 and later |Microsoft Defender Antivirus|Active mode|
|Windows Server 2025
Windows Server 2022
Windows Server 2019
Windows Server, version 1803, or newer
Windows Server 2016
Azure Stack HCI OS, version 23H2 and later |A non-Microsoft antivirus/antimalware solution|Disabled
(set manually; see the note that follows this table) |
@@ -68,11 +70,11 @@ If the device is onboarded to Microsoft Defender for Endpoint, you can use Micro
>
> - Windows Server 2019 and newer: `Uninstall-WindowsFeature Windows-Defender`
> - Windows Server 2016: `Uninstall-WindowsFeature Windows-Defender` and `Uninstall-WindowsFeature Windows-Defender-Gui`
->
-> On Windows Server 2016, you might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.
->
+>
+> On Windows Server 2016, you might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.
+>
> Make sure to restart your server to finish removing Microsoft Defender Antivirus.
->
+>
> If you uninstall your non-Microsoft antivirus product, make sure that Microsoft Defender Antivirus is re-enabled. See [Re-enable Microsoft Defender Antivirus on Windows Server if it was disabled](enable-update-mdav-to-latest-ws.md#re-enable-microsoft-defender-antivirus-on-windows-server-if-it-was-disabled).
## Microsoft Defender Antivirus and non-Microsoft antivirus/antimalware solutions
@@ -86,7 +88,7 @@ Whether Microsoft Defender Antivirus runs in active mode, passive mode, or is di
- Whether Microsoft Defender Antivirus is the primary antivirus/antimalware solution on the endpoint
- Whether the endpoint is onboarded to Defender for Endpoint
-The following table summarizes the state of Microsoft Defender Antivirus in several scenarios.
+The following table summarizes the state of Microsoft Defender Antivirus in several scenarios.
| Antivirus/antimalware solution | Onboarded to Defender for Endpoint? | Microsoft Defender Antivirus state | Smart App Control State |
|---|---|---|---|
@@ -97,23 +99,23 @@ The following table summarizes the state of Microsoft Defender Antivirus in seve
| A non-Microsoft antivirus/antimalware solution | No | Disabled (automatically) | N/A or Off|
> [!NOTE]
-> Smart App Control is a consumer-only product that's used on new Windows 11 installs. It can run alongside your antivirus software and block apps that are considered to be malicious or untrusted. [Learn more about Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003).
+> Smart App Control is a consumer-only product that's used on new Windows 11 installs. It can run alongside your antivirus software and block apps that are considered to be malicious or untrusted. [Learn more about Smart App Control](https://support.microsoft.com/Windows/Security/Threat-Malware-Protection/smart-app-control-frequently-asked-questions).
## Windows Server and passive mode
> [!TIP]
> If you are planning to keep Microsoft Defender Antivirus in passive mode for your Windows Servers, the `ForceDefenderPassiveMode` setting needs to be set before onboarding the device to Microsoft Defender for Endpoint.
-On Windows Server 2016 and later, Windows Server, version 1803 or newer, Windows Server 2012 R2 and Azure Stack HCI OS, version 23H2 and later, Microsoft Defender Antivirus doesn't enter passive mode automatically when you install a non-Microsoft antivirus product. In those cases, set Microsoft Defender Antivirus to passive mode to prevent problems caused by having multiple antivirus products installed on a server. You can set Microsoft Defender Antivirus to passive mode using a registry key as follows:
+On Windows Server 2016 and later, Windows Server, version 1803 or newer, Windows Server 2012 R2 and Azure Stack HCI OS, version 23H2 and later, Microsoft Defender Antivirus doesn't enter passive mode automatically when you install a non-Microsoft antivirus product. On these operating systems, set Microsoft Defender Antivirus to passive mode to prevent problems caused by having multiple antivirus products installed on a server. You can set Microsoft Defender Antivirus to passive mode using a registry key as follows:
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
- Name: `ForceDefenderPassiveMode`
- Type: `REG_DWORD`
- Value: `1`
-You can view your protection status in PowerShell by using the command [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus). Check the value for `AMRunningMode`. You should see **Normal**, **Passive**, or **EDR Block Mode** if Microsoft Defender Antivirus is enabled on the endpoint.
+You can view your protection status in PowerShell by using the command [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus). Check the value for `AMRunningMode`. You should see **Normal**, **Passive**, or **EDR Block Mode** if Microsoft Defender Antivirus is enabled on the endpoint.
-For passive mode to work on endpoints running Windows Server 2016 and Windows Server 2012 R2, those endpoints must be onboarded using the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
+For passive mode to work on endpoints running Windows Server 2016 and Windows Server 2012 R2, those endpoints must be onboarded using the [modern unified solution for Windows Server 2016 and Windows Server 2012 R2](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
> [!IMPORTANT]
> Beginning with [platform version 4.18.2208.0 and later](msda-updates-previous-versions-technical-upgrade-support.md#september-2022-platform-41822097--engine-11197003), if a server is onboarded to Microsoft Defender for Endpoint, [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) allows a switch to active mode, but not to passive mode.
@@ -131,11 +133,11 @@ For example, [Endpoint detection and response (EDR) in block mode](edr-in-block-
In order for Microsoft Defender Antivirus to run in passive mode, endpoints must meet the following requirements:
-- Operating system: Windows 10 or newer; Windows Server 2019 and later, Windows Server, version 1803, or newer, Azure Stack HCI OS, version 23H2 and later or
(Windows Server 2012 R2 and Windows Server 2016 if onboarded using the [modern, unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)).
+- Operating system: Windows 10 or newer; Windows Server 2019 and later, Windows Server, version 1803, or newer, Azure Stack HCI OS, version 23H2 and later or
(Windows Server 2012 R2 and Windows Server 2016 if onboarded using the [modern, unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2)).
- Microsoft Defender Antivirus must be installed.
-- Another non-Microsoft antivirus/antimalware product must be installed and used as the primary antivirus solution. ([Add Microsoft Defender for Endpoint to your exclusion list for your existing solution](switch-to-mde-phase-2.md)).
+- Another non-Microsoft antivirus/antimalware product must be installed and used as the primary antivirus solution. ([Add Microsoft Defender for Endpoint to your exclusion list for your existing solution](switch-to-mde-phase-2.md)).
- Endpoints must be onboarded to Defender for Endpoint.
@@ -148,7 +150,7 @@ In order for Microsoft Defender Antivirus to run in passive mode, endpoints must
> [!IMPORTANT]
>
> - Microsoft Defender Antivirus is only available on devices running Windows 10 and 11, Windows Server 2012 R2 and later, Windows Server, version 1803 or newer, and Azure Stack HCI OS, version 23H2 and later.
-> - Passive mode is only supported on Windows Server 2012 R2 & 2016 when the device is onboarded using the [modern, unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
+> - Passive mode is only supported on Windows Server 2012 R2 & 2016 when the device is onboarded using the [modern unified solution for Windows Server 2016 and Windows Server 2012 R2](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
> - In Windows 8.1, enterprise-level endpoint antivirus protection is offered as [System Center Endpoint Protection](/previous-versions/system-center/system-center-2012-R2/hh508760(v=technet.10)), which is managed through Microsoft Configuration Manager.
> - Windows Defender is also offered for [consumer devices on Windows 8.1](/previous-versions/windows/it-pro/windows-8.1-and-8/dn344918(v=ws.11)#BKMK_WindowsDefender), although Windows Defender does not provide enterprise-level management.
@@ -158,7 +160,7 @@ Defender for Endpoint affects whether Microsoft Defender Antivirus can run in pa
> [!IMPORTANT]
>
-> - The following table summarizes the features and capabilities that are actively working or not, according to whether Microsoft Defender Antivirus is in active mode, passive mode, or disabled/uninstalled. This table is designed to be informational only.
+> - The following table summarizes the features and capabilities that are actively working or not, according to whether Microsoft Defender Antivirus is in active mode, passive mode, or disabled/uninstalled. This table is designed to be informational only.
> - **Do not turn off capabilities**, such as real-time protection, cloud-delivered protection, or limited periodic scanning if you are using Microsoft Defender Antivirus in passive mode, or if you are using [EDR in block mode](edr-in-block-mode.md), which works behind the scenes to detect and remediate malicious artifacts that were detected post-breach.
| Protection | Microsoft Defender Antivirus
(*Active mode*) | Microsoft Defender Antivirus
(*Passive mode*) | Microsoft Defender Antivirus
(*Disabled or uninstalled*) |
@@ -167,12 +169,12 @@ Defender for Endpoint affects whether Microsoft Defender Antivirus can run in pa
| [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) | Yes | No | No |
| [Network protection](network-protection.md) | Yes | No | No |
| [Attack surface reduction rules](attack-surface-reduction-rules-overview.md) | Yes | No | No |
-| [File scanning and detection information](review-scan-results-microsoft-defender-antivirus.md) | Yes | Yes
[See note 2](#notes-about-protection-states) | No |
-| [Threat remediation](configure-remediation-microsoft-defender-antivirus.md) | Yes |[See note 3](#notes-about-protection-states) | No |
-| [Security intelligence updates](microsoft-defender-antivirus-updates.md) | Yes | Yes
[See note 4](#notes-about-protection-states) | No |
-| [Data Loss Prevention](/Microsoft-365/compliance/endpoint-dlp-learn-about) | Yes | Yes | No |
-| [Controlled folder access](controlled-folders.md) | Yes |No | No |
-| [Web content filtering](web-content-filtering.md) | Yes | [See note 5](#notes-about-protection-states) | No |
+| [File scanning and detection information](review-scan-results-microsoft-defender-antivirus.md) | Yes | Yes
[See note 2: scan scheduling in passive mode](#notes-about-protection-states) | No |
+| [Threat remediation](configure-remediation-microsoft-defender-antivirus.md) | Yes |[See note 3: threat remediation in passive mode](#notes-about-protection-states) | No |
+| [Security intelligence updates](microsoft-defender-antivirus-updates.md) | Yes | Yes
[See note 4: security intelligence updates in passive mode](#notes-about-protection-states) | No |
+| [Data Loss Prevention](/purview/endpoint-dlp-learn-about) | Yes | Yes | No |
+| [Controlled folder access (CFA)](controlled-folder-access-overview.md) | Yes |No | No |
+| [Web content filtering](web-content-filtering.md) | Yes | [See note 5: web content filtering in passive mode](#notes-about-protection-states) | No |
| [Device control](device-control-report.md) | Yes | Yes | No |
| [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) | Yes | No | No |
@@ -189,20 +191,20 @@ Defender for Endpoint affects whether Microsoft Defender Antivirus can run in pa
1. "Start the scheduled scan only when computer is on but not in use" is set to "Not configured or enabled". A Windows Task Scheduler is created unless you set "Start the scheduled scan only when computer is on but not in use" to disabled.
- 1. "Turn on catch-up quick scan" is set to "Not configured or enabled". Every 30 days (default number of days) a quick catchup scan continues to occur unless "Turn on catch-up quick scan" is set to disabled. Scan tasks that are set up in Windows Task Scheduler continue to run according to their schedule. If you have scheduled tasks, you can remove them, if preferred.
+ 1. "Turn on catch-up quick scan" is set to "enabled". Every 30 days (default number of days) a quick catchup scan continues to occur unless "Turn on catch-up quick scan" is set to disabled. Scan tasks that are set up in Windows Task Scheduler continue to run according to their schedule. If you have scheduled tasks, you can remove them, if preferred.
1. "Turn on scan after security intelligence update" is set to "Not configured or enabled". By default, a quick scan occurs after a "Security Intelligence Update" unless you set "Turn on scan after security intelligence update" to disabled.
-1. When Microsoft Defender Antivirus is in passive mode, it doesn't remediate threats. However, [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md) can remediate threats. In this case, you might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.
+1. When Microsoft Defender Antivirus is in passive mode, it doesn't remediate threats. However, [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md) can remediate threats. When EDR in block mode remediates threats, you might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.
1. The security intelligence update cadence is controlled by Windows Update settings only. Defender-specific update schedulers (daily/weekly at specific time, interval-based) settings only work when Microsoft Defender Antivirus is in active mode. They're ignored in passive mode.
-1. When Microsoft Defender Antivirus is in passive mode, web content filtering only works with the Microsoft Edge browser.
+1. When Microsoft Defender Antivirus is in passive mode, web content filtering only works with the Microsoft Edge browser.
> [!IMPORTANT]
>
-> - [Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about) protection continues to operate normally when Microsoft Defender Antivirus is in either active or passive mode.
-> - Don't disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Defender for Endpoint, or the Windows Security app. This recommendation includes the `wscsvc`, `SecurityHealthService`, `MsSense`, `Sense`, `WinDefend`, or `MsMpEng` services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
+> - [Endpoint data loss prevention](/purview/endpoint-dlp-learn-about) protection continues to operate normally when Microsoft Defender Antivirus is in either active or passive mode.
+> - Don't disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Defender for Endpoint, or the Windows Security app. This recommendation includes the `wscsvc`, `SecurityHealthService`, `MsSense`, `Sense`, `WinDefend`, or `MsMpEng` services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
> - In Defender for Endpoint, you can turn EDR in block mode on, even if Microsoft Defender Antivirus isn't your primary antivirus solution. EDR in block mode detects and remediate malicious items that are found on the device (post breach). To learn more, see [EDR in block mode](edr-in-block-mode.md).
> - In Defender for Endpoint, EDR response actions always operate in passive mode, even if EDR is not in block mode.
@@ -247,10 +249,9 @@ To verify that Microsoft Defender Antivirus is running, check for its process in
### Use Windows PowerShell to confirm that Microsoft Defender Antivirus is running
-> [!IMPORTANT]
-> Use this procedure only to confirm whether Microsoft Defender Antivirus is running on an endpoint.
+Use the following steps only to confirm whether Microsoft Defender Antivirus is running on an endpoint.
-1. On a Windows device, open Windows PowerShell.
+1. On a Windows device, open Windows PowerShell.
1. Run the following PowerShell cmdlet: `Get-Process`.
@@ -258,16 +259,16 @@ To verify that Microsoft Defender Antivirus is running, check for its process in
### Use Windows PowerShell to confirm that antivirus protection is running
-> [!IMPORTANT]
-> Use this procedure only to confirm whether antivirus protection is enabled on an endpoint.
+Use the following steps only to confirm whether antivirus protection is enabled on an endpoint.
1. On a Windows device, open Windows PowerShell.
1. Run following PowerShell cmdlet: `Get-MpComputerStatus | select AMRunningMode`.
-1. Review the results. You should see **Normal**, **Passive**, or **EDR Block Mode** if antivirus protection is enabled on the endpoint.
+1. Review the results. You should see **Normal**, **Passive**, or **EDR Block Mode** if antivirus protection is enabled on the endpoint.
-## More details about Microsoft Defender Antivirus states
+
+## Microsoft Defender Antivirus protection states
Microsoft Defender Antivirus operates in one of three states:
@@ -277,15 +278,15 @@ Microsoft Defender Antivirus operates in one of three states:
### Active mode
-In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. Settings that are configured by using Configuration Manager, Group Policy, Microsoft Intune, or other management products apply. Files are scanned, threats are remediated, and detection information is reported in your configuration tool (such as in the Microsoft Intune admin center or the Microsoft Defender Antivirus app on the endpoint).
+In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. Settings that are configured by using Configuration Manager, Group Policy, Microsoft Intune, or other management products apply. Files are scanned, threats are remediated, and detection information is reported in your configuration tool (such as in the Microsoft Intune admin center or the Microsoft Defender Antivirus app on the endpoint).
### Passive mode or EDR in block mode
-In passive mode, Microsoft Defender Antivirus isn't used as the antivirus app, and threats aren't* remediated by Microsoft Defender Antivirus. However, [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md) can remediate threats. Files are scanned by EDR, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.
+In passive mode, Microsoft Defender Antivirus isn't used as the antivirus app, and threats aren't* remediated by Microsoft Defender Antivirus. However, [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md) can remediate threats. Files are scanned by EDR, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.
When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](microsoft-defender-antivirus-updates.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have a non-Microsoft antivirus product that is providing real-time protection from malware.
-**Make sure to get your antivirus and antimalware updates, even if Microsoft Defender Antivirus is running in passive mode**. See [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md). Passive mode is only supported on Windows Server 2012 R2 & 2016 when the machine is onboarded using the [modern, unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
+**Make sure to get your antivirus and antimalware updates, even if Microsoft Defender Antivirus is running in passive mode**. See [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md). Passive mode is only supported on Windows Server 2012 R2 & 2016 when the machine is onboarded using the [modern, unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
### Disabled or uninstalled
@@ -309,4 +310,4 @@ Microsoft Defender for Endpoint extends antivirus and endpoint protection to mac
- [Microsoft Defender Antivirus on Windows clients](microsoft-defender-antivirus-windows.md)
- [EDR in block mode](edr-in-block-mode.md)
-- [Learn about Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about)
+- [Learn about Endpoint data loss prevention](/purview/endpoint-dlp-learn-about)
diff --git a/defender-endpoint/microsoft-defender-antivirus-exclusions-configure.md b/defender-endpoint/microsoft-defender-antivirus-exclusions-configure.md
new file mode 100644
index 00000000000..e8e4c88ac94
--- /dev/null
+++ b/defender-endpoint/microsoft-defender-antivirus-exclusions-configure.md
@@ -0,0 +1,456 @@
+---
+title: Configure custom exclusions for Microsoft Defender Antivirus
+description: Learn how to exclude specific files, folders, and processes from Microsoft Defender Antivirus scans by using Intune, MDM, Group Policy, PowerShell, or WMI.
+ms.service: defender-endpoint
+ms.localizationpriority: medium
+ms.date: 08/12/2026
+author: chrisda
+ms.author: chrisda
+ms.custom: nextgen, msecd-doc-authoring-1015
+ms.reviewer: ksarens
+ms.subservice: ngp
+ms.audience: ITPro
+ms.topic: how-to
+ms.collection:
+- m365-security
+- tier2
+- mde-ngp
+appliesto:
+ - Microsoft Defender Antivirus
+ai-usage: ai-assisted
+
+#customer intent: As a security administrator, I want to configure custom exclusions for Microsoft Defender Antivirus so that I can prevent specific files, folders, and processes from being scanned when necessary.
+---
+
+# Configure custom exclusions for Microsoft Defender Antivirus
+
+You usually don't need to define exclusions for Microsoft Defender Antivirus. However, you can exclude specific files, folders, and all files opened by a specific process from Microsoft Defender Antivirus scans. These exclusions are known as _custom exclusions_, and they come in the following types:
+
+- [File and folder exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-and-folder-exclusions)
+- [Process exclusions](microsoft-defender-antivirus-exclusions-overview.md#process-exclusions)
+- [Contextual exclusions](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions)
+
+This article describes how to configure custom exclusions for Microsoft Defender Antivirus on Windows.
+
+Custom exclusions apply to [scheduled scans](schedule-antivirus-scans.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Process exclusions are the exception: they apply only to real-time protection and monitoring, not to scheduled or on-demand scans.
+
+Before you define exclusions, review [Exclusions in Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-overview.md) to understand the exclusion types, wildcards, and system environment variables.
+
+For best results, use enterprise-level management solutions like Microsoft Intune or Microsoft Configuration Manager to manage exclusions. Exclusion settings from Intune or Configuration Manager overwrite any conflicting Group Policy or PowerShell settings on startup.
+
+> [!TIP]
+>
+> - For a detailed overview of suppressions, submissions, and exclusions in Microsoft Defender Antivirus and Defender for Endpoint, see [Overview of exclusions and indicators in Microsoft Defender for Endpoint](defender-endpoint-exclusions-overview.md).
+> - The following methods are available to protect exclusions configured on devices:
+> - [Tamper protection for antivirus exclusions](manage-tamper-protection-intune.md#tamper-protection-for-antivirus-exclusions).
+> - [HideExclusionsFromLocalAdmins](/windows/client-management/mdm/defender-csp#configurationhideexclusionsfromlocaladmins):
+> - Doesn't remove existing exclusions from the device.
+> - Exclusions aren't visible in [Get-MpPreference](/powershell/module/defender/get-mppreference) or Registry Editor.
+> - [HideExclusionsFromLocalUsers](/windows/client-management/mdm/defender-csp#configurationhideexclusionsfromlocalusers): Implicitly enabled if HideExclusionsFromLocalAdmins is enabled.
+
+## Prerequisites
+
+### Supported operating systems
+
+- Windows
+
+
+
+
+
+
+
+## Configure Microsoft Defender Antivirus exclusions in Microsoft Intune
+
+> [!IMPORTANT]
+> The procedures in this section require Microsoft Intune. Intune is a separate product that isn't included in all subscriptions. If you don't have Intune, use one of the other methods in this article. For more information, see [Microsoft Intune licensing](/intune/intune-service/fundamentals/licenses).
+
+Microsoft Intune is the recommended tool for configuring and distributing Microsoft Defender Antivirus exclusion policies to devices. Use the Microsoft Defender Antivirus exclusions profile to create or modify exclusion policies.
+
+> [!NOTE]
+> You can define antivirus exclusions in a dedicated **Microsoft Defender Antivirus exclusions** profile (described in this section) or directly in a **Microsoft Defender Antivirus** profile. The exclusion settings are identical in both, and Intune merges the exclusions from all assigned policies into a single superset on each device. Use a dedicated exclusions profile when you want to manage or target exclusions separately from your other antivirus settings. For more information, see [Antivirus policy for endpoint security in Intune](/intune/intune-service/protect/endpoint-security-antivirus-policy#policy-merge-for-settings).
+
+### Configure Microsoft Defender Antivirus exclusions in Intune using endpoint security policies
+
+To create a Microsoft Defender Antivirus exclusions policy in Intune, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When you create the policy, use these settings:
+
+- **Policy type**: Antivirus
+- **Platform**: Windows
+- **Profile**: Microsoft Defender Antivirus exclusions
+- **Configuration settings**: Configure some or all of the following exclusion types:
+ - **Excluded extensions**: Exclusions by file type extension. The exclusion applies to any files with that extension, regardless of location. For more information, see [File extension exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-extension-exclusions).
+ - **Excluded paths**: Also known as _file and folder exclusions_. For more information, see [File and folder exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-and-folder-exclusions).
+
+ Contextual exclusions are also available. For more information, see [Contextual exclusions](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions).
+
+ - **Excluded processes**: Exclusions for files opened by specified processes. The processes themselves aren't excluded. To exclude the processes, use an **Excluded paths** exclusion. For more information, see [Process exclusions](microsoft-defender-antivirus-exclusions-overview.md#process-exclusions).
+
+ Wildcards, including _system_ (not _user_) environment variables are supported in **Excluded paths** and **Excluded processes** values. For more information, see [Wildcards in Microsoft Defender Antivirus exclusions](microsoft-defender-antivirus-exclusions-overview.md#wildcards-in-microsoft-defender-antivirus-exclusions).
+
+ To add exclusions, use either of the following methods:
+
+ - Select **Add**, and then enter the value in the box that appears. Repeat as many times as necessary. To remove an exclusion or an empty box, select the check box next to the entry, and then select **Remove**.
+
+ - Select **Import** to import a CSV file that contains the names of files and folders to exclude. The CSV file uses the following format (the example shows **Excluded extensions**):
+
+ ```text
+ ExcludedExtensions
+ "extension1"
+ "extension2"
+ ...
+ ```
+
+ > [!TIP]
+ > Double quotation marks around the values are optional, and are ignored (aren't used in the values) if you include them. Don't use single quotation marks around the values.
+
+
+
+To change the exclusions in an existing policy later, select the policy on the **Endpoint security \| Antivirus** page in the Microsoft Intune admin center at
+ **Value**: `
+ **Value**: `
+ **Value**: `
`folder`|
+|Scan type restriction|`ScanType`|`quick`
`full`|
+|Scan trigger restriction|`ScanTrigger`|`OnDemand`
`OnAccess`
`BM` (Behavior monitoring)|
+|Process restriction|`Process`|`
user location?|Examples|
+|---|---|:---:|---|
+|`%ALLUSERSPROFILE%`|`C:\ProgramData`|Yes|`%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs`
`%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore`
`%ALLUSERSPROFILE%\Microsoft\Windows\Templates`|
+|`%APPDATA%`|`C:\Windows\System32\config\systemprofile\AppData\Roaming`|No|`%APPDATA%\Microsoft\Windows\Start Menu`
`%APPDATA%\Microsoft\Windows\Start Menu\Programs`|
+|`%CommonProgramFiles%`|`C:\Program Files\Common Files`|Yes||
+|`%CommonProgramFiles(x86)%`|`C:\Program Files (x86)\Common Files`|Yes||
+|`%LOCALAPPDATA%`|`C:\Windows\System32\config\systemprofile\AppData\Local`|No|`%LOCALAPPDATA%\Microsoft\Windows\History`|
+|`%ProgramData%`|`C:\ProgramData`|Yes||
+|`%ProgramFiles%`|`C:\Program Files`|Yes|`%ProgramFiles%\Common Files`|
+|`%ProgramFiles(x86)%`|`C:\Program Files (x86)`|Yes|`%ProgramFiles(x86)%\Common Files`|
+|`%PUBLIC%`|`C:\Users\Public`|Yes|`%PUBLIC%\Desktop`
`%PUBLIC%\Documents`
`%PUBLIC%\Pictures`|
+|`%SystemDrive%`|`C:`|Yes|`%SystemDrive%\Program Files`
`%SystemDrive%\Program Files (x86)`
`%SystemDrive%\Users`|
+|`%SystemRoot%`|`C:\Windows`|Yes||
+|`%TEMP%`|`C:\Windows\TEMP`|No||
+|`%TMP%`|`C:\Windows\TEMP`|No||
+|`%USERPROFILE%`|`C:\Windows\System32\config\systemprofile`|No|`%USERPROFILE%\AppData\Local`
`%USERPROFILE%\AppData\LocalLow`
`%USERPROFILE%\AppData\Roaming`|
+|`%windir%`|`C:\Windows`|Yes|`%windir%\Fonts`
`%windir%\System32`
`%windir%\Resources`|
+
+## See also
+
+- [Exclusions to avoid in Microsoft Defender Antivirus and Defender for Endpoint](defender-endpoint-exclusions-common-mistakes.md)
+- [Configure custom exclusions for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-configure.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
+- [Microsoft Defender Antivirus exclusions on Windows Server](microsoft-defender-antivirus-exclusions-windows-server.md)
diff --git a/defender-endpoint/microsoft-defender-antivirus-exclusions-windows-server.md b/defender-endpoint/microsoft-defender-antivirus-exclusions-windows-server.md
new file mode 100644
index 00000000000..a35e069a05d
--- /dev/null
+++ b/defender-endpoint/microsoft-defender-antivirus-exclusions-windows-server.md
@@ -0,0 +1,384 @@
+---
+title: Microsoft Defender Antivirus exclusions on Windows Server
+ms.reviewer: pahuijbr
+description: Learn which built-in and automatic exclusions Microsoft Defender Antivirus applies on Windows Server by role, and how to add custom exclusions or disable automatic exclusions.
+ms.service: defender-endpoint
+ms.subservice: ngp
+ms.localizationpriority: medium
+ms.date: 08/12/2026
+author: chrisda
+ms.author: chrisda
+ms.topic: install-set-up-deploy
+ai-usage: ai-assisted
+ms.custom: nextgen, msecd-doc-authoring-1015
+ms.collection:
+- m365-security
+- tier2
+- mde-ngp
+appliesto:
+ - Microsoft Defender Antivirus
+
+#customer intent: As a server administrator, I want to understand which exclusions Microsoft Defender Antivirus applies automatically on Windows Server so that I can avoid redundant or conflicting custom exclusions.
+---
+
+# Microsoft Defender Antivirus exclusions on Windows Server
+
+On Windows Server, Microsoft Defender Antivirus applies exclusions automatically so that it doesn't scan files and processes that are critical to installed server roles and the operating system. These predefined exclusions reduce the risk of performance or stability problems without any manual configuration.
+
+Microsoft Defender Antivirus automatically configures the following types of exclusions on Windows Server:
+
+- **Built-in exclusions** for operating system files on all supported versions of Windows.
+- **Automatic exclusions** for server roles on Windows Server 2016 and later.
+
+Built-in and automatic exclusions are delivered and kept up to date through [security intelligence updates](microsoft-defender-antivirus-updates.md#security-intelligence-updates), so they apply without any manual configuration. They don't appear in the standard exclusion lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
+
+Built-in and automatic exclusions are separate from the custom exclusions that you define. [Custom exclusions](microsoft-defender-antivirus-exclusions-configure.md) take precedence: when you set a custom exclusion for a path that duplicates a built-in or automatic exclusion, the custom exclusion always applies.
+
+To learn how the different exclusion types work, see [Exclusions in Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-overview.md).
+
+This article lists the built-in and automatic exclusions that Microsoft Defender Antivirus applies on Windows Server, and explains how to disable automatic exclusions when you need full control.
+
+## Prerequisites
+
+### Supported operating systems
+
+Microsoft Defender Antivirus is built into Windows Server 2016 and later, and Azure Stack HCI OS version 23H2 and later, so the built-in and automatic exclusions in this article apply by default.
+
+On Windows Server 2012 R2, Microsoft Defender Antivirus isn't built in. It's installed when you onboard the server to Microsoft Defender for Endpoint with the [modern unified solution](onboard-server.md), and automatic server role exclusions don't apply.
+
+## Built-in exclusions
+
+Microsoft Defender Antivirus applies built-in exclusions for operating system files on all supported versions of Windows. The exclusions that apply to client and server versions alike (such as Windows Update, Windows Security, and Group Policy files) are listed in [Built-in exclusions](microsoft-defender-antivirus-exclusions-overview.md#built-in-exclusions).
+
+This section lists the built-in exclusions for server features that aren't present on client versions of Windows.
+
+> [!TIP]
+>
+> - The default locations described in this article might be different from the locations on your servers.
+> - The list of built-in exclusions applied by Microsoft Defender Antivirus is updated as the threat landscape changes.
+
+
+
+### Windows Internet Name Service (WINS) exclusions
+
+The following exclusions apply when the Windows Internet Name Service (WINS) server feature is installed:
+
+- `%systemroot%\System32\Wins\*\*.chk`
+- `%systemroot%\System32\Wins\*\*.log`
+- `%systemroot%\System32\Wins\*\*.mdb`
+- `%systemroot%\System32\LogFiles\`
+- `%systemroot%\SysWow64\LogFiles\`
+
+### File Replication Service (FRS) exclusions
+
+The following FRS exclusions are automatically configured:
+
+- **Files in the FRS working folder**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory` specifies the location.
+ - `%windir%\Ntfrs\jet\sys\*\edb.chk`
+ - `%windir%\Ntfrs\jet\*\Ntfrs.jdb`
+ - `%windir%\Ntfrs\jet\log\*\*.log`
+- **FRS Database log files**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Ntfrs\Parameters\DB Log File Directory` specifies the location.
+ - `%windir%\Ntfrs\*\Edb\*.log`
+- **FRS staging folder**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage` specifies the location.
+ - `%systemroot%\Sysvol\*\Ntfrs_cmp*\`
+- **FRS preinstall folder**: The hidden, preinstall folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory` identifies this folder.
+ - `%systemroot%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\*\Ntfrs*\`
+- **Distributed File System Replication (DFSR) database and working folders**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File` specifies the location.
+ - `%systemdrive%\System Volume Information\DFSR\$db_normal$`
+ - `%systemdrive%\System Volume Information\DFSR\FileIDTable_*`
+ - `%systemdrive%\System Volume Information\DFSR\SimilarityTable_*`
+ - `%systemdrive%\System Volume Information\DFSR\*.XML`
+ - `%systemdrive%\System Volume Information\DFSR\$db_dirty$`
+ - `%systemdrive%\System Volume Information\DFSR\$db_clean$`
+ - `%systemdrive%\System Volume Information\DFSR\$db_lostl$`
+ - `%systemdrive%\System Volume Information\DFSR\Dfsr.db`
+ - `%systemdrive%\System Volume Information\DFSR\*.frx`
+ - `%systemdrive%\System Volume Information\DFSR\*.log`
+ - `%systemdrive%\System Volume Information\DFSR\Fsr*.jrs`
+ - `%systemdrive%\System Volume Information\DFSR\Tmp.edb`
+
+ > [!NOTE]
+ > For custom locations, see the [Disable automatic exclusions on Windows Server](#disable-automatic-exclusions-on-windows-server) section.
+
+### Process exclusions for built-in operating system files
+
+- `%systemroot%\System32\dfsr.exe`
+- `%systemroot%\System32\dfsrs.exe`
+
+## Automatic server role exclusions
+
+Automatic server role exclusions add path and process exclusions based on the roles installed on the server.
+
+On Windows Server 2016 and later, you don't need to define exclusions for server roles. When you install a role, Microsoft Defender Antivirus automatically excludes the role's files and processes, including files added during installation.
+
+Automatic server role exclusions aren't supported on Windows Server 2012 R2. When you onboard these servers to Defender for Endpoint, only the [built-in exclusions](#built-in-exclusions) for operating system files apply. To get equivalent coverage, recreate the role exclusions as [custom exclusions](microsoft-defender-antivirus-exclusions-configure.md). For more information, see [Onboard Windows servers to the Microsoft Defender for Endpoint service](onboard-server.md).
+
+> [!NOTE]
+>
+> - Automatic exclusions apply only to [real-time protection (RTP)](configure-protection-features-microsoft-defender-antivirus.md). Other scan activity (for example, [Network Inspection](network-protection.md) and [Behavior Monitoring](behavior-monitor.md)) isn't excluded. To exclude these scan types, use custom exclusions.
+> - Automatic exclusions aren't honored during [quick, full, or custom scans](schedule-antivirus-scans.md#comparing-the-quick-scan-full-scan-and-custom-scan). To exclude files from these scans, use custom exclusions.
+> - Microsoft Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer.
+> - The default locations described in this article might be different from the locations on your servers.
+> - To set exclusions for software that isn't included as a Windows feature or server role, refer to the software documentation.
+
+### Active Directory exclusions
+
+The following exclusions are automatically configured when you install the Active Directory Domain Services (AD DS) role:
+
+- **NTDS database files**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File` specifies the location.
+ - `%windir%\Ntds\ntds.dit`
+ - `%windir%\Ntds\ntds.pat`
+- **AD DS transaction log files**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path` specifies the location.
+ - `%windir%\Ntds\EDB*.log`
+ - `%windir%\Ntds\Res*.log`
+ - `%windir%\Ntds\Edb*.jrs`
+ - `%windir%\Ntds\Ntds*.pat`
+ - `%windir%\Ntds\TEMP.edb`
+- **NTDS working folder**: The registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory` specifies the location.
+ - `%windir%\Ntds\Temp.edb`
+ - `%windir%\Ntds\Edb.chk`
+- **Process exclusions for AD DS and AD DS-related support files**:
+ - `%systemroot%\System32\ntfrs.exe`
+ - `%systemroot%\System32\lsass.exe`
+
+### DHCP Server exclusions
+
+The following exclusions are automatically configured when you install the DHCP Server role:
+
+- `%systemroot%\System32\DHCP\*\*.mdb`
+- `%systemroot%\System32\DHCP\*\*.pat`
+- `%systemroot%\System32\DHCP\*\*.log`
+- `%systemroot%\System32\DHCP\*\*.chk`
+- `%systemroot%\System32\DHCP\*\*.edb`
+
+The following registry keys specify the file locations:
+
+- `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters\DatabasePath`
+- `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters\DhcpLogFilePath`
+- `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters\BackupDatabasePath`
+
+### DNS Server exclusions
+
+The following exclusions are automatically configured when you install the DNS Server role:
+
+- **Files and folders**:
+ - `%systemroot%\System32\Dns\*\*.log`
+ - `%systemroot%\System32\Dns\*\*.dns`
+ - `%systemroot%\System32\Dns\*\*.scc`
+ - `%systemroot%\System32\Dns\*\BOOT`
+- **Processes**:
+ - `%systemroot%\System32\dns.exe`
+
+### File and Storage Services exclusions
+
+The following exclusions are automatically configured when you install the File and Storage Services role:
+
+- `%SystemDrive%\ClusterStorage`
+- `%clusterserviceaccount%\Local Settings\Temp`
+- `%SystemDrive%\mscs`
+
+> [!TIP]
+> The preceding File and Storage Services exclusions don't include exclusions for the Clustering role.
+
+### Hyper-V exclusions
+
+The following exclusions are automatically configured when you install the Hyper-V role:
+
+- **Files**:
+ - `*.avhd`
+ - `*.avhdx`
+ - `*.iso`
+ - `*.rct`
+ - `*.vhd`
+ - `*.vhdx`
+ - `*.vmcx`
+ - `*.vmrs`
+ - `*.vsv`
+- **Folders**:
+ - `%ProgramData%\Microsoft\Windows\Hyper-V`
+ - `%ProgramFiles%\Hyper-V`
+ - `%SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots`
+ - `%Public%\Documents\Hyper-V\Virtual Hard Disks`
+- **Processes**:
+ - `%systemroot%\System32\Vmms.exe`
+ - `%systemroot%\System32\Vmwp.exe`
+
+### Print Server exclusions
+
+The following exclusions are automatically configured when you install the Print Server role:
+
+- **File exclusions**:
+ - `*.shd`
+ - `*.spl`
+- **Folder exclusions**: The registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory` specifies the location.
+ - `%systemroot%\system32\spool\printers\*`
+- **Process exclusions**:
+ - `spoolsv.exe`
+
+
+
+### SYSVOL folder exclusions
+
+The following exclusions are automatically configured for files in the SYSVOL folder:
+
+- `%systemroot%\Sysvol\Domain\*.adm`
+- `%systemroot%\Sysvol\Domain\*.admx`
+- `%systemroot%\Sysvol\Domain\*.adml`
+- `%systemroot%\Sysvol\Domain\Registry.pol`
+- `%systemroot%\Sysvol\Domain\*.aas`
+- `%systemroot%\Sysvol\Domain\*.inf`
+- `%systemroot%\Sysvol\Domain\*Scripts.ini`
+- `%systemroot%\Sysvol\Domain\*.ins`
+- `%systemroot%\Sysvol\Domain\Oscfilter.ini`
+
+
+
+#### Manually exclude files in the Sysvol\Sysvol or SYSVOL_DFSR\Sysvol folder
+
+> [!NOTE]
+> This guidance to manually exclude files and folders under `%SystemRoot%\SYSVOL` (including DFSR-related paths) is relevant only in the following scenarios:
+>
+> - You explicitly disabled automatic exclusions.
+> - You're troubleshooting performance or stability issues and need to temporarily validate antivirus interaction.
+
+The `Sysvol\Sysvol` or `SYSVOL_DFSR\Sysvol` folder and all subfolders is the file system reparse target of the replica set root. By default, these folders use the following locations:
+
+- `%systemroot%\Sysvol\Domain`
+- `%systemroot%\Sysvol_DFSR\Domain`
+
+The NETLOGON share references the currently active `SYSVOL` location. The SysVol value in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netlogon\Parameters` identifies the location. In this location and all subfolders, exclude the following files:
+
+- `*.adm`
+- `*.admx`
+- `*.adml`
+- `Registry.pol`
+- `Registry.tmp`
+- `*.aas`
+- `*.inf`
+- `Scripts.ini`
+- `*.ins`
+- `Oscfilter.ini`
+
+For the steps to add these exclusions, see [Configure custom exclusions for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-configure.md).
+
+To confirm the exclusions are configured after you add them, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**):
+
+```powershell
+$p = Get-MpPreference; 'ExclusionExtension','ExclusionPath','ExclusionProcess' | ForEach-Object { $t = $_; $p.$t | ForEach-Object {[pscustomobject]@{Type=$t; Value=$_}} } | Format-Table -AutoSize
+```
+
+The command uses the [Get-MpPreference](/powershell/module/defender/get-mppreference) cmdlet to display the configured exclusions by type: extension, path, and process.
+
+### Web Server exclusions
+
+The following exclusions are automatically configured when you install the Web Server role:
+
+- **Folder exclusions**:
+ - `%SystemRoot%\IIS Temporary Compressed Files`
+ - `%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files`
+ - `%SystemDrive%\inetpub\temp\ASP Compiled Templates`
+ - `%systemDrive%\inetpub\logs`
+ - `%systemDrive%\inetpub\wwwroot`
+- **Process exclusions**:
+ - `%SystemRoot%\system32\inetsrv\w3wp.exe`
+ - `%SystemRoot%\SysWOW64\inetsrv\w3wp.exe`
+ - `%SystemDrive%\PHP5433\php-cgi.exe`
+
+### Windows Server Update Services exclusions
+
+The following exclusions are automatically configured when you install the Windows Server Update Services (WSUS) role:
+
+- `%systemroot%\WSUS\WSUSContent`
+- `%systemroot%\WSUS\UpdateServicesDBFiles`
+- `%systemroot%\SoftwareDistribution\Datastore`
+- `%systemroot%\SoftwareDistribution\Download`
+
+The registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup` specifies the location.
+
+
+
+## Disable automatic exclusions on Windows Server
+
+Automatic exclusions in Windows Server 2016 or later and Azure Stack HCI OS version 23H2 or later use the default paths for a role or feature only.
+
+You might need to disable automatic exclusions when the default paths don't match your environment. For example, if you moved the NTDS and SYSVOL folders to a custom drive or path, the automatic exclusions no longer cover them. In cases like this, disable the automatic exclusions, review the [Automatic server role exclusions](#automatic-server-role-exclusions) section to identify the exclusions your roles need, and then add the equivalent [custom exclusions](microsoft-defender-antivirus-exclusions-configure.md).
+
+> [!WARNING]
+> Disabling automatic exclusions in Windows Server 2016 or later and Azure Stack HCI OS version 23H2 or later might adversely affect performance or result in data corruption.
+
+The following subsections describe how to disable the automatic exclusions.
+
+
+
+### Disable automatic exclusions in Group Policy
+
+To disable the automatic exclusions list by using Group Policy, follow these steps:
+
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
+
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
+
+1. Right-click the GPO, and then select **Edit**.
+
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Exclusions**.
+
+ > [!NOTE]
+ > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Antivirus instead of _Microsoft_ Defender Antivirus. Both names refer to the same policy location.
+
+1. In the details pane of **Exclusions**, open the **Turn off Auto Exclusions** setting. To open the setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
+
+1. In the setting window that opens, select **Enabled**, and then select **OK**.
+
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Exclusions**.
+
+
+
+### Disable automatic exclusions in PowerShell
+
+To disable automatic exclusions by using PowerShell, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**):
+
+```powershell
+Set-MpPreference -DisableAutoExclusions $true
+```
+
+For more information, see the following articles:
+
+- [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md).
+- [Set-MpPreference](/powershell/module/defender/set-mppreference).
+
+
+
+### Disable automatic exclusions in WMI
+
+Use Windows Management Instrumentation (WMI) to disable automatic exclusions by calling the **Set** method of the [MSFT_MpPreference](/previous-versions/windows/desktop/defender/msft-mppreference) class to configure the `DisableAutoExclusions` property.
+
+For more information and allowed parameters, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)
+
+## Microsoft Defender Antivirus exclusions on Exchange servers
+
+Microsoft Exchange Server 2016 or later supports integration with the Antimalware Scan Interface (AMSI). For more information, see [Exchange Server AMSI integration](/exchange/antispam-and-antimalware/amsi-integration-with-exchange).
+
+Many organizations exclude Exchange Server folders from antivirus scans for performance reasons. Microsoft recommends auditing Microsoft Defender Antivirus exclusions on Exchange servers and assessing whether you can remove exclusions without affecting performance. To add, change, or remove exclusions, see [Configure custom exclusions for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-configure.md).
+
+To list the [extension exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-extension-exclusions), [file and folder exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-and-folder-exclusions), and [process exclusions](microsoft-defender-antivirus-exclusions-overview.md#process-exclusions) currently configured on an Exchange Server, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**):
+
+```powershell
+$p = Get-MpPreference; 'ExclusionExtension','ExclusionPath','ExclusionProcess' | ForEach-Object { $t = $_; $p.$t | ForEach-Object {[pscustomobject]@{Type=$t; Value=$_}} } | Format-Table -AutoSize
+```
+
+Custom exclusions are honored during all scan types. Automatic exclusions apply only to real-time protection and are ignored during quick, full, and custom scans, so a quick scan still scans the Exchange directories covered by automatic exclusions.
+
+
+
+## Related content
+
+- [Configure custom exclusions for Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-configure.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
+- [Exclusions to avoid in Microsoft Defender Antivirus and Defender for Endpoint](defender-endpoint-exclusions-common-mistakes.md)
+- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
+- [Onboard client devices running Windows or macOS to Microsoft Defender for Endpoint](onboard-client.md)
+- [Onboard servers through Microsoft Defender for Endpoint's onboarding experience](onboard-server.md)
diff --git a/defender-endpoint/microsoft-defender-antivirus-on-windows-server.md b/defender-endpoint/microsoft-defender-antivirus-on-windows-server.md
deleted file mode 100644
index 8b52b431d42..00000000000
--- a/defender-endpoint/microsoft-defender-antivirus-on-windows-server.md
+++ /dev/null
@@ -1,148 +0,0 @@
----
-title: Microsoft Defender Antivirus on Windows Server
-description: Learn how to enable and configure Microsoft Defender Antivirus on Windows Server 2016 and later as well as 5Azure Stack HCI OS version 23H2 and later.
-ms.service: defender-endpoint
-ms.subservice: ngp
-ms.localizationpriority: medium
-author: chrisda
-ms.author: chrisda
-ms.reviewer: pahuijbr
-ms.topic: how-to
-ms.date: 10/20/2025
-ms.collection:
-- m365-security
-- tier2
-- m365initiative-defender-endpoint
-- mde-ngp
-appliesto:
- - Microsoft Defender for Endpoint Plan 1
- - Microsoft Defender for Endpoint Plan 2
- - Microsoft Defender Antivirus
-
----
-# Microsoft Defender Antivirus on Windows Server
-
-
-## Overview
-
-By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2016 and later. For Windows Server 2012 R2, Microsoft Defender Antivirus is installed when the device is onboarded to Defender for Endpoint using the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
-
-This article describes how to enable the user interface, install or reinstall Microsoft Defender Antivirus, verify that Microsoft Defender Antivirus is running, and update your antimalware security intelligence. This article also describes how to set Microsoft Defender Antivirus to passive mode if you're using a non-Microsoft antivirus/anti-malware solution on Windows Server.
-
-## Prerequisites
-
-### Supported operating systems
-
-- Windows server 2016 and later
-- Windows Server, version 1803 or later
-- Windows Server 2012 R2 (Requires Microsoft Defender for Endpoint)
-- Azure Stack HCI OS version 23H2 and later
-
-## Enable the user interface on Windows Server
-
-On Windows Server, the Microsoft Defender Antivirus user interface (GUI) is installed by default, and other times it has to be enabled. The GUI isn't required; you can use PowerShell, Group Policy, or other methods to manage Microsoft Defender Antivirus. If your organization prefers to use the GUI, use one of the procedures in the following table to enable it:
-
-| Procedure | What to do |
-|:---|:---|
-| Turn on the GUI using the Add Roles and Features Wizard | 1. See [Install roles, role services, and features by using the add Roles and Features Wizard](/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard), and use the **Add Roles and Features Wizard**.
2. When you get to the **Features** step of the wizard, under **Windows Defender Features**, select the **GUI for Windows Defender** option. |
-| Turn on the GUI using PowerShell (Windows Server 2016 only)| 1. On Windows Server 2016, open Windows PowerShell as an administrator.
2. Run the following PowerShell cmdlet: `Install-WindowsFeature -Name Windows-Defender-GUI` |
-
-> [!IMPORTANT]
-> If you're using Windows Server 2012 R2, see [Onboard Windows Server 2016 and Windows Server 2012 R2](onboard-server.md#onboard-windows-server-2016-and-windows-server-2012-r2).
-
-## Install Microsoft Defender Antivirus on Windows Server
-
-If you need to install or reinstall Microsoft Defender Antivirus on Windows Server, use one of the procedures in the following table:
-
-| Procedure | What to do |
-|:---|:---|
-| Use the Add Roles and Features Wizard | 1. See [Install or Uninstall Roles, Role Services, or Features](/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard), and use the **Add Roles and Features Wizard**.
2. When you get to the **Features** step of the wizard, select the Microsoft Defender Antivirus option. Also select the **GUI for Windows Defender** option. |
-| Use PowerShell to install Microsoft Defender Antivirus | 1. On your Windows Server, open Windows PowerShell as an administrator.
2. Run the following PowerShell cmdlet: `Install-WindowsFeature -Name Windows-Defender` |
-
-> [!NOTE]
-> Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Microsoft Defender Antivirus Events](troubleshoot-microsoft-defender-antivirus.yml).
-
-## Verify Microsoft Defender Antivirus is running
-
-After you've installed (or reinstalled) Microsoft Defender Antivirus, your next step is to verify that it's running. You can use either PowerShell or Command Prompt.
-
-- PowerShell: `Get-Service -Name windefend`
-- Command Prompt: `sc query Windefend`
-
-To verify that firewall protection is turned on using PowerShell, run the following command: `Get-Service -Name mpssvc`.
-
-To view verify the state of all services using Command Prompt, run the following command: `sc query state= all`.
-
-> [!IMPORTANT]
-> Beginning with [platform version 4.18.2208.0 and later](msda-updates-previous-versions-technical-upgrade-support.md#september-2022-platform-41822097--engine-11197003), if a server is onboarded to Defender for Endpoint, the "Turn off Windows Defender" setting in [Group Policy](configure-endpoints-gp.md#update-endpoint-protection-configuration) no longer completely disables Windows Defender Antivirus on Windows Server 2012 R2 and later. Instead, it places Microsoft Defender Antivirus into passive mode. In addition, the [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) feature allows Microsoft Defender Antivirus to switch to active mode but not to passive mode.
->
-> If "Turn off Windows Defender" is already set before onboarding the device to Defender for Endpoint, there's no change and Microsoft Defender Antivirus remains disabled.
->
-> To switch Microsoft Defender Antivirus to passive mode, even if it was disabled before onboarding, you can apply the [ForceDefenderPassiveMode configuration](switch-to-mde-phase-2.md#manually-set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) with a value of `1`. To place it into active mode, switch this value to `0` instead.
->
-> Note the modified logic for `ForceDefenderPassiveMode` when tamper protection is enabled: Once Microsoft Defender Antivirus is toggled to active mode, tamper protection will prevents Microsoft Defender Antivirus from going into passive mode, even if `ForceDefenderPassiveMode` is set to `1`.
-
-## Update antimalware security intelligence
-
-To get your regular security intelligence updates, the Windows Update service must be running. If you use an update management service, like Windows Server Update Services (WSUS), make sure Microsoft Defender Antivirus Security intelligence updates are approved for the computers you manage.
-
-By default, Windows Update doesn't download and install updates automatically on Windows Server 2016 and later, and Azure Stack HCI OS version 23H2 and later. You can change this configuration by using one of the following methods:
-
-| Method | Description |
-|---|---|
-| **Windows Update** in Control Panel | **Install updates automatically** results in all updates being automatically installed, including Windows Defender Security intelligence updates.
**Download updates but let me choose whether to install them** allows Windows Defender to download and install Security intelligence updates automatically, but other updates aren't automatically installed. |
-| **Group Policy** | You can set up and manage Windows Update by using the settings available in Group Policy, in the following path: **Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates** |
-| The **AUOptions** registry key | The following two values allow Windows Update to automatically download and install Security intelligence updates:
**4** - **Install updates automatically**. This value results in all updates being automatically installed, including Windows Defender Security intelligence updates.
**3** - **Download updates but let me choose whether to install them**. This value allows Windows Defender to download and install Security intelligence updates automatically, but other updates aren't automatically installed. |
-
-To ensure that protection from malware is maintained, enable the following services:
-
-- Windows Error Reporting service
-- Windows Update service
-
-The following table lists the services for Microsoft Defender Antivirus and the dependent services.
-
-| Service Name | File Location | Description |
-|---|---|---|
-| Windows Defender Service (`WinDefend`) | `C:\Program Files\Windows Defender\MsMpEng.exe` | This service is the main Microsoft Defender Antivirus service that needs to be running always.|
-| Windows Error Reporting Service (`Wersvc`) | `C:\WINDOWS\System32\svchost.exe -k WerSvcGroup` | This service sends error reports back to Microsoft. |
-| Windows Firewall (`MpsSvc`) | `C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork` | We recommend keeping the Windows Firewall service enabled. |
-| Windows Update (`Wuauserv`) | `C:\WINDOWS\system32\svchost.exe -k netsvcs`| Windows Update is needed to get Security intelligence updates and antimalware engine updates |
-
-## Additional settings to consider
-
-- [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md)
-- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md)
-- [Learn more about Windows Server and passive mode](microsoft-defender-antivirus-compatibility.md#windows-server-and-passive-mode)
-
-## What happens if a non-Microsoft antivirus product is uninstalled?
-
-If a non-Microsoft antivirus product was installed on Windows Server, Microsoft Defender Antivirus was probably set to passive mode. When the non-Microsoft antivirus product is uninstalled, Microsoft Defender Antivirus should switch to active mode automatically. However, that might not occur on certain versions of Windows Server, such as Windows Server 2016. Use the following procedure to check the status of Microsoft Defender Antivirus, and if necessary, set it to active mode:
-
-1. Check the status of Microsoft Defender Antivirus by following the guidance in [Verify Microsoft Defender Antivirus is running](#verify-microsoft-defender-antivirus-is-running) (in this article).
-
-1. If necessary, set Microsoft Defender Antivirus to active mode manually by following these steps:
-
- a. On your Windows Server device, open Registry Editor as an administrator.
-
- a. Go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`.
-
- a. Set or define a `REG_DWORD` entry called `ForceDefenderPassiveMode`, and set its value to `0`.
-
- a. Reboot the device.
-
-> [!TIP]
-> If you still need help, see the following troubleshooting items:
->
-> - [Microsoft Defender Antivirus seems to be stuck in passive mode](switch-to-mde-troubleshooting.md#microsoft-defender-antivirus-seems-to-be-stuck-in-passive-mode).
-> - [I'm having trouble re-enabling Microsoft Defender Antivirus on Windows Server 2016](switch-to-mde-troubleshooting.md#im-having-trouble-re-enabling-microsoft-defender-antivirus-on-windows-server-2016).
-
-## See also
-
-- [Microsoft Defender Antivirus in Windows](microsoft-defender-antivirus-windows.md)
-- [Microsoft Defender Antivirus compatibility with other security products](microsoft-defender-antivirus-compatibility.md)
-- [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
-- [Troubleshoot performance issues related to real-time protection](troubleshoot-performance-issues.md)
-- [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
-
-
-
diff --git a/defender-endpoint/microsoft-defender-antivirus-updates.md b/defender-endpoint/microsoft-defender-antivirus-updates.md
index 5a8e7cee00b..128f1961537 100644
--- a/defender-endpoint/microsoft-defender-antivirus-updates.md
+++ b/defender-endpoint/microsoft-defender-antivirus-updates.md
@@ -52,7 +52,7 @@ For more information, see [Manage the sources for Microsoft Defender Antivirus p
- Monthly updates are released in phases, resulting in multiple packages visible in your [Windows Server Update Services](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus).
-- The following section lists changes included in the broad release channel. See the [latest broad channel release](https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info).
+- The following section lists changes included in the broad release channel. See the [latest broad channel release](https://definitionupdates.microsoft.com/packages?action=info).
- To learn more about the gradual rollout process, and to see more information about the next release, see [Manage the gradual rollout process for Microsoft Defender updates](manage-gradual-rollout.md).
@@ -60,9 +60,9 @@ For more information, see [Manage the sources for Microsoft Defender Antivirus p
- If you're looking for a list of Microsoft Defender processes, see the spreadsheet provided at [Enable access to Microsoft Defender for Endpoint service URLs in the proxy server](configure-environment.md#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). The sheet also lists the services and their associated URLs that your network must be able to connect to.
-- Platform updates can be temporarily postponed if other protection features, such as [Endpoint DLP](/Microsoft-365/compliance/endpoint-dlp-getting-started) or [Device Control](device-control-report.md), are actively monitoring running processes. Platform updates are retried after a reboot or when all monitored services are stopped.
+- Platform updates can be temporarily postponed if other protection features, such as [Endpoint DLP](/purview/endpoint-dlp-getting-started) or [Device Control](device-control-report.md), are actively monitoring running processes. Platform updates are retried after a reboot or when all monitored services are stopped.
-- In the **Microsoft Configuration Manager / Windows Server Update Services** (ConfigMgr/WSUS) catalog, the category **Microsoft Defender for Endpoint** includes updates for the `MSSense` service in [KB5005292](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5005292). KB5005292 includes updates and fixes to the Microsoft Defender for Endpoint **endpoint detection and response** (EDR) sensor. For more information, see [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac) and [What's new in Microsoft Defender for Endpoint on Windows](microsoft-defender-endpoint-releases.md#windows-releases).
+- In the **Microsoft Configuration Manager / Windows Server Update Services** (ConfigMgr/WSUS) catalog, the category **Microsoft Defender for Endpoint** includes updates for the `MSSense` service in [KB5005292](https://www.catalog.update.microsoft.com/Search.aspx?q=KB5005292). KB5005292 includes updates and fixes to the Microsoft Defender for Endpoint **endpoint detection and response** (EDR) sensor. For more information, see [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/servicing/management-tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor) and [What's new in Microsoft Defender for Endpoint on Windows](microsoft-defender-endpoint-releases.md#windows-releases).
### Previous version updates: Technical upgrade support only
@@ -151,7 +151,7 @@ The table provides the Microsoft Defender Antivirus platform and engine versions
|1703 (RS2)|`4.11.15603.2`|`1.1.13504.0`|Technical upgrade support (only)|
|1607 (RS1)|`4.10.14393.3683`|`1.1.12805.0`|Technical upgrade support (only)|
-For Windows 10 release information, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet).
+For Windows 10 release information, see the [Windows lifecycle fact sheet](/lifecycle/faq/windows).
> [!NOTE]
> - Windows Server 2016 ships with the same platform version as RS1 and falls under the same support phase: Technical upgrade support (only).
@@ -168,7 +168,7 @@ To avoid a gap in protection, keep your OS installation images up to date with t
Updates are released for x86, x64, and Arm64 Windows architecture.
-For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images).
+For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-update-for-windows-operating-system-installation-images).
After a new package version is released, support for the previous two versions is reduced to technical support only. To view a list of previous versions, see [Previous DISM updates](msda-updates-previous-versions-technical-upgrade-support.md#previous-dism-updates-no-longer-supported).
@@ -221,13 +221,13 @@ After a new package version is released, support for the previous two versions i
| Article | Description |
|:---|:---|
-|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review anti-malware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, Windows Server 2022, Windows Server 2016, and Windows Server 2012 R2 installation images. |
+|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-update-for-windows-operating-system-installation-images) | Review anti-malware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, Windows Server 2022, Windows Server 2016, and Windows Server 2012 R2 installation images. |
|[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through many sources. |
|[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. |
|[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. |
|[Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | You can set protection updates to be downloaded at startup or after certain cloud-delivered protection events. |
|[Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)| You can specify settings, such as whether updates should occur on battery power that's especially useful for mobile devices and virtual machines. |
-| [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac) | You can update the EDR sensor (MsSense.exe) that's included in the new Microsoft Defender for Endpoint unified solution package released in 2021.|
+| [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor) | You can update the EDR sensor (MsSense.exe) that's included in the new Microsoft Defender for Endpoint unified solution package released in 2021.|
> [!TIP]
> If you're looking for Antivirus related information for other platforms, see:
diff --git a/defender-endpoint/microsoft-defender-antivirus-using-powershell.md b/defender-endpoint/microsoft-defender-antivirus-using-powershell.md
index cb8dfc954a1..afebd7c6dc5 100644
--- a/defender-endpoint/microsoft-defender-antivirus-using-powershell.md
+++ b/defender-endpoint/microsoft-defender-antivirus-using-powershell.md
@@ -6,8 +6,8 @@ ms.localizationpriority: medium
ms.topic: how-to
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: yongrhee
ms.subservice: ngp
ms.collection:
@@ -25,7 +25,7 @@ ai-usage: ai-assisted
In Windows 10 or later and Windows Server 2016 or later, you can use the next-generation protection features in Microsoft Defender Antivirus with exploit protection.
-This article explains how to enable and test the key protection features in Microsoft Defender Antivirus with exploit protection.
+The following sections explain how to enable and test the key protection features in Microsoft Defender Antivirus with exploit protection.
We recommend you use our [evaluation PowerShell script](https://aka.ms/wdeppscript) to configure these features, but you can individually enable each feature as described in this article.
@@ -33,7 +33,7 @@ For more information about our endpoint protection products and services, see th
- [Next-generation protection overview](next-generation-protection.md)
- [Microsoft Defender Antivirus in Windows](microsoft-defender-antivirus-windows.md)
-- [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-on-windows-server.md)
+- [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-windows-server-configure.md)
- [Protect devices from exploits](exploit-protection.md)
If you have any questions about a detection by Microsoft Defender Antivirus, or you discover a missed detection, you can submit the file to us. For more information, see [Submit files for analysis](/unified-secops/submission-guide).
@@ -53,7 +53,8 @@ Microsoft Defender Antivirus uses [standard Windows notifications](configure-not
The Windows Event Log also records detection and engine events. For more information, see [Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.yml).
-## Cloud protection features
+
+## Use PowerShell to configure cloud protection features
Standard definition updates can take hours to prepare and deliver. Our cloud-delivered protection service can deliver updated malware protection in seconds. For more information, see [Cloud protection and Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md).
@@ -93,9 +94,10 @@ Standard definition updates can take hours to prepare and deliver. Our cloud-del
Set-MpPreference -CloudExtendedTimeout 50
```
-## Always-on protection (real-time scanning)
+
+## Use PowerShell to enable always-on protection (real-time scanning)
-Microsoft Defender Antivirus scans files as Windows sees them, and monitors running processes for malicious behavior (known or suspected). If the antivirus engine discovers malicious activity, the engine immediately blocks the process or file from running. For more information on these options, see [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md).
+Microsoft Defender Antivirus scans files as Windows sees them, and monitors running processes for malicious behavior (known or suspected). If the antivirus engine discovers malicious activity, the engine immediately blocks the process or file from running. For more information on behavioral, heuristic, and real-time protection options, see [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md).
- **Constantly monitor files and processes for known malware activity**:
@@ -121,7 +123,8 @@ Microsoft Defender Antivirus scans files as Windows sees them, and monitors runn
Set-MpPreference -DisableRemovableDriveScanning 0
```
-## Potentially unwanted application protection
+
+## Use PowerShell to enable potentially unwanted application protection
[Potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) are files and apps that aren't traditionally classified as malicious. These types of apps include:
@@ -135,7 +138,8 @@ Microsoft Defender Antivirus scans files as Windows sees them, and monitors runn
Set-MpPreference -PUAProtection Enabled
```
-## Email and archive scanning
+
+## Use PowerShell to configure email and archive scanning
You can set Microsoft Defender Antivirus to automatically scan certain types of email files and archive files (such as .zip files) when Windows see them. For more information, see [Managed email scans in Microsoft Defender](configure-advanced-scan-types-microsoft-defender-antivirus.md).
@@ -163,11 +167,12 @@ Typically, you get Microsoft Defender Antivirus updates from Windows update once
-## Advanced threat mitigation and prevention
+
+## Use PowerShell to configure advanced threat mitigation features
-Exploit protection provides features that help protect devices from known malicious behaviors and attacks on vulnerable technologies. Controlled folder access protects sensitive data in specific folders by preventing untrusted apps from writing to those locations.
+Exploit protection provides features that help protect devices from known malicious behaviors and attacks on vulnerable technologies. Controlled folder access (CFA) protects sensitive data in specific folders by preventing untrusted apps from writing to those locations.
-- **Prevent malicious and suspicious apps (such as ransomware) from making changes to protected folders with [controlled folders](controlled-folders.md)**:
+- **Prevent malicious and suspicious apps (such as ransomware) from making changes to protected folders with [controlled folder access (CFA)](controlled-folder-access-overview.md)**:
```powershell
Set-MpPreference -EnableControlledFolderAccess Enabled
@@ -204,7 +209,7 @@ Tamper protection prevents unauthorized changes to your security settings. For m
#### Check the Cloud Protection network connectivity
-It's important to verify that Cloud Protection network connectivity is working during your penetration testing by doing the following steps:
+Cloud Protection is the cloud-delivered protection service in Microsoft Defender Antivirus. It's important to verify that Cloud Protection network connectivity is working during your penetration testing by doing the following steps:
In an elevated Command Prompt (a Command Prompt window you opened by selecting **Run as administrator**), run the following commands:
diff --git a/defender-endpoint/microsoft-defender-antivirus-windows-server-configure.md b/defender-endpoint/microsoft-defender-antivirus-windows-server-configure.md
new file mode 100644
index 00000000000..debebf173bc
--- /dev/null
+++ b/defender-endpoint/microsoft-defender-antivirus-windows-server-configure.md
@@ -0,0 +1,177 @@
+---
+title: Configure Microsoft Defender Antivirus on Windows Server
+description: Learn how to enable and configure Microsoft Defender Antivirus on Windows Server 2016 and later as well as Azure Stack HCI OS version 23H2 and later.
+ms.service: defender-endpoint
+ms.subservice: ngp
+ms.localizationpriority: medium
+author: chrisda
+ms.author: chrisda
+ms.reviewer: pahuijbr
+ms.topic: how-to
+ms.date: 06/25/2026
+ms.custom: msecd-doc-authoring-1015
+ai-usage: ai-assisted
+ms.collection:
+- m365-security
+- tier2
+- m365initiative-defender-endpoint
+- mde-ngp
+appliesto:
+ - Microsoft Defender Antivirus
+
+#customer intent: As a server administrator, I want to enable and configure Microsoft Defender Antivirus on Windows Server so that my servers stay protected.
+---
+
+# Configure Microsoft Defender Antivirus on Windows Server
+
+
+
+By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2016 and later. For Windows Server 2012 R2, Microsoft Defender Antivirus is installed only after the device is onboarded to Microsoft Defender for Endpoint by using the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2).
+
+Use the procedures in this article to enable the user interface, install or reinstall Microsoft Defender Antivirus, verify that Microsoft Defender Antivirus is running, and update your antimalware security intelligence. You can also set Microsoft Defender Antivirus to passive mode if you use a non-Microsoft antivirus solution on Windows Server.
+
+## Prerequisites
+
+### Supported operating systems
+
+- Windows Server 2016 and later
+- Windows Server 2012 R2 (Requires Microsoft Defender for Endpoint)
+- Azure Stack HCI OS version 23H2 and later
+
+
+
+## Enable the Microsoft Defender Antivirus user interface on Windows Server 2016
+
+The user interface isn't required; you can use PowerShell, Group Policy, or other methods to manage Microsoft Defender Antivirus. On Windows Server 2016, if your organization prefers to use the user interface, use one of the following procedures to add it. The user interface requires the Desktop Experience installation option; it isn't available on Server Core.
+
+> [!NOTE]
+> On Windows Server 2019 and later with the Desktop Experience installation option, the Windows Security app is part of the operating system and isn't installed as a separate feature that you can turn on or turn off.
+
+### Turn on the user interface by using PowerShell
+
+To install the Microsoft Defender Antivirus user interface on Windows Server 2016, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**):
+
+```powershell
+Install-WindowsFeature -Name Windows-Defender-GUI
+```
+
+### Turn on the user interface by using the Add Roles and Features Wizard
+
+On Windows Server 2016, you can install the user interface by using the Add Roles and Features Wizard as described in [Add roles and features to Windows Server](/windows-server/administration/server-manager/add-remove-roles-features?tabs=gui#add-roles-and-features-to-windows-server).
+
+On the **Features** step (Step 7), expand **Windows Defender Features** and then select **GUI for Windows Defender**.
+
+## Install Microsoft Defender Antivirus on Windows Server
+
+Microsoft Defender Antivirus is installed and enabled by default on Windows Server 2016 and later. If you need to reinstall it, use one of the following procedures.
+
+### Use PowerShell to install Microsoft Defender Antivirus
+
+To install or reinstall Microsoft Defender Antivirus on Windows Server 2016 and later, run the following command in an elevated PowerShell session:
+
+```powershell
+Install-WindowsFeature -Name Windows-Defender
+```
+
+### Use the Add Roles and Features Wizard to install Microsoft Defender Antivirus on Windows Server 2016
+
+On Windows Server 2016, you can install Microsoft Defender Antivirus by using the Add Roles and Features Wizard as described in [Add roles and features to Windows Server](/windows-server/administration/server-manager/add-remove-roles-features?tabs=gui#add-roles-and-features-to-windows-server).
+
+On the **Features** step (Step 7), expand **Windows Defender Features** and then select **Windows Defender**.
+
+As described in [Enable the Microsoft Defender Antivirus user interface on Windows Server 2016](#enable-the-microsoft-defender-antivirus-user-interface-on-windows-server-2016), you can also select **GUI for Windows Defender** to install the user interface.
+
+## Verify Microsoft Defender Antivirus is running
+
+After you install Microsoft Defender Antivirus, verify that it's running. You can use either PowerShell or Command Prompt.
+
+- **PowerShell**: Run the following command:
+
+ ```powershell
+ Get-Service -Name windefend
+ ```
+
+- **Command Prompt**: Run the following command:
+
+ ```cmd
+ sc query Windefend
+ ```
+
+> [!NOTE]
+> Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Microsoft Defender Antivirus Events](troubleshoot-microsoft-defender-antivirus.yml).
+
+## Update antimalware security intelligence
+
+To get your regular security intelligence updates on Windows Server, the Windows Update service must be running. If you use an update management service, like Windows Server Update Services (WSUS), make sure Microsoft Defender Antivirus security intelligence updates are approved for the computers you manage.
+
+By default, Windows Update doesn't download and install updates automatically on Windows Server 2016 and later, or on Azure Stack HCI OS version 23H2 and later. On Windows Server, you can change this configuration by using one of the following methods:
+
+- **Windows Update in Control Panel**:
+ - **Install updates automatically** installs all updates automatically, including Microsoft Defender Antivirus security intelligence updates.
+ - **Download updates but let me choose whether to install them** lets Microsoft Defender Antivirus download and install security intelligence updates automatically, but other updates aren't installed automatically.
+
+- **Group Policy**: Enable the **Configure Automatic Updates** policy at **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates**, and then select one of the following options:
+ - **4 - Auto download and schedule the install** installs all updates automatically, including Microsoft Defender Antivirus security intelligence updates.
+ - **3 - Auto download and notify for install** lets Microsoft Defender Antivirus download and install security intelligence updates automatically, but other updates aren't installed automatically.
+
+- **The registry**: Set the `AUOptions` value under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU` to one of the following `REG_DWORD` values to let Windows Update automatically download and install security intelligence updates:
+ - **4** (**Install updates automatically**) installs all updates automatically, including Microsoft Defender Antivirus security intelligence updates.
+ - **3** (**Download updates but let me choose whether to install them**) lets Microsoft Defender Antivirus download and install security intelligence updates automatically, but other updates aren't installed automatically.
+
+To maintain protection from malware, keep the following Microsoft Defender Antivirus services and dependent services running. If any of these services are stopped, start them and set them to start automatically.
+
+- **Windows Defender Service** (`WinDefend`): The main Microsoft Defender Antivirus service, which must always be running. Located at `C:\Program Files\Windows Defender\MsMpEng.exe`.
+- **Windows Error Reporting Service** (`Wersvc`): Sends error reports back to Microsoft. Hosted by `svchost.exe -k WerSvcGroup`.
+- **Windows Firewall** (`MpsSvc`): We recommend keeping this service enabled. Hosted by `svchost.exe -k LocalServiceNoNetwork`.
+- **Windows Update** (`Wuauserv`): Required to get security intelligence updates and antimalware engine updates. Hosted by `svchost.exe -k netsvcs`.
+
+## Microsoft Defender Antivirus modes on Windows Server
+
+On Windows Server, Microsoft Defender Antivirus can run in active mode or passive mode, and its behavior depends on whether the server is onboarded to Defender for Endpoint.
+
+In platform version 4.18.2208.0 (September 2022) or later, if a server is onboarded to Defender for Endpoint, the **Turn off Windows Defender** setting in [Group Policy](configure-endpoints-gp.md#update-endpoint-protection-configuration) no longer completely disables Microsoft Defender Antivirus on Windows Server 2012 R2 and later. Instead, it places Microsoft Defender Antivirus into passive mode.
+
+If **Turn off Windows Defender** is already set before you onboard the device to Defender for Endpoint, there's no change and Microsoft Defender Antivirus remains disabled.
+
+To switch Microsoft Defender Antivirus to passive mode, even if it was disabled before onboarding, apply the [ForceDefenderPassiveMode configuration](switch-to-mde-phase-2.md#manually-set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) with a value of `1`. To place it into active mode, set this value to `0` instead.
+
+> [!IMPORTANT]
+> When tamper protection is enabled, the logic for `ForceDefenderPassiveMode` changes. After Microsoft Defender Antivirus is toggled to active mode, [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) prevents it from going into passive mode, even if `ForceDefenderPassiveMode` is set to `1`.
+
+
+
+## Reactivate Microsoft Defender Antivirus after uninstalling a non-Microsoft product
+
+If a non-Microsoft antivirus product is installed on Windows Server, Microsoft Defender Antivirus is probably set to passive mode. When the non-Microsoft antivirus product is uninstalled, Microsoft Defender Antivirus should switch to active mode automatically. However, that switch might not occur on certain versions of Windows Server, such as Windows Server 2016, where Microsoft Defender Antivirus can remain in passive mode or stay disabled. Use the following procedure to check the status of Microsoft Defender Antivirus, and if necessary, set it to active mode:
+
+1. Check the status of Microsoft Defender Antivirus by following the guidance in [Verify Microsoft Defender Antivirus is running](#verify-microsoft-defender-antivirus-is-running) (in this article).
+
+1. If necessary, set Microsoft Defender Antivirus to active mode manually by following these steps:
+ 1. On the server, open Notepad and copy the following text:
+
+ ```text
+ Windows Registry Editor Version 5.00
+
+ [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection]
+ "ForceDefenderPassiveMode"=dword:00000000
+ ```
+
+ 1. Save the file with a `.reg` extension in a location that's easy to find, such as `C:\Data\ForceDefenderActiveMode.reg`.
+ 1. In File Explorer, right-click the `.reg` file, select **Merge**, and then confirm the prompt to add the entry to the registry. You need administrator permissions to make this change.
+ 1. Restart the server.
+
+> [!TIP]
+> If you still need help, see the following troubleshooting items:
+>
+> - [Microsoft Defender Antivirus seems to be stuck in passive mode](switch-to-mde-troubleshooting.md#microsoft-defender-antivirus-seems-to-be-stuck-in-passive-mode).
+> - [I'm having trouble re-enabling Microsoft Defender Antivirus on Windows Server 2016](switch-to-mde-troubleshooting.md#im-having-trouble-re-enabling-microsoft-defender-antivirus-on-windows-server-2016).
+
+## See also
+
+- [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md)
+- [Configure Microsoft Defender Antivirus exclusions on Windows Server](microsoft-defender-antivirus-exclusions-windows-server.md)
+- [Microsoft Defender Antivirus in Windows](microsoft-defender-antivirus-windows.md)
+- [Microsoft Defender Antivirus compatibility with other security products](microsoft-defender-antivirus-compatibility.md)
+- [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
+- [Troubleshoot performance issues related to real-time protection](troubleshoot-performance-issues.md)
+- [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
diff --git a/defender-endpoint/microsoft-defender-antivirus-windows.md b/defender-endpoint/microsoft-defender-antivirus-windows.md
index fddaa5d3352..04f2d757669 100644
--- a/defender-endpoint/microsoft-defender-antivirus-windows.md
+++ b/defender-endpoint/microsoft-defender-antivirus-windows.md
@@ -163,5 +163,5 @@ It's important to keep Microsoft Defender Antivirus (or any antivirus/anti-malwa
- [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
- [Microsoft Defender Antivirus management and configuration](configuration-management-reference-microsoft-defender-antivirus.md)
- [Evaluate Microsoft Defender Antivirus protection](evaluate-microsoft-defender-antivirus.md)
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
- [AI agent runtime protection with Microsoft Defender for Endpoint](ai-agent-runtime-protection-overview.md)
diff --git a/defender-endpoint/microsoft-defender-core-service-overview.md b/defender-endpoint/microsoft-defender-core-service-overview.md
index fdc5791a638..d5b5a8f40ee 100644
--- a/defender-endpoint/microsoft-defender-core-service-overview.md
+++ b/defender-endpoint/microsoft-defender-core-service-overview.md
@@ -67,7 +67,7 @@ To enhance your endpoint security experience, Microsoft is releasing the Microso
- `*.config.ecs.gov.teams.microsoft.us (GCC-H)`
- `*.config.ecs.dod.teams.microsoft.us (DoD)`
-1. If you're using [Application Control for Windows](/windows/security/application-security/application-control/windows-defender-application-control/wdac), or you're running non-Microsoft antivirus or endpoint detection and response software, make sure to add the processes mentioned earlier to your allowlist.
+1. If you're using [Application Control for Windows](/windows/security/application-security/application-control/app-control-for-business/appcontrol), or you're running non-Microsoft antivirus or endpoint detection and response software, make sure to add the processes mentioned earlier to your allowlist.
1. Consumers don't need to take any actions to prepare.
diff --git a/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode.md b/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode.md
index 0a9424aecf9..4acb2e563d4 100644
--- a/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode.md
+++ b/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode.md
@@ -1,18 +1,18 @@
---
title: Protect Dev Drive using performance mode
-description: Learn how to manage, configure, Microsoft Defender Antivirus performance mode for developers who use Dev Drive.
+description: Learn how to configure and manage Microsoft Defender Antivirus performance mode to help protect Dev Drive for developer workloads.
ms.service: defender-endpoint
ms.localizationpriority: high
ms.topic: how-to
author: chrisda
ms.author: chrisda
ms.reviewer: pricci, yongrhee
-ms.custom: nextgen02, msecd-doc-authoring-1014
+ms.custom: nextgen02, msecd-doc-authoring-1016
ms.subservice: ngp
ms.collection:
- m365-security
- tier2
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Business
ai-usage: ai-assisted
@@ -21,6 +21,8 @@ ai-usage: ai-assisted
---
# Protect Dev Drive using performance mode
+## Overview
+
> [!NOTE]
> Want to experience Microsoft Defender XDR? Learn more about how you can [Pilot and deploy Microsoft Defender XDR](/defender-xdr/pilot-deploy-overview).
@@ -30,7 +32,7 @@ ai-usage: ai-assisted
Performance mode is now available on Windows 11 as a new Microsoft Defender Antivirus capability. Performance mode reduces the performance impact of Microsoft Defender Antivirus scans for files stored on designated Dev Drive. The goal of performance mode is to improve functional performance for developers who use Windows 11 devices.
-It's important to note that performance mode can run only on Dev Drive. Additionally, real-time protection must be turned on for performance mode to function. Enabling this feature on a Dev Drive doesn't change standard real-time protection running on volumes with operating systems or other volumes formatted as `FAT32` or `NTFS`.
+It's important to note that performance mode can run only on Dev Drive. Additionally, real-time protection must be turned on for performance mode to function. Enabling performance mode on a Dev Drive doesn't change standard real-time protection running on volumes with operating systems or other volumes formatted as `FAT32` or `NTFS`.
## Prerequisites
@@ -42,6 +44,8 @@ Performance mode is supported on the following operating systems:
### Microsoft Defender Antivirus requirements for performance mode
+Ensure the following Microsoft Defender Antivirus requirements are met before you enable performance mode:
+
1. Review the requirements that are specific to Dev Drive. See [Set up a Dev Drive on Windows 11](/windows/dev-drive).
2. Make sure Microsoft Defender Antivirus is up to date:
@@ -59,13 +63,13 @@ For more information about Dev Drive, see: [Set up a Dev Drive on Windows 11](/w
### Performance mode compared to real-time protection
-To give the best possible performance, creating a Dev Drive automatically grants trust in the new volume by default. A trusted Dev Drive volume causes real-time protection to run in a special asynchronous performance mode for that volume. Running performance mode provides a balance between threat protection and performance. The balance is achieved by deferring security scans until after the open file operation has completed, instead of performing the security scan synchronously while the file operation is being processed. Deferring scans until after file open completes inherently provides faster performance, but with less protection. However, enabling performance mode provides significantly better protection than other performance tuning methods, such as using folder exclusions, which block security scans altogether.
+To give the best possible performance, creating a Dev Drive automatically grants trust in the new volume by default. A trusted Dev Drive volume causes real-time protection to run in a special asynchronous performance mode for that volume. Running performance mode provides a balance between threat protection and performance. The balance between threat protection and performance is achieved by deferring security scans until after the open file operation has completed, instead of performing the security scan synchronously while the file operation is being processed. Deferring scans until after file open completes inherently provides faster performance, but with less protection. However, enabling performance mode provides significantly better protection than other performance tuning methods, such as using folder exclusions, which block security scans altogether.
> [!NOTE]
> Using performance mode doesn't apply to high cpu or high memory usage scenarios with Microsoft Defender Antivirus services (`MsMpEng.exe`, `WinDefend`, or Antimalware Service Executable). If you're troubleshooting a high cpu usage, instead use the Microsoft Defender Antivirus [Performance Analyzer](tune-performance-defender-antivirus.md) to narrow down to the hot processes/paths and add them to the exclusions.
> [!TIP]
-> Use [Contextual exclusions](configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md) to target real-time protection (RTP).
+> Use [Contextual exclusions](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions) to target real-time protection (RTP).
The following table summarizes performance mode synchronous and asynchronous scan behavior.
| Performance mode state | Scan type | Description | Summary |
@@ -79,7 +83,7 @@ An untrusted Dev Drive doesn't have the same benefits as a trusted Dev Drive. Se
Use one of the following methods to manage performance mode:
-- Performance mode can only run on a *trusted* Dev Drive and is enabled by default when a new Dev Drive is created. For more information, see [Understanding security risks and trust in relation to Dev Drive](/windows/dev-drive#understanding-security-risks-and-trust-in-relation-to-dev-drive).
+- Performance mode can only run on a *trusted* Dev Drive and is enabled by default when a new Dev Drive is created. For more information about security risks and trust for Dev Drive, see [Understanding security risks and trust in relation to Dev Drive](/windows/dev-drive#understanding-security-risks-and-trust-in-relation-to-dev-drive).
- Enforce the Microsoft Defender Antivirus Performance Mode by using Intune, Group Policy, or PowerShell.
@@ -101,7 +105,7 @@ Enable performance mode status via the OMA-URI settings shown in the following t
### Manage performance mode with Group Policy
> [!NOTE]
-> The updated Group Policy Template **Configure performance mode status**, located under **Real-Time Protection** is only available after you install the [Windows 11 2024 Update (24H2)](https://www.microsoft.com/en-us/download/details.aspx?id=106254&msockid=361c21bb46b6605111133499470c6155).
+> The updated Group Policy Template **Configure performance mode status**, located under **Real-Time Protection** is only available after you install the [Administrative Templates for Windows 11 2024 Update (24H2)](https://www.microsoft.com/download/details.aspx?id=106254).
1. Using your Group Policy Management Console or Group Policy Editor, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Real-time Protection**.
@@ -118,6 +122,8 @@ Enable performance mode status via the OMA-URI settings shown in the following t
### Manage performance mode with PowerShell
+Use PowerShell to enable performance mode on the device:
+
1. Open PowerShell as an administrator on the device.
1. Type `set-MpPreference -PerformanceModeStatus Enabled` and press **Enter**.
@@ -144,4 +150,4 @@ To verify that Dev Drive and Defender Performance Mode is enabled, follow these
## Related content
-[Set up a Dev Drive on Windows 11](/windows/dev-drive)
+- [Set up a Dev Drive on Windows 11](/windows/dev-drive)
diff --git a/defender-endpoint/microsoft-defender-endpoint-releases.md b/defender-endpoint/microsoft-defender-endpoint-releases.md
index d7bdcade276..7981fc5994e 100644
--- a/defender-endpoint/microsoft-defender-endpoint-releases.md
+++ b/defender-endpoint/microsoft-defender-endpoint-releases.md
@@ -7,7 +7,7 @@ author: lwainstein
ms.author: lwainstein
ms.reviewer: noamhadash, pahuijbr, yongrhee
ms.localizationpriority: medium
-ms.date: 06/22/2026
+ms.date: 08/05/2026
ai-usage: ai-assisted
appliesto: Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2, Microsoft Defender XDR
---
@@ -29,9 +29,24 @@ This table includes supported releases for all supported platforms in the past s
|OS |Build |Month released|Details |Learn more |
|---------|---------|---------|---------|---------|
+|Android |1.0.9212.0102|Aug 2026|- Build: 1.0.9212.0102
- Release: Aug 20, 2026|[Release details and updates](#android--aug-2026--platform-1092120102)|
+|iOS |1.1.80120102|Aug 2026|- Build: 1.1.80120102
- Release: Aug 20, 2026|[Release details and updates](#ios--aug-2026--platform-version-1180120102)|
+|macOS |101.26062.0012 |August 2026 |- Release version: 20.126062.12.0
- Engine version: 1.1.26060.12000
- Signature version: 1.457.164.0 |[Release details and updates](#macos--august-2026--101260620012) |
+|Android |1.0.9129.0101|Aug 2026|- Build: 1.0.9129.0101
- Release: Aug 11, 2026|[Release details and updates](#android--aug-2026--platform-1091290101)|
+|iOS |1.1.79210103|Aug 2026|- Build: 1.1.79210103
- Release: Aug 04, 2026|[Release details and updates](#ios--aug-2026--platform-version-1179210103)|
+|macOS |101.26062.0011 |August 2026 |- Release version: 20.126062.11.0
- Engine version: 1.1.26040.3000
- Signature version: 1.449.26.0 |[Release details and updates](#macos--august-2026--101260620011) |
+|Linux |101.26062.0007 |August 2026 |- Release version: 30.126052.0012.0
- Engine version: 1.1.26040.3001
- Signature version: 1.449.136.0 |[Release details and updates](#linux--aug-2026--101260620007) |
+|Windows Antivirus |Platform 4.18.26070.9 / Engine 1.1.26070.7|July 2026|- Platform: 4.18.26070.9
- Engine: 1.1.26070.7
- Security intelligence: 1.457.11.0|[Release details and updates](#windows-antivirus--july-2026--platform-418260709--engine-11260707)|
+|macOS |101.26062.0009 |July 2026 |- Release version: 20.126062.9.0
- Engine version: 1.1.26050.3000
- Signature version: 1.455.265.0 |[Release details and updates](#macos--july-2026--101260620009) |
+|Android |1.0.9107.0101|July 2026|- Build: 1.0.9107.0101
- Release: July 21, 2026|[Release details and updates](#android--july-2026--platform-1091070101)|
+|iOS |1.1.79080103|July 2026|- Build: 1.1.79080103
- Release: July 20, 2026|[Release details and updates](#ios--july-2026--platform-version-1179080103)|
+|Linux |101.26052.0012 |July 2026 |- Release version: 30.126052.0012.0
- Engine version: 1.1.26040.3001
- Signature version: 1.449.136.0 |[Release details and updates](#linux--july-2026--101260520012) |
+|Windows Antivirus |Platform 4.18.26060.3008 / Engine 1.1.26060.3008 |June 2026 |- Platform: 4.18.26060.3008
- Engine: 1.1.26060.3008
- Security intelligence: 1.455.25.0 |[Release details and updates](#windows-antivirus--june-2026--platform-418260603008--engine-11260603008) |
+|iOS |1.1.78290102|July 2026|- Build: 1.1.78290102
- Release: July 3, 2026|[Release details and updates](#ios--july-2026--platform-version-1178290102)|
+|Android |1.0.9029.0101|June 2026|- Build: 1.0.9029.0101
- Release: June 30, 2026|[Release details and updates](#android--june-2026--platform-1090290101)|
|macOS |101.26042.0020 |June 2026 |- Release version: 20.126042.20.0
- Engine version: 1.1.26040.3000
- Signature version: 1.453.151.0 |[Release details and updates](#macos--june-2026--101260420020) |
-|Linux |101.26042.0009 |June 2026 |- Release version: 30.126042.0009.0
- Engine version: 1.1.26040.3001
- Signature version: 1.449.136.0 |[Release details and updates](#linux--june-2026--101260420009) |
-|Android |1.0.9014.0101|June 2026|- Build: 1.0.9014.0101
- Release: June 19, 2026|[Release details and updates](#android--june-2026--platform-1090140101)|
+|Linux |101.26042.0011 |June 2026 |- Release version: 30.126042.0011.0
- Engine version: 1.1.26040.3001
- Signature version: 1.449.136.0 |[Release details and updates](#linux--june-2026--101260420011). |
+|Android |1.0.9014.0101|June 2026|- Build: 1.0.9014.0101
- Release: June 19, 2026|[Release details and updates](#android--june-2026--platform-1090140101)|
|iOS |1.1.78020101|June 2026|- Build: 1.1.78020101
- Release: June 11, 2026|[Release details and updates](#ios--june-2026--platform-version-1178020101)|
|Android |1.0.9003.0101|June 2026|- Build: 1.0.9003.0101
- Release: June 8, 2026|[Release details and updates](#android--june-2026--platform-1090030101)|
|iOS |1.1.77280101|June 2026|- Build: 1.1.77280101
- Release: June 1, 2026|[Release details and updates](#ios--june-2026--platform-version-1177280101)|
@@ -96,10 +111,10 @@ This table includes supported releases for all supported platforms in the past s
This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions. You can also check the file information section in the monthly cumulative rollup updates in the following articles:
- [Windows 11 release information](/windows/release-health/windows11-release-information)
-- [Windows 10 updates](https://support.microsoft.com/topic/windows-10-update-history-8127c2c6-6edf-4fdf-8b9f-0f7be1ef3562)
-- [Windows Server 2022 updates](https://support.microsoft.com/topic/windows-server-2022-update-history-e1caa597-00c5-4ab9-9f3e-8212fe80b2ee)
-- [Windows Server 2019 updates](https://support.microsoft.com/topic/windows-10-and-windows-server-2019-update-history-725fc2e1-4443-6831-a5ca-51ff5cbcb059)
-- [Windows Server 2025 updates](https://support.microsoft.com/topic/windows-server-2025-update-history-10f58da7-e57b-4a9d-9c16-9f1dcd72d7d7)
+- [Windows 10 updates](https://support.microsoft.com/servicing/os/windows-10/2022/09/windows-10-update-history)
+- [Windows Server 2022 updates](https://support.microsoft.com/servicing/os/windows-server/2021/07/windows-server-2022-update-history)
+- [Windows Server 2019 updates](https://support.microsoft.com/servicing/os/windows-10/2020/11/windows-10-and-windows-server-2019-update-history)
+- [Windows Server 2025 updates](https://support.microsoft.com/servicing/os/windows-server/2024/10/windows-server-2025-update-history)
### Windows | February 2026 | Platform: 10.8821
@@ -107,13 +122,13 @@ This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions.
| OS | KB |
| -------- | -------- |
-| Windows Server 2025, all editions | [KB5078740](https://support.microsoft.com/help/5078740) |
-| Windows Server 2022 | [KB5078766](https://support.microsoft.com/help/5078766) |
-| Windows Server 2019, Windows 10 1809 | [KB5078752](https://support.microsoft.com/help/5078752) |
-| Windows 11 26H1 | [KB5077239](https://support.microsoft.com/help/5077239) |
-| Windows 11 24H2, Windows 11 25H2 | [KB5077241](https://support.microsoft.com/help/5077241) |
-| Windows 11 23H2 | [KB5078883](https://support.microsoft.com/help/5078883) |
-| Windows 10 21H2, Windows 10 22H2 | [KB5078885](https://support.microsoft.com/help/5078885) |
+| Windows Server 2025, all editions | [KB5078740](https://support.microsoft.com/servicing/os/windows-server/2026/03/march-10-2026-kb5078740-os-build-26100-32522) |
+| Windows Server 2022 | [KB5078766](https://support.microsoft.com/servicing/os/windows-server/2026/03/march-10-2026-kb5078766-os-build-20348-4893) |
+| Windows Server 2019, Windows 10 1809 | [KB5078752](https://support.microsoft.com/servicing/os/windows-10/2026/03/march-10-2026-kb5078752-os-build-17763-8511) |
+| Windows 11 26H1 | [KB5077239](https://support.microsoft.com/servicing/os/windows-11/2026/02/february-24-2026-kb5077239-os-build-28000-1643-preview) |
+| Windows 11 24H2, Windows 11 25H2 | [KB5077241](https://support.microsoft.com/servicing/os/windows-11/2026/02/february-24-2026-kb5077241-os-builds-26200-7922-and-26100-7922-preview) |
+| Windows 11 23H2 | [KB5078883](https://support.microsoft.com/servicing/os/windows-11/2026/03/march-10-2026-kb5078883-os-build-22631-6783) |
+| Windows 10 21H2, Windows 10 22H2 | [KB5078885](https://support.microsoft.com/topic/march-10-2026-kb5078885-os-builds-19045-7058-and-19044-7058-5738282d-0b7f-426e-a42b-bd7698ab6dbb) |
#### Enhancements and features
@@ -129,12 +144,12 @@ This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions.
| OS | KB |
| -------- | -------- |
-| Windows Server 2025, all editions | [KB5066835](https://support.microsoft.com/help/5066835) |
-| Windows Server 2022 | [KB5066782](https://support.microsoft.com/help/5066782) |
-| Windows Server 2019, Windows 10 1809 | [KB5066586](https://support.microsoft.com/help/5066586) |
-| Windows 11 24H2, Windows 11 25H2 | [KB5065789](https://support.microsoft.com/help/5065789) |
-| Windows 11 23H2 | [KB5065790](https://support.microsoft.com/help/5065790) |
-| Windows 10 21H2, Windows 10 22H2 | [KB5066791](https://support.microsoft.com/help/5066791) |
+| Windows Server 2025, all editions | [KB5066835](https://support.microsoft.com/servicing/os/windows-11/2025/10/october-14-2025-kb5066835-os-builds-26200-6899-and-26100-6899) |
+| Windows Server 2022 | [KB5066782](https://support.microsoft.com/topic/october-14-2025-kb5066782-os-build-20348-4294-f4af3c9e-7a60-4d17-a964-cfe1f1dd15f6) |
+| Windows Server 2019, Windows 10 1809 | [KB5066586](https://support.microsoft.com/servicing/os/windows-10/2025/10/october-14-2025-kb5066586-os-build-17763-7919) |
+| Windows 11 24H2, Windows 11 25H2 | [KB5065789](https://support.microsoft.com/servicing/os/windows-11/2025/09/september-29-2025-kb5065789-os-builds-26200-6725-and-26100-6725-preview) |
+| Windows 11 23H2 | [KB5065790](https://support.microsoft.com/servicing/os/windows-11/2025/09/september-23-2025-kb5065790-os-build-22631-5984-preview) |
+| Windows 10 21H2, Windows 10 22H2 | [KB5066791](https://support.microsoft.com/servicing/os/windows-10/2025/10/october-14-2025-kb5066791-os-builds-19044-6456-and-19045-6456) |
#### Enhancements and features
@@ -151,13 +166,13 @@ This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions.
| OS | KB |
| -------- | -------- |
-| Windows Server 2025, all editions | [KB5063878](https://support.microsoft.com/help/5063878) |
-| Windows Server 2022 | [KB5063880](https://support.microsoft.com/help/5063880) |
-| Windows Server 2019 | [KB5063877](https://support.microsoft.com/help/5063877) |
-| Windows 11 24H2 | [KB5062660](https://support.microsoft.com/help/5062660) |
-| Windows 11 23H2 | [KB5062663](https://support.microsoft.com/help/5062663) |
-| Windows 11 25H2 | [KB5063875](https://support.microsoft.com/help/5063875) |
-| Windows 10 21H2, Windows 10 22H2 | [KB5063709](https://support.microsoft.com/help/5063709) |
+| Windows Server 2025, all editions | [KB5063878](https://support.microsoft.com/topic/august-12-2025-kb5063878-os-build-26100-4946-e4b87262-75c8-4fef-9df7-4a18099ee294) |
+| Windows Server 2022 | [KB5063880](https://support.microsoft.com/servicing/os/windows-server/2025/08/august-12-2025-kb5063880-os-build-20348-4052) |
+| Windows Server 2019 | [KB5063877](https://support.microsoft.com/servicing/os/windows-10/2025/08/august-12-2025-kb5063877-os-build-17763-7678) |
+| Windows 11 24H2 | [KB5062660](https://support.microsoft.com/servicing/os/windows-11/2025/07/july-22-2025-kb5062660-os-build-26100-4770-preview) |
+| Windows 11 23H2 | [KB5062663](https://support.microsoft.com/servicing/os/windows-11/2025/07/july-22-2025-kb5062663-os-builds-22631-5699-preview) |
+| Windows 11 25H2 | [KB5063875](https://support.microsoft.com/servicing/os/windows-11/2025/08/august-12-2025-kb5063875-os-builds-22621-5768-and-22631-5768) |
+| Windows 10 21H2, Windows 10 22H2 | [KB5063709](https://support.microsoft.com/servicing/os/windows-10/2025/08/august-12-2025-kb5063709-os-builds-19044-6216-and-19045-6216) |
#### Enhancements and features
@@ -172,9 +187,9 @@ This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions.
| OS | KB |
| -------- | -------- |
-| Windows 11 24H2 | [KB5058499](https://support.microsoft.com/topic/may-28-2025-kb5058499-os-build-26100-4202-preview-d4c2f1ee-8138-4038-b705-546945076f92) |
-| Windows 11 23H2 | [KB5058502](https://support.microsoft.com/topic/may-27-2025-kb5058502-os-22621-5413-and-22631-5413-preview-6291789c-1eea-4227-9740-a701af6de688) |
-| Windows 10 22/H2 | [KB5058481](https://support.microsoft.com/topic/may-28-2025-kb5058481-os-build-19045-5917-preview-7698d6e7-dd65-494d-b523-aa4c6aa913a2) |
+| Windows 11 24H2 | [KB5058499](https://support.microsoft.com/servicing/os/windows-11/2025/05/may-28-2025-kb5058499-os-build-26100-4202-preview) |
+| Windows 11 23H2 | [KB5058502](https://support.microsoft.com/servicing/os/windows-11/2025/05/may-27-2025-kb5058502-os-builds-22621-5413-and-22631-5413-preview) |
+| Windows 10 22/H2 | [KB5058481](https://support.microsoft.com/servicing/os/windows-10/2025/05/may-28-2025-kb5058481-os-build-19045-5917-preview) |
#### Enhancements and features
@@ -192,13 +207,13 @@ This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions.
| OS | KB |
| -------- | -------- |
-| Windows 11 24H2 | [KB5041865](https://support.microsoft.com/topic/august-27-2024-kb5041865-os-build-26100-1591-preview-5d299921-2b27-4fe0-b414-c2336371b552) |
-| Windows 11 23H2, Windows 11 22H | [KB5041587](https://support.microsoft.com/topic/august-27-2024-kb5041587-os-builds-22621-4112-and-22631-4112-preview-9706ea0e-6f72-430e-b08a-878963dafe08) |
-| Windows 11 21H2 | [KB5043067](https://support.microsoft.com/topic/september-10-2024-kb5043067-os-build-22000-3197-62287850-4f0d-4e4a-9fe8-b026bb1be994) |
-| Windows 10 22H2 | [KB5041582](https://support.microsoft.com/topic/august-29-2024-kb5041582-os-build-19045-4842-preview-f4c4d191-5457-475c-80ac-e1d43cf9c941) |
-| Windows Server 2022 and later | [KB5042881](https://support.microsoft.com/topic/september-10-2024-kb5042881-os-build-20348-2700-5b548143-9613-4e5a-9454-8ed9be8b2bd2) |
-| Windows Server 2019 | [KB5043050](https://support.microsoft.com/topic/september-10-2024-kb5043050-os-build-17763-6293-66e9809a-1838-4474-a6a7-90d64f042f00) |
-| Windows Server 2016, Windows Server 2012 R2 | [KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac) |
+| Windows 11 24H2 | [KB5041865](https://support.microsoft.com/servicing/os/windows-11/2024/08/august-27-2024-kb5041865-os-build-26100-1591-preview) |
+| Windows 11 23H2, Windows 11 22H | [KB5041587](https://support.microsoft.com/servicing/os/windows-11/2024/08/august-27-2024-kb5041587-os-builds-22621-4112-and-22631-4112-preview) |
+| Windows 11 21H2 | [KB5043067](https://support.microsoft.com/servicing/os/windows-11/2024/09/september-10-2024-kb5043067-os-build-22000-3197) |
+| Windows 10 22H2 | [KB5041582](https://support.microsoft.com/servicing/os/windows-10/2024/08/august-29-2024-kb5041582-os-build-19045-4842-preview) |
+| Windows Server 2022 and later | [KB5042881](https://support.microsoft.com/servicing/os/windows-server/2024/09/september-10-2024-kb5042881-os-build-20348-2700) |
+| Windows Server 2019 | [KB5043050](https://support.microsoft.com/servicing/os/windows-10/2024/09/september-10-2024-kb5043050-os-build-17763-6293-expired) |
+| Windows Server 2016, Windows Server 2012 R2 | [KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor) |
#### Enhancements and features
@@ -208,7 +223,7 @@ This section covers Microsoft Defender for Endpoint EDR `MsSense.exe` versions.
## macOS releases
-Defender for Endpoint supports macOS version 15.0.1 or newer. macOS 11 (Big Sur) and 12 (Monterey) are no longer supported.
+Defender for Endpoint supports macOS version 14 (Sonoma) or newer. macOS 11 (Big Sur), 12 (Monterey), and 13 (Ventura) are no longer supported.
To share feedback, open Defender for Endpoint on macOS and go to **Help > Send feedback**.
@@ -216,6 +231,64 @@ To get latest features, configure your device for the Beta channel (formerly Ins
For known issues, see [macOS known issues](#macos-known-issues).
+### macOS | August-2026 | 101.26062.0012
+
+#### Versions
+
+| Release version | Engine version | Signature version |
+|-----------------|----------------|-------------------|
+| 20.126062.12.0 | 1.1.26060.12000 | 1.457.164.0 |
+
+#### Enhancements and features
+
+| Feature area | Update summary |
+|--------------|----------------|
+| General | Bug and performance fixes |
+
+### macOS | August-2026 | 101.26062.0011
+
+#### Versions
+
+| Release version | Engine version | Signature version |
+|-----------------|----------------|-------------------|
+| 20.126062.11.0 | 1.1.26040.3000 | 1.449.26.0 |
+
+#### Enhancements and features
+
+| Feature area | Update summary |
+|--------------|----------------|
+| Security for AI | Expanded [local AI agent discovery (Preview)](local-agent-discovery-overview.md) on macOS to include visibility into Model Context Protocol (MCP) server configurations. |
+| General | Performance improvements and bug fixes. |
+
+### macOS | July-2026 | 101.26062.0009
+
+#### Versions
+
+| Release version | Engine version | Signature version |
+|-----------------|----------------|-------------------|
+| 20.126062.9.0 | 1.1.26050.3000 | 1.455.265.0 |
+
+#### Enhancements and features
+
+| Feature area | Update summary |
+|--------------|----------------|
+| General | Bug and performance fixes |
+| General | Extend network diagnostics with `mdatp health --details network_configuration` |
+
+### macOS | July-2026 | 101.26052.0016
+
+#### Versions
+
+| Release version | Engine version | Signature version |
+|-----------------|----------------|-------------------|
+| 20.126052.16.0 | 1.1.26060.12000 | 1.455.47.0 |
+
+#### Enhancements and features
+
+| Feature area | Update summary |
+|--------------|----------------|
+| General | Security and critical updates |
+
### macOS | June-2026 | 101.26042.0020
#### Versions
@@ -458,6 +531,16 @@ Defender for Endpoint on Linux is updated regularly. While security fixes are in
For detailed information on Microsoft security updates, see the [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide).
+> [!NOTE]
+>
+> Each Defender for Endpoint on Linux version expires automatically after nine months. Expired versions continue to receive security intelligence updates, but you should install the latest version to receive all available fixes and enhancements.
+>
+> To check your client expiration date, run the following command:
+>
+> `mdatp health --field product_expiration`
+>
+> The previous RHEL 6 exception for version `101.23082.0011` was time-bound through June 30, 2024 and is no longer active.
+
> [!IMPORTANT]
>
@@ -469,27 +552,63 @@ For detailed information on Microsoft security updates, see the [Microsoft Secur
>
> If you have any concerns or need assistance during this transition, contact support.
-### Linux | June 2026 | 101.26042.0009
+### Linux known issues
+
+[!INCLUDE [Linux 101.26012.0007 known issue](includes/linux-build-issue.md)]
+
+### Linux | Aug 2026 | 101.26062.0007
+
+#### Release details
+
+| Release version | Engine version | Signature version |
+| -------- | -------- |-------- |
+|30.126052.0012.0 |1.1.26040.3001 |1.449.136.0 |
+
+#### Enhancements and features
+
+|Feature area | Update summary |
+|--------------|---------------|
+|Bug fix | Resolved an issue that could cause on-demand antivirus scans (quick, full, and custom) to take longer than expected or appear unresponsive in certain environments. Protection capabilities remained unaffected while scans were in progress. |
+|Security | Engine signature verification is now enabled by default for new installations and upgrades. Defender for Endpoint verifies the engine's digital signature before loading it and doesn't load engines that fail verification. Legacy engine signature verification settings are deprecated. |
+|Visibility | Resolved an issue where the `mdatp health` status could incorrectly show a device as healthy after it was offboarded. |
+|General | Reliability and quality improvements. |
+
+### Linux | July 2026 | 101.26052.0012
+
+#### Release details
+
+| Release version | Engine version | Signature version |
+| -------- | -------- |-------- |
+|30.126052.0012.0 |1.1.26040.3001 |1.449.136.0 |
+
+#### Enhancements and features
+
+|Feature area | Update summary |
+|--------------|---------------|
+|Visibility |**Improved antivirus enforcement visibility.**
The `mdatp health` command now includes a new `antivirus_enforcement_level` field that shows whether antivirus is running in `real_time`, `passive`, `on_demand`, or `audit` mode. This helps administrators quickly verify device protection status without additional checks.|
+| Visibility |**More accurate and informative connectivity tests.**
Connectivity tests now validate the same update paths used for offline security intelligence updates on supported x64 and ARM64 platforms, and surface inline diagnostics (failure type, affected feature, proxy detection status) when a check fails. Fixed URL validation mismatches that could cause false failures.|
+|Bug fix | FIPS-enabled RHEL 8/9 devices that failed to update to 101.26042.x will now install successfully. |
+|Bug fix | Fixed an issue where WordPress Core installations were not reflected in the Linux device software inventory. |
+
+### Linux | June 2026 | 101.26042.0011
#### Release details
| Release version | Engine version | Signature version |
| -------- | -------- |-------- |
-|30.126042.0009.0 |1.1.26040.3001 |1.449.136.0 |
+|30.126042.0011.0 |1.1.26040.3001 |1.449.136.0 |
#### Enhancements and features
|Feature area | Update summary |
|--------------|---------------|
+| Resolved build issue | This release contains a fix for a previously reported issue where Microsoft Defender for Endpoint on Linux could become disabled after upgrade or reinstall scenarios followed by a system reboot. The issue affected platform builds 101.26042.0000–101.26042.0009. Customers running affected builds or older supported versions can upgrade directly to 101.26042.0011 to receive the fix. See the Linux [Known issues](#linux-known-issues) documentation for additional details.|
|Visibility |Better user attribution in security events: [file](/defender-xdr/advanced-hunting-devicefileevents-table), [process](/defender-xdr/advanced-hunting-deviceprocessevents-table), and [network](/defender-xdr/advanced-hunting-devicenetworkevents-table) security events now include the original login user's ID, even when actions are performed via sudo or under root. This information is exposed in Advanced Hunting, making it easier to trace elevated actions back to the actual user's session for improved insider threat detection and investigations. Improved login event accuracy by preventing stale remote IP data from being reused across different login event types.|
-|Configuration | Offline security intelligence updates (GA): Customers can now configure offline security intelligence updates for Linux using Security Settings Management policies in the Defender portal. For more information, see [Configure Offline SIU updates](/defender-endpoint/linux-support-offline-security-intelligence-update?tabs=portal) Scheduled antivirus scans (Public Preview): Customers can centrally schedule antivirus scans on Linux using managed JSON and policy settings through the Defender portal. For more information, see [Schedule AV scans](/defender-endpoint/schedule-antivirus-scans-linux) |
-|Platform support |Added package publishing support for newer Linux distributions, including Fedora 43, Azure Linux 4.0, and RHEL 10 RPM variants.|
-|Security| Improved client IPC hardening for mdatp commands by rejecting requests from mdatp processes launched with dynamic loader injection environment variables (for example, LD_PRELOAD).
-If this affects your workflow, run mdatp without those variables set. For example: env -u LD_PRELOAD mdatp health|
+|Configuration |- Offline security intelligence updates (GA): Customers can now configure offline security intelligence updates for Linux using Security Settings Management policies in the Defender portal. For more information, see [Configure Offline SIU updates](/defender-endpoint/linux-support-offline-security-intelligence-update?tabs=portal)
- Scheduled antivirus scans (Public Preview): Customers can centrally schedule antivirus scans on Linux using managed JSON and policy settings through the Defender portal. For more information, see [Schedule AV scans](/defender-endpoint/schedule-antivirus-scans-linux) |
+|Platform support |Added package publishing support for newer Linux distributions including Fedora 43, RockyLinux 10, AlmaLinux 10 and SUSE Linux Enterprise Server 16 |
|Performance |Faster threat remediation: Malware is now quarantined and cleaned up more quickly, improving response time when threats are detected.|
|Stability |This release includes EDR SDK updates and stability improvements that help the Defender agent run more reliably with continuous protection.|
-
### Linux | April 2026 | 101.26032.0000
#### Release details
@@ -539,6 +658,10 @@ Fixed an issue in the January 2026 release, where real-time scanning of the /dev
| Vulnerability detection | Strengthened Linux security coverage for Python workloads by improving vulnerability detection across system, user, and virtual environments, expanding coverage for CVE‑2025‑68664/5 LangGrinch (langchain vulnerability).|
| General | Bug and performance fixes.
Real-time protection statistics collection is now disabled by default as a performance optimization; enable it on-demand when needed for diagnostics with `mdatp config real-time-protection-statistics --value enabled`. |
+#### Known issues
+
+[!INCLUDE [Linux 101.26012.0007 known issue](includes/linux-build-issue.md)]
+
### Linux | February 2026 | 101.25122.0004
#### Release details
@@ -685,6 +808,62 @@ Fixed an issue in the January 2026 release, where real-time scanning of the /dev
See the full list of [Android UX improvements](android-new-ux.md).
+### Android | Aug 2026 | Platform: 1.0.9212.0102
+
+#### Release details
+
+| Platform version| Release Date |
+| -------- | -------- |
+|1.0.9212.0102|Aug 20, 2026|
+
+#### Enhancements and features
+
+|__Feature Area__| __Update Summary__|
+| -------- | -------- |
+|Feature Enhancements|The Malware Protection card now shows the most recent scan time, making it easier to verify device protection status at a glance.. |
+
+### Android | Aug 2026 | Platform: 1.0.9129.0101
+
+#### Release details
+
+| Platform version| Release Date |
+| -------- | -------- |
+|1.0.9129.0101|Aug 11, 2026|
+
+#### Enhancements and features
+
+|__Feature Area__| __Update Summary__|
+| -------- | -------- |
+|General|Performance improvements and general bug fixes. |
+
+### Android | July 2026 | Platform: 1.0.9107.0101
+
+#### Release details
+
+| Platform version| Release Date |
+| -------- | -------- |
+|1.0.9107.0101|July 21, 2026|
+
+#### Enhancements and features
+
+|__Feature Area__| __Update Summary__|
+| -------- | -------- |
+|General|Performance improvements and general bug fixes. |
+
+### Android | June 2026 | Platform: 1.0.9029.0101
+
+#### Release details
+
+| Platform version| Release Date |
+| -------- | -------- |
+|1.0.9029.0101|June 30, 2026|
+
+#### Enhancements and features
+
+|__Feature Area__| __Update Summary__|
+| -------- | -------- |
+|General|Performance improvements and general bug fixes. |
+
### Android | June 2026 | Platform: 1.0.9014.0101
#### Release details
@@ -881,6 +1060,64 @@ See the full list of [Android UX improvements](android-new-ux.md).
For the latest UX improvements, see [iOS UX improvements](ios-new-ux.md).
+### iOS | Aug 2026 | Platform Version: 1.1.80120102
+
+#### Release details
+
+| Platform version | Release Date |
+| -------- | -------- |
+| 1.1.80120102 | Aug 20, 2026 |
+
+#### Enhancements and features
+
+|**Feature Area**| **Update Summary**|
+| -------- | -------- |
+| New Features & Enhancements | Introduced Dynamic Preview Rings feature to help organizations safely evaluate new Microsoft Defender for Endpoint mobile capabilities with a targeted set of users before expanding deployment across their environment. You can read more [here](mobile-dynamic-preview-rings-configure.md) |
+| Security Updates | We have retired the in-app OS Update recommendations in favor of enforcement via MAM / MDM policies |
+
+### iOS | Aug 2026 | Platform Version: 1.1.79210103
+
+#### Release details
+
+| Platform version | Release Date |
+| -------- | -------- |
+| 1.1.79210103| Aug 4, 2026 |
+
+#### Enhancements and features
+
+|**Feature Area**| **Update Summary**|
+| -------- | -------- |
+|Improvements|Performance improvements and general bug fixes.|
+
+### iOS | July 2026 | Platform Version: 1.1.79080103
+
+#### Release details
+
+| Platform version | Release Date |
+| -------- | -------- |
+| 1.1.79080103| July 20, 2026 |
+
+#### Enhancements and features
+
+|__Feature Area__| __Update Summary__|
+| -------- | -------- |
+|Improvements|Performance improvements and general bug fixes.|
+
+### iOS | July 2026 | Platform Version: 1.1.78290102
+
+#### Release details
+
+| Platform version | Release Date |
+| -------- | -------- |
+| 1.1.78290102| July 3, 2026 |
+
+#### Enhancements and features
+
+|__Feature Area__| __Update Summary__|
+| -------- | -------- |
+|Improvements|Performance improvements and general bug fixes.|
+|Feature|Improvement in compliance flow.|
+
### iOS | June 2026 | Platform Version: 1.1.78020101
#### Release details
@@ -1002,6 +1239,49 @@ For the latest UX improvements, see [iOS UX improvements](ios-new-ux.md).
For more information about Microsoft Defender Antivirus updates, see [Microsoft Defender Antivirus security intelligence product updates and support](microsoft-defender-antivirus-updates.md).
+### Windows Antivirus | July 2026 | Platform 4.18.26070.9 | Engine 1.1.26070.7
+
+#### Release details
+
+| Component | Version | Date |
+| -------- | -------- | -------- |
+| Platform | 4.18.26070.9 | August 5, 2026 |
+| Engine | 1.1.26070.7 | August 5, 2026 |
+| Security intelligence1 | 1.457.11.0 | August 5, 2026 |
+| Support phase | Security and Critical Updates | - |
+
+1The security intelligence version listed here is relevant to the listed engine release. Newer versions of security intelligence are released regularly. For more information, see
+[Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware](https://www.microsoft.com/wdsi/defenderupdates).
+
+#### Enhancements and features
+
+- Improved archive scanning performance to scale service memory limits dynamically based on the number of logical cores.
+- Improved cache builds on devices with Lunar Lake CPUs by using `TrustedImageIdentifier`.
+- Fixed an issue where files that were already excluded were still submitted to the cloud protection service for rescanning, only to return the same result.
+- Fixed HTTPS connection stalls under Network Protection Block mode caused by dropped TCP FIN segments.
+
+### Windows Antivirus | June 2026 | Platform 4.18.26060.3008 | Engine 1.1.26060.3008
+
+#### Release details
+
+| Component | Version | Date |
+| -------- | -------- | -------- |
+| Platform | 4.18.26060.3008 | June 30, 2026 |
+| Engine | 1.1.26060.3008 | June 30, 2026 |
+| Security intelligence1 | 1.455.25.0 | June 30, 2026 |
+| Support phase | Security and Critical Updates | - |
+
+1The security intelligence version listed here is relevant to the listed engine release. Newer versions of security intelligence are released regularly. For more information, see
+[Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware](https://www.microsoft.com/wdsi/defenderupdates).
+
+#### Enhancements and features
+
+- Resolved an issue where Controlled Folder Access toast notifications continuously appeared for the C: drive because of AMD driver injection into protected processes, so users no longer see a flood of repeated CFA "protected memory" prompts.
+- Improved Endpoint DLP enforcement reliability for Chrome uploads to Google Drive, ensuring policy-based blocking is consistently applied during bulk file transfers.
+- Fixed an issue in Endpoint DLP where Chrome and Firefox uploads could occasionally display the default Just-In-Time (JIT) notification instead of the organization-configured custom message due to a timing-related race condition.
+- Addressed Microsoft Defender Elevation of Privilege vulnerability CVE-2026-50656, improving protection against local privilege escalation scenarios in the Microsoft Malware Protection Engine
+
+
### Windows Antivirus | May 2026 | Platform 4.18.26050.15 | Engine 1.1.26050.11
#### Release details
@@ -1074,6 +1354,3 @@ For more information about Microsoft Defender Antivirus updates, see [Microsoft
- Fixed NisSrv self-healing when the service crosses memory thresholds.
- Improved encrypted PDF scanning.
- Fixed `Get-MpPerformanceReport` JSON parsing failures.
-
-
-
diff --git a/defender-endpoint/microsoft-defender-endpoint.md b/defender-endpoint/microsoft-defender-endpoint.md
index 15cf891084a..946c39da96e 100644
--- a/defender-endpoint/microsoft-defender-endpoint.md
+++ b/defender-endpoint/microsoft-defender-endpoint.md
@@ -11,7 +11,7 @@ ms.collection:
- essentials-overview
ms.custom: intro-overview
ms.topic: overview
-ms.date: 06/17/2026
+ms.date: 07/28/2026
ai-usage: ai-assisted
appliesto:
- Microsoft Defender for Endpoint Plan 1
@@ -33,7 +33,7 @@ Defender for Endpoint also integrates with the broader Microsoft security ecosys
* [Microsoft Defender for Cloud](/azure/defender-for-cloud/)
* [Microsoft Defender for Cloud Apps](/defender-cloud-apps/)
* [Microsoft Defender for Identity](/defender-for-identity/)
-* [Microsoft Defender for Office](/defender-office-365/)
+* [Microsoft Defender for Office 365](/defender-office-365/)
* [Microsoft Defender Vulnerability Management](/defender-vulnerability-management/defender-vulnerability-management)
* [Microsoft Sentinel](/azure/sentinel/)
* [Microsoft threat intelligence](threat-protection-integration.md)
@@ -56,6 +56,10 @@ Defender for Endpoint is available with several licensing options, including Def
> [!TIP]
> The more Microsoft Defender workloads you deploy (identity, email, cloud apps, and endpoints), the stronger your overall protection becomes. Each workload contributes signals that enrich detection, correlation, and automated response in the unified Defender portal.
+### Server licensing and Defender for Servers
+
+If you're using Defender for Endpoint on servers, you might be eligible for a discount if you're also using [Microsoft Defender for Servers](/azure/defender-for-cloud/defender-for-servers-overview). Learn about [licensing discounts available when you have both Defender for Endpoint and Defender for Servers](/azure/defender-for-cloud/faq-defender-for-servers#can-i-get-a-discount-if-i-already-have-a-microsoft-defender-for-endpoint-license-).
+
## Defender for Endpoint capabilities
Defender for Endpoint provides a comprehensive set of capabilities, including [endpoint detection and response](overview-endpoint-detection-response.md), [autonomous protection](/defender-xdr/automatic-attack-disruption) with [automatic attack disruption](/defender-xdr/automatic-attack-disruption) and [predictive shielding](/defender-xdr/shield-predict-threats), [next-generation protection](next-generation-protection.md) with ransomware prevention, [attack surface reduction](overview-attack-surface-reduction.md), [vulnerability management](/defender-vulnerability-management/defender-vulnerability-management), [Endpoint Attack Notifications](endpoint-attack-notifications.md), and [APIs](api/management-apis.md) for integration with your existing workflows.
diff --git a/defender-endpoint/microsoft-defender-offline.md b/defender-endpoint/microsoft-defender-offline.md
index d0dc61e4f06..4a7bec88513 100644
--- a/defender-endpoint/microsoft-defender-offline.md
+++ b/defender-endpoint/microsoft-defender-offline.md
@@ -3,10 +3,10 @@ title: Microsoft Defender Offline scan in Windows
description: You can use Microsoft Defender Offline Scan straight from the Microsoft Defender Antivirus app. You can also manage how it's deployed in your network.
ms.service: defender-endpoint
ms.localizationpriority: medium
-ms.date: 06/16/2026
+ms.date: 07/03/2026
author: limwainstein
ms.author: lwainstein
-ms.custom: nextgen, msecd-doc-authoring-1014
+ms.custom: nextgen, msecd-doc-authoring-1016
ms.reviewer: yongrhee
ms.subservice: ngp
ms.topic: how-to
@@ -32,7 +32,7 @@ ai-usage: ai-assisted
|**Firmware/ Rootkit**| Operating system
Driver
Memory (Heap)
Application
Identity
Cloud|
> [!NOTE]
-> The protection for this feature focuses on the Firmware/Rootkit.
+> The protection for Microsoft Defender Offline Scan focuses on firmware and rootkits.
Microsoft Defender Offline is an anti-malware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR).
@@ -66,12 +66,12 @@ To receive Microsoft Defender Offline Scan updates:
- Update Microsoft Defender Antivirus how you normally deploy updates to endpoints. Use a supported version of the:
- - [Platform Update](https://www.microsoft.com/security/portal/definitions/adl.aspx)
+ - [Platform Update](https://www.microsoft.com/wdsi/defenderupdates)
- [Engine Update](microsoft-defender-antivirus-updates.md)
- Security Intelligence Updates
- - You can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx)
+ - You can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/wdsi/defenderupdates)
- See the [Manage Microsoft Defender Antivirus Security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) article for more information.
- Users must be signed in with local administrator privileges.
@@ -79,7 +79,7 @@ To receive Microsoft Defender Offline Scan updates:
- Windows Recovery Environment (WinRE) needs to be enabled.
> [!NOTE]
-> If WinRE is disabled, the Windows Defender Offline scan doesn't run and no error messages are displayed. Nothing happens even if the machine is restarted manually. To fix this, you only have to enable WinRE.
+> If WinRE is disabled, the Windows Defender Offline scan doesn't run and no error messages are displayed. Nothing happens even if the machine is restarted manually. To resolve this issue, enable WinRE.
>
> - To check the WinRE status, you can execute this command-line: `reagentc /info`.
> - If the status is Disabled, you can enable it by executing this command-line: `reagentc /enable`.
@@ -94,7 +94,7 @@ If Microsoft Defender Antivirus determines that you need to run Microsoft Defend
The user is also notified within the Microsoft Defender Antivirus client. If you're using Intune to manage devices, you can see the notification in Intune.
-- You can manually force an offline scan that is built-in Windows 10, version 1607 or newer, and Windows 11. Or, for older operating systems such as Windows 7 SP1 and Windows 8.1, you can create bootable media to run an offline scan (see [Windows 7 Service Pack 1 and Windows 8.1](#in-windows-7-service-pack-1-and-windows-81) later in this article).
+- You can manually force an offline scan that is built-in Windows 10, version 1607 or newer, and Windows 11. Or, for older operating systems such as Windows 7 SP1 and Windows 8.1, you can create bootable media to run an offline scan (see the [In Windows 7 Service Pack 1 and Windows 8.1](#in-windows-7-service-pack-1-and-windows-81) section).
In Configuration Manager, you can identify the status of endpoints by navigating to **Monitoring > Overview > Security > Endpoint Protection Status > System Center Endpoint Protection Status**.
@@ -158,7 +158,7 @@ Starting with Windows 10, version 1607 or newer, and Windows 11, Microsoft Defen
### Use PowerShell cmdlets to run an offline scan
-Use the following cmdlets:
+Run the following cmdlet to initiate a Microsoft Defender Offline scan, which reboots the device into an isolated environment to detect persistent malware:
```PowerShell
Start-MpWDOScan
@@ -170,7 +170,10 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
Use the [**MSFT_MpWDOScan**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class to run an offline scan.
-The following WMI script snippet will immediately run a Microsoft Defender Offline scan, which will cause the endpoint to restart, run the offline scan, and then restart and boot into Windows.
+> [!IMPORTANT]
+> Running this command immediately restarts the endpoint to begin the offline scan. Save all files and close applications before continuing.
+
+The following WMI command triggers a Microsoft Defender Offline scan, which restarts the endpoint, performs the offline scan, and then boots back into Windows.
```console
wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start
@@ -180,11 +183,13 @@ For more information about Windows Defender WMI APIs, see [Windows Defender WMIv
#### In Windows 7 Service Pack 1 and Windows 8.1:
+To run Microsoft Defender Offline on Windows 7 SP1 or Windows 8.1, create bootable media and then use it to scan the endpoint:
+
1. Download Windows Defender Offline and install it to a CD, DVD, or USB flash drive using the following links:
- [Download the 64-bit version (msstool64.exe)](https://go.microsoft.com/fwlink/?LinkID=234124)
- [Download the 32-bit version (msstool32.exe)](https://go.microsoft.com/fwlink/?LinkID=234123)
- If you're not sure which version to download, see [Is my PC running the 32-bit or 64-bit version of Windows?](https://support.microsoft.com/windows/32-bit-and-64-bit-windows-frequently-asked-questions-c6ca9541-8dce-4d48-0415-94a3faa2e13d).
+ If you're not sure which version to download, see [Is my PC running the 32-bit or 64-bit version of Windows?](https://support.microsoft.com/Windows/Experience/Compatibility/32-bit-and-64-bit-windows-frequently-asked-questions).
1. To get started, find a blank CD, DVD, or USB flash drive with at least 250 MB of free space, and then run the tool. You are guided through the steps to create the removable media.
@@ -253,6 +258,3 @@ Windows Defender Antivirus downloaded and configured Windows Defender Offline to
> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
> - [Configure Defender for Endpoint on Android features](android-configure.md)
> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)
-
-
-
diff --git a/defender-endpoint/microsoft-defender-security-center-antivirus.md b/defender-endpoint/microsoft-defender-security-center-antivirus.md
index 044a101bada..a3522e6d2a1 100644
--- a/defender-endpoint/microsoft-defender-security-center-antivirus.md
+++ b/defender-endpoint/microsoft-defender-security-center-antivirus.md
@@ -1,18 +1,18 @@
---
title: Microsoft Defender Antivirus in the Windows Security app
-description: With Microsoft Defender Antivirus now included in the Windows Security app, you can review, compare, and perform common tasks.
+description: Learn how to view and manage Microsoft Defender Antivirus settings in the Windows Security app, including running scans, updating security intelligence, configuring exclusions, and setting up ransomware protection.
ms.service: defender-endpoint
ms.localizationpriority: medium
ms.topic: how-to
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
+ms.custom: nextgen, msecd-doc-authoring-1016
ms.reviewer: yongrhee
ms.subservice: ngp
ms.collection:
- m365-security
- tier2
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -23,11 +23,10 @@ ai-usage: ai-assisted
# Microsoft Defender Antivirus in the Windows Security app
-
-Beginning with Windows 10, version 1703 and later, Microsoft Defender Antivirus settings are viewable in the Windows Security app. See [Windows Security](/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center) for more information about security features and settings that are built into Windows.
+This article describes how to use the Windows Security app to manage Microsoft Defender Antivirus. You can run scans, check security intelligence updates, verify real-time protection, add exclusions, review threat detection history, and configure ransomware protection. These features are available in Windows 10, version 1703 and later. For more information about built-in security features, see [Windows Security](/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center).
> [!IMPORTANT]
-> Disabling the Windows Security app doesn't disable Microsoft Defender Antivirus or [Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security). These capabilities are disabled or set to passive mode when non-Microsoft antivirus/antimalware software is installed on the device and kept up to date.
+> Disabling the Windows Security app doesn't disable Microsoft Defender Antivirus or [Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall). These capabilities are disabled or set to passive mode when non-Microsoft antivirus/antimalware software is installed on the device and kept up to date.
> If you do disable the Windows Security app, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app might display stale or inaccurate information about any antivirus or firewall products that are installed on the device. It might also prevent Microsoft Defender Antivirus from re-enabling when you uninstall any non-Microsoft antivirus/antimalware software.
> Disabling the Windows Security app can significantly lower the level protection of your device and could lead to malware infection.
@@ -39,7 +38,7 @@ Use the following steps to open Virus & threat protection settings in the Window
1. Select **Virus & threat protection**.
-1. Use one or more of the subsequent sections to perform tasks using the Windows Security app.
+1. From **Virus & threat protection**, you can run scans, check protection updates, verify real-time protection, add exclusions, review protection history, and configure ransomware protection as described in the following sections.
> [!NOTE]
> If these settings are configured and deployed using Group Policy, the Virus & threat protection settings described in this procedure are grayed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting are updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-local-policy-overrides-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured.
@@ -61,13 +60,13 @@ Use this section to review the current security intelligence version and check f
:::image type="content" source="/defender/media/wdav-wdsc-defs.png" alt-text="Security intelligence version number" lightbox="/defender/media/wdav-wdsc-defs.png":::
> [!NOTE]
-> The *security intelligence version* (previously called the *definition version*) shown in the Windows Security app is the version number of the antimalware definitions used by Microsoft Defender Antivirus. To check your definition version, follow the steps below to navigate to **Virus & threat protection updates**, where the security intelligence version is displayed.
+> The _security intelligence version_ (previously called the _definition version_) is the version number of the antimalware definitions that Microsoft Defender Antivirus uses. To check your version, use the following steps:
-1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**.
+1. Open the Windows Security app by searching the start menu for _Security_, and then selecting **Windows Security**.
1. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar).
-1. Select **Virus & threat protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check your current against the latest version available for manual download, or review the change log for that version. See [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](microsoft-defender-antivirus-updates.md).
+1. Select **Virus & threat protection updates**. The installed version and its download date are shown. You can compare it to the latest version available for manual download, or review the change log. For more information, see [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](microsoft-defender-antivirus-updates.md).
1. Select **Check for updates** to download new protection updates (if there are any).
@@ -78,7 +77,7 @@ Use this section to review the current security intelligence version and check f
Use the following steps to verify that Microsoft Defender Antivirus real-time protection is enabled.
-1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**.
+1. Open the Windows Security app by searching the start menu for _Security_, and then selecting **Windows Security**.
1. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar).
@@ -92,36 +91,23 @@ Use the following steps to verify that Microsoft Defender Antivirus real-time pr
## Add exclusions for Microsoft Defender Antivirus in the Windows Security app
-Use the following steps to add exclusions for Microsoft Defender Antivirus in the Windows Security app.
-
-1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**.
-
-1. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar).
-
-1. Under **Virus & threat protection settings**, select **Manage settings**.
-
-1. Under **Exclusions**, select **Add or remove exclusions**.
-
-1. Select the plus icon (**+**) to choose the type and set the options for each exclusion.
-
-The following table summarizes exclusion types and what happens:
-
-|Exclusion type|Defined by|What happens|
-|---|---|---|
-|**File**|Location
Example: `c:\sample\sample.test`|The specific file is skipped by Microsoft Defender Antivirus.|
-|**Folder**|Location
Example: `c:\test\sample`|All items in the specified folder are skipped by Microsoft Defender Antivirus.|
-|**File type**|File extension
Example: `.test`|All files with the `.test` extension anywhere on your device are skipped by Microsoft Defender Antivirus.|
-|**Process**|Executable file path
Example: `c:\test\process.exe`|The specific process and any files that are opened by that process are skipped by Microsoft Defender Antivirus.|
+Use the following steps to add exclusions for Microsoft Defender Antivirus in the Windows Security app. For more information, see [Exclusions in Microsoft Defender Antivirus](microsoft-defender-antivirus-exclusions-overview.md).
-To learn more, see the following resources:
-
-- [Configure and validate exclusions based on file extension and folder location](./configure-extension-file-exclusions-microsoft-defender-antivirus.md)
-- [Configure exclusions for files opened by processes](./configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
+1. In the **Windows security** app on the device, go to **Virus & threat protection**.
+1. In the **Virus & threat protection** pane, in the **Virus & threat protection settings** section, select **Manage settings**.
+1. In the **Virus & threat protection settings** pane, in the **Exclusions** section, select **Add or remove exclusions**.
+1. In the **Exclusions** pane, select **+ Add an exclusion** and then select one of the following values that appear:
+ - **File** or **Folder**: Also known as _path exclusions_. For more information, see [File and folder exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-and-folder-exclusions).
+ - **File type**: Exclusions by file type extension. The exclusion applies to any files with that extension, regardless of location. For more information, see [File extension exclusions](microsoft-defender-antivirus-exclusions-overview.md#file-extension-exclusions).
+ - **Process**: Exclusions for files opened by specified processes. The processes themselves aren't excluded. To exclude the processes, use **File** or **Folder** exclusions. For more information, see [Process exclusions](microsoft-defender-antivirus-exclusions-overview.md#process-exclusions).
+
## Review threat detection history in the Windows Security app
-1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**.
+Use the following steps to review threat detection history in the Windows Security app.
+
+1. Open the Windows Security app by searching the start menu for _Security_, and then selecting **Windows Security**.
1. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar).
@@ -131,22 +117,16 @@ To learn more, see the following resources:
Use the following steps to configure ransomware protection and recovery options in the Windows Security app.
-1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**.
+1. Open the Windows Security app by searching the start menu for _Security_, and then selecting **Windows Security**.
1. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar).
1. Under **Ransomware protection**, select **Manage ransomware protection**.
-1. To change **Controlled folder access** settings, see [Protect important folders with Controlled folder access](controlled-folders.md).
+1. To change **Controlled folder access** (CFA) settings, see [Configure controlled folder access (CFA)](controlled-folder-access-configure.md).
1. To set up ransomware recovery options, select **Set up** under **Ransomware data recovery** and follow the instructions for linking or setting up your OneDrive account so you can easily recover from a ransomware attack.
-
## Related content
- [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md)
-
-
-
-
-
diff --git a/defender-endpoint/migrate-devices-streamlined.md b/defender-endpoint/migrate-devices-streamlined.md
index d437098bd2d..d973817bb2e 100644
--- a/defender-endpoint/migrate-devices-streamlined.md
+++ b/defender-endpoint/migrate-devices-streamlined.md
@@ -10,13 +10,13 @@ ms.collection:
- tier1
ms.topic: how-to
ms.subservice: onboard
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Migrate devices to use the streamlined connectivity method
@@ -38,6 +38,8 @@ In most cases, full device offboarding isn't required when reonboarding. You can
## Migrating devices using the streamlined method
+Use the following guidance to migrate previously onboarded devices to the streamlined connectivity method for each supported operating system and deployment tool.
+
### Review migration recommendations before switching connectivity methods
@@ -49,7 +51,7 @@ Use the following recommendations to plan your migration rollout:
- **Complete migration**. At this stage, you can gradually roll out the migration to a larger set of devices. To complete the migration, you can replace previous onboarding policies and remove the old URLs from your network device.
-Validate [device prerequisites](configure-device-connectivity.md#prerequisites) before proceeding with any migrations. This article builds upon [Onboarding devices using streamlined connectivity](configure-device-connectivity.md) by focusing on migrating existing devices.
+Validate [device prerequisites](configure-device-connectivity.md#prerequisites) before proceeding with any migrations. This migration guide builds upon [Onboarding devices using streamlined connectivity](configure-device-connectivity.md) by focusing on migrating existing devices.
To reonboard devices, you need to use the streamlined onboarding package. For more information on how to access the package, see [Streamlined connectivity](configure-device-connectivity.md).
@@ -66,7 +68,10 @@ The following table lists migration instructions for the available onboarding to
### [Windows 10 and 11](#tab/windows10and11)
-### Windows 10 and 11
+Use the following options to migrate Windows 10 and Windows 11 devices to the streamlined connectivity method.
+
+
+### Migrate Windows 10 and Windows 11 devices
> [!IMPORTANT]
> Windows 10 versions 1607, 1703, 1709, and 1803 don't support reonboarding. To migrate existing devices, you need to fully offboard and onboard using the streamlined onboarding package.
@@ -75,29 +80,37 @@ For general information on onboarding Windows client devices, see [Onboarding Wi
Confirm prerequisites are met: [Prerequisites for using streamlined method](configure-device-connectivity.md#prerequisites).
-### Local script
+
+### Migrate devices using a local script
-Follow the guidance in [Local script (up to 10 devices)](configure-endpoints-script.md) using the streamlined onboarding package. After completing the steps, you must restart the device for device connectivity to switch over.
+Follow the guidance in [Local script (up to 10 devices)](configure-endpoints-script.md) using the streamlined onboarding package. After completing the local script onboarding steps, you must restart the device for device connectivity to switch over.
-### Group policy
+
+### Migrate devices using Group Policy
-Follow the guidance in [Group policy](configure-endpoints-gp.md) using the streamlined onboarding package. After completing the steps, you must restart the device for device connectivity to switch over.
+Follow the guidance in [Group policy](configure-endpoints-gp.md) using the streamlined onboarding package. After completing the Group Policy onboarding steps, you must restart the device for device connectivity to switch over.
-### Microsoft Intune
+
+### Migrate devices using Microsoft Intune
-Follow the guidance in [Intune](/intune/intune-service/protect/endpoint-security-edr-policy#updating-the-onboarding-state-for-a-device) using the streamlined onboarding package. You can use the "auto from connector" option; however, this option doesn't automatically reapply the onboarding package. Create a new onboarding policy and target a test group first. After completing the steps, you must restart the device for device connectivity to switch over.
+Follow the guidance in [Intune](/intune/intune-service/protect/endpoint-security-edr-policy#updating-the-onboarding-state-for-a-device) using the streamlined onboarding package. You can use the "auto from connector" option; however, the "auto from connector" option doesn't automatically reapply the onboarding package. Create a new onboarding policy and target a test group first. After completing the Intune onboarding steps, you must restart the device for device connectivity to switch over.
-### Microsoft Configuration Manager
+
+### Migrate devices using Microsoft Configuration Manager
Follow the guidance in [Configuration Manager](/intune/configmgr/protect/deploy-use/defender-advanced-threat-protection#bkmk_updateatp).
-### VDI
+
+### Migrate VDI devices using the streamlined method
-Use the guidance in [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md). After completing the steps, you must restart the device for device connectivity to switch over.
+Use the guidance in [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md). After completing the VDI onboarding steps, you must restart the device for device connectivity to switch over.
### [**Windows Server**](#tab/Windowsserver)
-### Windows Server
+Use the following options to migrate Windows Server devices to the streamlined connectivity method.
+
+
+### Migrate Windows Server devices
For general information on onboarding Windows server devices, see [Onboard Windows servers to the Microsoft Defender for Endpoint service](onboard-server.md).
@@ -108,33 +121,41 @@ Confirm prerequisites are met: [Prerequisites for streamlined method](configure-
Devices already onboarded don't reonboard automatically. Turn on the following Advanced Feature setting in the Microsoft Defender portal (**Settings > Endpoints > Advanced Features**) and select the option "Apply streamlined connectivity settings to devices managed by Intune and Defender for Cloud". Newly added devices start using the new onboarding information within ~48 hours. To reonboard existing devices, apply the onboarding script - see [Onboard Windows servers to the Microsoft Defender for Endpoint service](onboard-server.md).
-### Microsoft Configuration Manager
+
+### Migrate Windows Server devices using Microsoft Configuration Manager
Follow the guidance in [Configuration Manager](/intune/configmgr/protect/deploy-use/defender-advanced-threat-protection#bkmk_updateatp) to deploy a new policy.
-### Group policy
+
+### Migrate Windows Server devices using Group Policy
-Follow the guidance in [Group policy](configure-endpoints-gp.md) using the streamlined onboarding package. After completing the steps, you must restart the device for device connectivity to switch over.
+Follow the guidance in [Group policy](configure-endpoints-gp.md) using the streamlined onboarding package. After completing the Group Policy onboarding steps, you must restart the device for device connectivity to switch over.
-### VDI
+
+### Migrate Windows Server VDI devices
-Follow the guidance in [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md). After completing the steps, you must restart the device for device connectivity to switch over.
+Follow the guidance in [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md). After completing the VDI onboarding steps, you must restart the device for device connectivity to switch over.
### [**macOS**](#tab/macOS)
-### macOS
+Use the following options to migrate macOS devices to the streamlined connectivity method.
+
+
+### Migrate macOS devices
For general information on onboarding macOS devices, see [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md).
Confirm prerequisites are met: [Prerequisites for streamlined method](configure-device-connectivity.md#prerequisites).
-### Local script
+
+### Migrate macOS devices using a local script
Follow the guidance in [Manual deployment for Microsoft Defender for Endpoint on macOS](mac-install-manually.md) using the streamlined onboarding package.
-After completing the steps, you must either reboot the device or restart the Defender for Endpoint service for connectivity to switch over.
+After completing the manual macOS onboarding steps, you must either reboot the device or restart the Defender for Endpoint service for connectivity to switch over.
-### Microsoft Intune
+
+### Migrate macOS devices using Microsoft Intune
Use the following steps to migrate macOS devices with Microsoft Intune:
@@ -166,17 +187,19 @@ For more JAMF guidelines, see [Deploying Microsoft Defender for Endpoint on macO
### [**Linux**](#tab/linux)
-### Linux
+
+### Migrate Linux devices
For general information on onboarding Linux devices, see [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md).
Confirm prerequisites are met: [Prerequisites for streamlined method](configure-device-connectivity.md#prerequisites).
-### Local script
+
+### Migrate Linux devices using a local script
Use the guidance in [Deploy Microsoft Defender for Endpoint on Linux manually](linux-install-manually.md) using the streamlined onboarding package.
-After completing the steps, you must either reboot the device or restart the service using `sudo systemctl restart mdatp`.
+After completing the Linux manual onboarding steps, you must either reboot the device or restart the service using `sudo systemctl restart mdatp`.
Device connectivity to streamlined approach doesn't start if you don't reboot the device.
@@ -219,7 +242,7 @@ Ensure connectivity is established with the appropriate URLs.
You can use advanced hunting in Microsoft Defender portal to view the connectivity type status.
-This information is found in the DeviceInfo table under the "ConnectivityType" column:
+Connectivity type status is found in the DeviceInfo table under the "ConnectivityType" column:
- Column Name: ConnectivityType
- Possible Values: `
2. [Suppress an alert](defender-endpoint-false-positives-negatives.md#suppress-an-alert) for a known entity.
3. [Review remediation actions](defender-endpoint-false-positives-negatives.md#part-2-review-remediation-actions) that were taken for the detected entity.
4. [Submit the false positive to Microsoft](/unified-secops-platform/submission-guide) for analysis.
5. [Define an indicator or an exclusion](defender-endpoint-false-positives-negatives.md#part-3-review-or-define-exclusions) for the entity (only if necessary). |
-| [Performance issues](troubleshoot-performance-issues.md) such as one of the following issues:
- A system is having high CPU usage or other performance issues.
- A system is having memory leak issues.
- An app is slow to load on devices.
- An app is slow to open a file on devices. | 1. [Collect diagnostic data](collect-diagnostic-data.md) for Microsoft Defender Antivirus.
2. If you're using a non-Microsoft antivirus solution, [Check with the vendor for known issues with antivirus products](troubleshoot-performance-issues.md#check-with-the-vendor-for-known-issues-with-antivirus-products).
3. Review performance logs (see [Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI](troubleshoot-av-performance-issues-with-wprui.md)) to determine the estimated performance impact. For performance-specific issues related to Microsoft Defender Antivirus, use the [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).
4. [Define an exclusion for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md) (if necessary).
5. [Create an indicator for Defender for Endpoint](indicators-overview.md) (only if necessary). |
-| [Compatibility issues](microsoft-defender-antivirus-compatibility.md) with non-Microsoft antivirus products.
Example: Defender for Endpoint relies on security intelligence updates for devices, whether they're running Microsoft Defender Antivirus or a non-Microsoft antivirus solution. | 1. If you're using a non-Microsoft antivirus product as your primary antivirus/antimalware solution, [set Microsoft Defender Antivirus to passive mode](microsoft-defender-antivirus-compatibility.md#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode).
2. If you're switching from a non-Microsoft antivirus/antimalware solution to Defender for Endpoint, see [Make the switch to Defender for Endpoint](switch-to-mde-overview.md). This guidance includes [Exclusions you might need to define for Microsoft Defender Antivirus](switch-to-mde-phase-2.md#step-4-add-your-existing-solution-to-the-exclusion-list-for-microsoft-defender-antivirus) and [Troubleshooting information](switch-to-mde-troubleshooting.md) (just in case something goes wrong while migrating). |
-| Compatibility with applications.
Example: Applications are crashing or experiencing unexpected behaviors after a device is onboarded to Microsoft Defender for Endpoint. | See [Address unwanted behaviors in Microsoft Defender for Endpoint with exclusions, indicators, and other techniques](address-unwanted-behaviors-mde.md). |
-
-## Alternatives to creating exclusions and allow indicators
-
-Creating an exclusion or an allow indicator creates a protection gap. These techniques should only be used after determining the root cause of the issue. Until that determination is made, consider these alternatives:
-
-- Submit a file to Microsoft for analysis
-- Suppress an alert
-
-### Submitting files for analysis
-
-If you have a file that you think is wrongly detected as malware (a false positive), or a file that you suspect might be malware even though it wasn't detected (a false negative), you can submit the file to Microsoft for analysis. Your submission is scanned immediately, and will then be reviewed by Microsoft security analysts. You're able to check the status of your submission on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory).
-
-Submitting files for analysis helps reduce false positives and false negatives for all customers. To learn more, see the following articles:
-
-- [Submit files for analysis](/unified-secops-platform/submission-guide) (available to all customers)
-- [Submit files using the new unified submissions portal in Defender for Endpoint](admin-submissions-mde.md) (available to customers who have Defender for Endpoint Plan 2 or Microsoft Defender XDR)
-
-### Suppressing alerts
-
-If you're getting alerts in the Microsoft Defender portal for tools or processes that you know aren't actually a threat, you can suppress those alerts. To suppress an alert, you create a suppression rule, and specify what actions to take for that alert on other, identical alerts. You can create suppression rules for a specific alert on a single device, or for all alerts that have the same title across your organization.
-
-To learn more, see the following articles:
-
-- [Suppress alerts](/defender-xdr/investigate-alerts?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json#built-in-alert-tuning-rules)
-- [Tech Community Blog: Introducing the new alert suppression experience](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719) (for Defender for Endpoint)
-
-## Types of exclusions
-
-There are several different types of exclusions to consider. Some types of exclusions affect multiple capabilities in Defender for Endpoint, whereas other types are specific to Microsoft Defender Antivirus.
-
-- **[Custom exclusions](#custom-exclusions)**: These are exclusions that you define for specific use cases or scenarios, and for certain operating systems, such as [Mac](#exclusions-on-mac), [Linux](#exclusions-on-linux), and [Windows](#exclusions-on-windows).
-- **[Preconfigured antivirus exclusions](#antivirus-preconfigured-exclusions)**: These are exclusions that you don't have to define, such as [automatic server role exclusions](#automatic-server-role-exclusions) and [built-in antivirus exclusions](#built-in-antivirus-exclusions). Even though you don't have to define these, it's helpful to know what they are and how they work.
-- **[Attack surface reduction exclusions](#attack-surface-reduction-exclusions)**: These are exclusions to prevent attack surface reduction capabilities from blocking legitimate applications that your organization might be using.
-- **[Automation folder exclusions](#automation-folder-exclusions)**: These are exclusions that you define to prevent automated investigation and remediation capabilities from applying to specific files or folders.
-- **[Controlled folder access exclusions](#controlled-folder-access-exclusions)**: These are exclusions to allow certain apps or executables to access protected folders.
-- **[Custom remediation actions](#custom-remediation-actions)**: These are actions that you specify for Microsoft Defender Antivirus when certain types of detections.
-
-For information about indicators, see [Overview of indicators in Microsoft Defender for Endpoint](indicators-overview.md).
-
-### Custom exclusions
-
-Microsoft Defender for Endpoint allows you to configure custom exclusions to optimize performance and avoid false positives. The types of exclusions you can set vary by Defender for Endpoint capabilities and by operating systems.
-
-The following table summarizes types of custom exclusions that you can define. Note the scope for each exclusion type.
-
-| Exclusion types | Scope |Use cases |
-|---| ----| -------- |
-|[Custom Defender for Endpoint exclusions](#custom-exclusions) | Antivirus
Attack surface reduction rules
Defender for Endpoint
Network Protection |A file, folder, or process is identified as malicious, even though it's not a threat.
An application encounters unexpected performance or application compatibility issue when running with Defender for Endpoint|
-|[Defender for Endpoint attack surface reduction exclusions](#attack-surface-reduction-exclusions) | Attack surface reduction rules|An attack surface reduction rule causes unexpected behavior. |
-|[Defender for Endpoint automation folder exclusions](#automation-folder-exclusions) | Automated investigation and response|Automated investigation and remediation take action on a file, extension, or directory that should be done manually.|
-|[Defender for Endpoint controlled folder access exclusions](#controlled-folder-access-exclusions) | Controlled folder access|Controlled folder access blocks an application from accessing a protected folder.|
-|[Defender for Endpoint File and Certificate Allow Indicators](indicator-certificates.md)| Antivirus
Attack surface reduction rules
Controlled folder access |A file or process signed by a certificate is identified as malicious even through it's not.|
-|[Defender for Endpoint Domain/URL and IP address Indicators](indicator-ip-domain.md) | Network Protection
SmartScreen
Web Content Filtering | SmartScreen reports a false positive.
You want to override a Web Content Filtering block on a specific site.|
-
-
-> [!NOTE]
-> [Network protection](network-protection.md) is directly impacted by process exclusions on all platforms. A process exclusion on any OS (Windows, MacOS, Linux) results in preventing Network Protection from inspecting traffic or enforcing rules for that specific process.
-
-#### Exclusions on Mac
-
-For macOS, you can define exclusions that apply to on-demand scans, real-time protection, and monitoring. The supported exclusion types include:
-
-- **File extension**: Exclude all files with a specific extension.
-- **File**: Exclude a specific file identified by its full path.
-- **Folder**: Exclude all files under a specified folder recursively.
-- **Process**: Exclude a specific process and all files opened by it.
-
-For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on macOS](mac-exclusions.md).
-
-#### Exclusions on Linux
-
-On Linux, you can configure both antivirus and global exclusions.
-
-- **Antivirus exclusions**: Apply to on-demand scans, real-time protection (RTP), and behavior monitoring (BM).
-- **Global exclusions**: Apply to real-time protection (RTP), behavior monitoring (BM), and endpoint detection and response (EDR), stopping all associated antivirus detections and EDR alerts.
-
-For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md).
-
-#### Exclusions on Windows
-
-Microsoft Defender Antivirus can be configured to exclude combinations of processes, files, and extensions from scheduled scans, on-demand scans, and real-time protection. See [Configure custom exclusions for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md).
-
-For more granular control that helps minimize protection gaps, consider using [Contextual file and process exclusions](configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md).
-
-### Antivirus preconfigured exclusions
-
-These exclusion types are preconfigured in Microsoft Defender for Endpoint for Microsoft Defender Antivirus.
-
-| Exclusion types | Configuration | Description |
-|---|----|----|
-| [Automatic Microsoft Defender Antivirus exclusions](#automatic-server-role-exclusions) | Automatic | Automatic Exclusions for server roles and features in Windows Server. When you install a role on Windows Server 2016 or later, Microsoft Defender Antivirus includes automatic exclusions for the server role and any files that are added while installing the role.
These exclusions are only for active roles on Windows Server 2016 and later. |
-| [Built-in Microsoft Defender Antivirus exclusions](#built-in-antivirus-exclusions) | Automatic |Microsoft Defender Antivirus includes built-in exclusions for operating system files on all versions of Windows.|
-
-#### Automatic server role exclusions
-
-[Automatic server role exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#automatic-server-role-exclusions) include exclusions for server roles and features in Windows Server 2016 and later. These exclusions aren't scanned by [real-time protection](configure-protection-features-microsoft-defender-antivirus.md) but are still subject to [quick, full, or on-demand antivirus scans](schedule-antivirus-scans.md#comparing-the-quick-scan-full-scan-and-custom-scan).
-
-Examples include:
-
-- File Replication Service (FRS)
-- Hyper-V
-- SYSVOL
-- Active Directory
-- DNS Server
-- Print Server
-- Web Server
-- Windows Server Update Services
-- ...and more.
-
-> [!NOTE]
-> Automatic exclusions for server roles aren't supported on Windows Server 2012 R2. For servers running Windows Server 2012 R2 with the Active Directory Domain Services (AD DS) server role installed, exclusions for domain controllers must be specified manually. See [Active Directory exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#active-directory-exclusions).
-
-For more information, see [Automatic server role exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#automatic-server-role-exclusions).
-
-#### Built-in antivirus exclusions
-
-[Built-in antivirus exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#built-in-exclusions) include certain operating system files that are excluded by Microsoft Defender Antivirus on all versions of Windows (including Windows 10, Windows 11, and Windows Server).
-
-Examples include:
-
-- `%windir%\SoftwareDistribution\Datastore\Datastore.edb`
-- `%allusersprofile%\NTUser.pol`
-- Windows Update files
-- Windows Security files
-- ... and more.
-
-The list of built-in exclusions in Windows is kept up to date as the threat landscape changes. To learn more about these exclusions, see [Microsoft Defender Antivirus exclusions on Windows Server: Built-in exclusions](configure-server-exclusions-microsoft-defender-antivirus.md#built-in-exclusions).
-
-### Attack surface reduction exclusions
-
-[Attack surface reduction (ASR) rules](attack-surface-reduction-rules-overview.md) block risky software behavior, but some legitimate apps engage in this risky behavior (for example, launching executable files that download and run other files). Some rules support Microsoft Defender Antivirus exclusions. ASR rules also support global and per-rule ASR exclusions. For more information, see [File and folder exclusions for ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules).
-
-### Automation folder exclusions
-
-Automation folder exclusions apply to [automated investigation and remediation](automated-investigations.md) in Defender for Endpoint, which is designed to examine alerts and take immediate action to resolve detected breaches. As alerts are triggered, and an automated investigation runs, a verdict (Malicious, Suspicious, or No threats found) is reached for each piece of evidence investigated. Depending on the [automation level](automation-levels.md) and other security settings, remediation actions can occur automatically or only upon approval by your security operations team.
-
-You can specify folders, file extensions in a specific directory, and file names to be excluded from automated investigation and remediation capabilities. Such automation folder exclusions apply to all devices onboarded to Defender for Endpoint. These exclusions are still subject to antivirus scans.
-
-For more information, see [Manage automation folder exclusions](manage-automation-folder-exclusions.md).
-
-### Controlled folder access exclusions
-
-[Controlled folder access](controlled-folders.md) monitors apps for activities that are detected as malicious and protects the contents of certain (protected) folders on Windows devices. Controlled folder access allows only trusted apps to access protected folders, such as common system folders (including boot sectors) and other folders that you specify. You can allow certain apps or signed executables to access protected folders by defining exclusions.
-
-For more information, See [Customize controlled folder access](customize-controlled-folders.md).
-
-### Custom remediation actions
-
-When Microsoft Defender Antivirus detects a potential threat while running a scan, it attempts to remediate or remove the detected threat. You can define custom remediation actions to configure how Microsoft Defender Antivirus should address certain threats, whether a restore point should be created before remediating, and when threats should be removed.
-
-For more information, see [Configure remediation actions for Microsoft Defender Antivirus detections](configure-remediation-microsoft-defender-antivirus.md).
-
-## How exclusions and indicators are evaluated
-
-Most organizations have several different types of exclusions and indicators to determine whether users should be able to access and use a file or process. Exclusions and indicators are processed in a particular order so that [policy conflicts are handled systematically](indicator-file.md#policy-conflict-handling).
-
-Here's how it works:
-
-1. If a detected file/process isn't allowed by Windows Defender Application Control and AppLocker, it's blocked. Otherwise, it proceeds to Microsoft Defender Antivirus.
-
-2. If the detected file/process isn't part of an exclusion for Microsoft Defender Antivirus, it's blocked. Otherwise, Defender for Endpoint checks for a custom indicator for the file/process.
-
-3. If the detected file/process has a Block or Warn indicator, that action is taken. Otherwise, the file/process is allowed, and proceeds to evaluation by attack surface reduction rules, controlled folder access, and SmartScreen protection.
-
-4. If the detected file/process isn't blocked by attack surface reduction rules, controlled folder access, or SmartScreen protection, it proceeds to Microsoft Defender Antivirus.
-
-5. If the detected file/process isn't allowed by Microsoft Defender Antivirus, it's checked for an action based on its threat ID.
-
-## How policy conflicts are handled
-
-In cases where Defender for Endpoint indicators conflict, here's what to expect:
-
-- If there are conflicting file indicators, the indicator that uses the most secure hash is applied. For example, SHA256 takes precedence over SHA-1, which takes precedence over MD5.
-
-- If there are conflicting URL indicators, the more strict indicator is used. For [Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview), an indicator that uses the longest URL path is applied. For example, `www.dom.ain/admin/` takes precedence over `www.dom.ain`. ([Network protection](network-protection.md) applies to domains, rather than subpages within a domain.)
-
-- If there are similar indicators for a file or process that have different actions, the indicator that is scoped to a specific device group takes precedence over an indicator that targets all devices.
-
-## How automated investigation and remediation works with indicators
-
-[Automated investigation and remediation capabilities](automated-investigations.md) in Defender for Endpoint first determine a verdict for each piece of evidence, and then take an action depending on Defender for Endpoint indicators. Thus, a file/process could get a verdict of "good" (which means no threats were found) and still be blocked if there's an indicator with that action. Similarly, an entity could get a verdict of "bad" (which means it's determined to be malicious) and still be allowed if there's an indicator with that action.
-
-For more information, see [Automated investigation and remediation engine](indicators-overview.md#automated-investigation-and-remediation-engine).
-
-## Other server workloads and exclusions
-
-If your organization is using other server workloads, such as Exchange Server, SharePoint Server, or SQL Server, keep in mind that only built-in server roles (that could be prerequisites for software you install later) on Windows Server are excluded by [automatic server role exclusions](#automatic-server-role-exclusions) feature (and only when using their default installation location). You'll likely need to define antivirus exclusions for these other workloads, or for all workloads if you disable automatic server role exclusions.
-
-Here are some examples of technical documentation to identify and implement the exclusions you need:
-
-- [Running antivirus software on Exchange Server](/exchange/antispam-and-antimalware/windows-antivirus-software?view=exchserver-2019&preserve-view=true)
-- [Folders to exclude from antivirus scans on SharePoint Server](https://support.microsoft.com/office/certain-folders-may-have-to-be-excluded-from-antivirus-scanning-when-you-use-file-level-antivirus-software-in-sharepoint-01cbc532-a24e-4bba-8d67-0b1ed733a3d9)
-- [Choosing antivirus software for SQL Server](https://support.microsoft.com/topic/how-to-choose-antivirus-software-to-run-on-computers-that-are-running-sql-server-feda079b-3e24-186b-945a-3051f6f3a95b)
-
-Depending on what you're using, you might need to refer to the documentation for that server workload.
-
-## See also
-
-- [Address common false-positive scenarios with exclusions](address-unwanted-behaviors-mde.md)
-- [Configure exclusions for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md)
-- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
-- [Overview of indicators in Microsoft Defender for Endpoint](indicators-overview.md)
-
-
diff --git a/defender-endpoint/network-devices.md b/defender-endpoint/network-devices.md
index c50fdf3d6da..fa42bb91368 100644
--- a/defender-endpoint/network-devices.md
+++ b/defender-endpoint/network-devices.md
@@ -9,9 +9,9 @@ ms.localizationpriority: medium
ms.collection:
- m365-security
- tier1
-ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1014
+ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1016
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -21,7 +21,9 @@ ai-usage: ai-assisted
---
# Set up authenticated network scans in Microsoft Defender for Endpoint
-Authenticated network scans provide an agentless way to discover and assess network infrastructure devices, such as switches, routers, WLAN controllers, firewalls, and VPN gateways.
+## Overview
+
+Authenticated network scans provide an agentless way to discover and assess network infrastructure devices, such as switches, routers, WLAN controllers, firewalls, and VPN gateways. This article walks you through the prerequisites, scanner installation and registration, and configuration steps needed to set up authenticated network scans and view discovered devices in the device inventory.
For more information, see [Authenticated network scans](device-discovery.md#authenticated-network-scans).
@@ -38,7 +40,7 @@ Any network device that responds to SNMPv2 or SNMPv3 queries can be discovered b
### Supported Windows versions for the scanner
-The scanner is supported on Windows 10, version 1903 and Windows Server, version 1903 and later. For more information, see [Windows 10, version 1903 and Windows Server, version 1903](https://support.microsoft.com/topic/windows-10-update-history-e6058e7c-4116-38f1-b984-4fcacfba5e5d)
+The scanner is supported on Windows 10, version 1903 and Windows Server, version 1903 and later. For more information, see [Windows 10, version 1903 and Windows Server, version 1903](https://support.microsoft.com/servicing/os/windows-10/2020/11/windows-10-update-history-4)
> [!NOTE]
> You can install up to 40 scanners per tenant.
@@ -148,7 +150,7 @@ Each scanning device can support up to 1,500 successful IP addresses scan. For e
If there are multiple IP address ranges/subnets to scan, the test scan results take several minutes to show up. A test scan is available for up to 1,024 addresses.
-When the results are displayed, you can choose which devices to include in the periodic scan. If you skip viewing the scan results, all configured IP addresses are added to the network device authenticated scan (regardless of the device's response). The scan results can also be exported.
+When the test scan results are displayed, you can choose which devices to include in the periodic scan. If you skip viewing the scan results, all configured IP addresses are added to the network device authenticated scan (regardless of the device's response). The scan results can also be exported.
## View network devices in the device inventory
diff --git a/defender-endpoint/network-isolation-exclusions.md b/defender-endpoint/network-isolation-exclusions.md
new file mode 100644
index 00000000000..4dfee0d2472
--- /dev/null
+++ b/defender-endpoint/network-isolation-exclusions.md
@@ -0,0 +1,203 @@
+---
+title: Network isolation exclusions in Microsoft Defender for Endpoint
+description: Learn how to exclude specific processes, IP addresses, or services from network isolation when you apply the selective isolation action to devices.
+ms.service: defender-endpoint
+ms.author: painbar
+author: paulinbar
+ms.localizationpriority: medium
+ms.collection:
+- m365-security
+- tier2
+- mde-edr
+ms.topic: how-to
+ms.subservice: edr
+ms.date: 06/30/2026
+appliesto:
+ - Microsoft Defender for Endpoint Plan 1
+ - Microsoft Defender for Endpoint Plan 2
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1015
+ai-usage: ai-assisted
+---
+
+# Network isolation exclusions
+
+Isolation exclusions let you exclude specific processes, IP addresses, or services from network isolation by applying the selective isolation response action to devices.
+
+Network isolation in Microsoft Defender for Endpoint restricts a compromised device's communication to prevent threat spread. However, certain critical services, such as management tools or security solutions, might need to remain operational.
+
+Isolation exclusions allow designated processes or endpoints to bypass the restrictions of network isolation, ensuring essential functions (for example, remote remediation or monitoring) continue while limiting broader network exposure.
+
+## Prerequisites
+
+Before you use isolation exclusions, make sure the following prerequisites are met:
+
+- Isolation exclusion must be enabled.
+- Enabling isolation exclusion requires Security Admin or Manage Security settings permissions or above.
+
+### Supported operating systems
+
+Isolation exclusion is supported on the following operating systems:
+
+- Isolation exclusion is available on Windows 11, Windows 10 version 1703 or later, Windows Server 2016 and later, Windows Server 2012 R2, macOS, and Azure Stack HCI OS, version 23H2 and later.
+
+> [!WARNING]
+> **Any exclusion weakens device isolation and increases security risks. To minimize risk, configure exclusions only when strictly necessary**.
+
+Regularly review and update exclusions to align with security policies.
+
+## Isolation modes
+
+There are two modes of isolation: **full isolation** and **selective isolation**.
+
+- **Full isolation**: In full isolation mode, the device is completely isolated from the network, and no exceptions are allowed. All traffic is blocked, except for essential communications with the Defender agent. Exclusions aren't applied in full isolation mode.
+
+ Full isolation mode is the most secure option, suitable for scenarios where a high level of containment is necessary. For more information about full isolation mode, see [Isolate devices from the network](respond-machine-alerts.md#isolate-devices-from-the-network).
+
+- **Selective isolation**: Selective isolation mode allows administrators to apply exclusions to ensure that critical tools and network communications can still function, while maintaining the device's isolated state.
+
+## How to use isolation exclusion
+
+There are two steps to using isolation exclusion: defining isolation exclusion rules, and applying isolation exclusion on a device.
+
+:::image type="content" source="media/network-isolation-exclusions/enable-exclusions.png" alt-text="Screenshot showing how to enable isolation exclusions." lightbox="media/network-isolation-exclusions/enable-exclusions.png":::
+
+> [!NOTE]
+> Once the isolation exclusions feature has been enabled, the previously embedded exclusions for Microsoft Teams, Outlook, and Skype no longer apply, and the exclusions list starts empty on all platforms. If Microsoft Teams, Outlook, and Skype still require access during isolation, you must manually define new exclusion rules for them.
+>
+> Skype has been deprecated and is no longer included in any default exclusions.
+
+### Step 1: Define global exclusions in the settings
+
+To define global isolation exclusion rules, perform the following steps:
+
+1. In the [Microsoft Defender portal](https://security.microsoft.com), navigate to **Settings** > **Endpoints** > **Advanced features** > **Isolation Exclusion Rules**.
+
+1. Select the relevant OS tab (Windows rules or Mac rules).
+
+1. Select **+ Add exclusion rule**
+
+ :::image type="content" source="media/network-isolation-exclusions/add-new-exclusion-rule.png" alt-text="Screenshot showing how to add a new isolation exclusion rule." lightbox="media/network-isolation-exclusions/add-new-exclusion-rule.png":::
+
+1. The **Add new exclusion rule** dialog appears:
+
+ :::image type="content" source="media/network-isolation-exclusions/exclusion-rule-definition.png" alt-text="Screenshot showing the fields required for defining an isolation exclusion rule." lightbox="media/network-isolation-exclusions/exclusion-rule-definition.png":::
+
+ Fill in the isolation exclusion parameters. Red asterisks denote required parameters. The parameters and their valid values are:
+
+ - **Rule name**: Provide a name for the rule.
+
+ - **Rule description**: Describe the purpose of the rule.
+
+ - **Process path** (Windows only): The file path of an executable is its location on the endpoint. You can define one executable to be used in each rule.
+
+ Examples:
+
+ - `C:\Windows\System\Notepad.exe`
+ - `%WINDIR%\Notepad.exe`
+
+ Notes:
+
+ - The executable must exist when isolation is applied, otherwise the exclusion rule is ignored.
+ - The exclusion doesn't apply to any child processes created by the specified process.
+
+ - **Service name** (Windows only): Windows service short names can be used in cases where you want to exclude a service (not an application) that is sending or receiving traffic. Service short names can be retrieved by running the **Get-Service** command from PowerShell. You can define one service to be used in each rule.
+
+ Example: termservice
+
+ - **Package family name** (Windows only): The Package Family Name (PFN) is a unique identifier assigned to Windows app packages. The PFN format follows this structure: `
(for example, PowerShell) |
-|:---|:---|:---|:---|
+| --- | --- | --- | --- |
| [Web Threat Protection](web-threat-protection.md) | SmartScreen must be enabled | Network protection must be in block mode | Network protection must be in block mode |
| [Custom Indicators](indicators-overview.md) | SmartScreen must be enabled | Network protection must be in block mode | Network protection must be in block mode |
| [Web Content Filtering](web-content-filtering.md) | SmartScreen must be enabled | Network protection must be in block mode | Not supported |
@@ -83,7 +85,7 @@ Network protection requires devices running one of the following operating syste
Network protection also requires Microsoft Defender Antivirus with real-time protection enabled.
| Windows version | Microsoft Defender Antivirus |
-|:---|:---|
+| --- | --- |
| Windows 10 version 1709 or later, Windows 11, Windows Server 1803 or later | Make sure that [Microsoft Defender Antivirus real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md), [behavior monitoring](behavior-monitor.md), and [cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) are enabled (active) |
| Windows Server 2012 R2 and Windows Server 2016 using the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2) | Platform update version `4.18.2001.x.x` or newer |
@@ -154,13 +156,13 @@ A user visits a website. If the url has an unknown or uncertain reputation, a to
> [!NOTE]
>
-> - The images shown in this article for both the `warn` experience and `block` experience use "blocked url" as example placeholder text. In a functioning environment, the actual url or domain is listed.
+> - The images shown in this article for both the `warn` experience and `block` experience use "blocked url" as example placeholder text. In a functioning environment, the actual url or domain is listed.
>
> - To receive this toast notification, make sure the **Files or activities are blocked** option is enabled under **Virus & Threat Protection notifications** by setting the corresponding registry key:
>
> `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender Security Center\Virus and threat protection\FilesBlockedNotificationDisabled = 0`
>
-> For more information, see [Windows Security app settings](https://support.microsoft.com/windows/windows-security-app-settings-1ec98620-4e41-4b6b-b055-3c4bb115d4ee#bkmk_notifications).
+> For more information, see [Windows Security app settings](https://support.microsoft.com/Windows/Security/Windows-Security/windows-security-app-settings#bkmk_notifications).
#### Use CSP to enable `Convert warn verdict to block`
@@ -174,17 +176,23 @@ For Edge browsers, see [Edge Policy: Prevent SmartScreen Prompt Override](/deplo
By enabling this setting, network protection blocks network traffic instead of displaying a warning.
-1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
-1. Right-click the Group Policy Object you want to configure, and then select **Edit**.
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
-1. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
+1. Right-click the GPO, and then select **Edit**.
-1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Network inspection system**.
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**.
-1. Double-click **Convert warn verdict to block** and set the option to **Enabled**.
+1. In the details pane of **Network inspection system**, open the **Convert warn verdict to block** setting. To open the setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
-1. Select **OK**.
+1. In the setting window that opens, select **Enabled**, and then select **OK**.
+
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**.
#### Block experience
@@ -460,17 +468,23 @@ Network protection includes a performance optimization that allows `block` mode
This procedure enables network protection to improve performance by switching from real-time inspection to asynchronous inspection.
-1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).
+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.
-1. Right-click the Group Policy Object you want to configure, and then select **Edit**.
+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.
-1. In the Group Policy Management Editor, go to **Computer configuration**, and then select **Administrative templates**.
+1. Right-click the GPO, and then select **Edit**.
-1. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Network inspection system**.
+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**.
-1. Double-click **Turn on asynchronous inspection**, and then set the option to **Enabled**.
+1. In the details pane of **Network inspection system**, open the **Turn on asynchronous inspection** setting. To open the setting, use any of the following methods:
+ - Double-click the setting.
+ - Right-click the setting, and then select **Edit**.
+ - Select the setting, and then select **Action** \> **Edit**.
-1. Select **OK**.
+> [!TIP]
+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **Network inspection system**.
+
+1. In the setting window that opens, select **Enabled**, and then select **OK**.
### Use Microsoft Defender Antivirus Powershell to enable Turn on asynchronous inspection
@@ -487,5 +501,3 @@ Set-MpPreference -AllowSwitchToAsyncInspection $true
- [Configuring attack surface reduction capabilities in Microsoft Intune](/intune/intune-service/protect/endpoint-security-asr-policy)
- [Network protection for Linux](network-protection-linux.md) | To learn about using Microsoft Network protection for Linux devices.
- [Network protection for macOS](network-protection-macos.md) | To learn more about Microsoft Network protection for macOS
-
-
diff --git a/defender-endpoint/offboard-machines.md b/defender-endpoint/offboard-machines.md
index 3a91946ad0e..1581d44252d 100644
--- a/defender-endpoint/offboard-machines.md
+++ b/defender-endpoint/offboard-machines.md
@@ -10,7 +10,7 @@ ms.collection:
- tier2
ms.topic: article
ms.subservice: onboard
-ms.date: 06/16/2026
+ms.date: 08/11/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -30,6 +30,7 @@ appliesto:
- Windows Server 2012 R2 and later
- Azure Stack HCI OS, version 23H2 and later
- Mac devices
+- Linux devices
For information about offboarding and uninstalling Microsoft Defender for Endpoint on Linux, see [Offboard Microsoft Defender for Endpoint on Linux](linux-off-board-endpoints.md).
@@ -40,6 +41,7 @@ You can also use other methods, such as:
- [Offboard devices using a local script](configure-endpoints-script.md#offboard-devices-using-a-local-script)
- [Offboard devices using Group Policy](configure-endpoints-gp.md#offboard-devices-using-group-policy)
- [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-devices-using-mobile-device-management-tools)
+- [Offboard devices using the API](api/offboard-machine-api.md)
## Offboard servers
@@ -51,6 +53,7 @@ You can also use other methods, such as:
- [Offboard devices using Configuration Manager](configure-endpoints-sccm.md#offboard-devices-using-configuration-manager)
- [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-devices-using-mobile-device-management-tools)
- [Offboard devices using a local script](configure-endpoints-script.md#offboard-devices-using-a-local-script)
+- [Offboard devices using the API](api/offboard-machine-api.md)
## Offboard Mac devices
diff --git a/defender-endpoint/onboard-downlevel.md b/defender-endpoint/onboard-downlevel.md
index 9b0be12423f..21c16545e30 100644
--- a/defender-endpoint/onboard-downlevel.md
+++ b/defender-endpoint/onboard-downlevel.md
@@ -63,13 +63,13 @@ It's recommended to onboard down-level Windows clients via MMA and SCEP **only i
Review the following details to verify minimum system requirements:
-- Install the [February 2018 monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4074598)
+- Install the [February 2018 monthly update rollup](https://support.microsoft.com/servicing/os/windows-7/2018/02/february-13-2018-kb4074598-monthly-rollup) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4074598)
-- Install the [March 12, 2019 (or later) Servicing stack update](https://support.microsoft.com/topic/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1-march-12-2019-b4dc0cff-d4f2-a408-0cb1-cb8e918feeba) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/search.aspx?q=4490628)
+- Install the [March 12, 2019 (or later) Servicing stack update](https://support.microsoft.com/topic/servicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1-march-12-2019-b4dc0cff-d4f2-a408-0cb1-cb8e918feeba) - Direct download link from the Windows Update catalog is available [here](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4490628)
-- Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry)
+- Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/servicing/os/windows/2019/11/update-for-customer-experience-and-diagnostic-telemetry)
-- Install [Microsoft .NET Framework 4.5.2 or later](https://www.microsoft.com/en-US/download/details.aspx?id=42642)
+- Install [Microsoft .NET Framework 4.5.2 or later](/dotnet/framework/install/guide-for-developers)
> [!NOTE]
> Installation of .NET 4.5 might require you to restart your computer after installation.
@@ -109,7 +109,7 @@ Defender for Endpoint integrates with System Center Endpoint Protection to provi
The following steps are required to enable this integration:
-- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
+- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/servicing/management-tools/configuration-manager/update/2020/08/january-2017-anti-malware-platform-update-for-endpoint-protection-clients)
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
- Configure your network to allow connections to the Microsoft Defender Antivirus cloud. For more information, see [Configure and validate Microsoft Defender Antivirus network connections](configure-network-connections-microsoft-defender-antivirus.md)
diff --git a/defender-endpoint/onboarding-endpoint-configuration-manager.md b/defender-endpoint/onboarding-endpoint-configuration-manager.md
index bdc03e4c86e..20755c97a83 100644
--- a/defender-endpoint/onboarding-endpoint-configuration-manager.md
+++ b/defender-endpoint/onboarding-endpoint-configuration-manager.md
@@ -176,7 +176,7 @@ Follow the steps below to identify the Defender for Endpoint Workspace ID and Wo
- Server SKUs: Windows Server 2008 SP1 or Newer
- Client SKUs: Windows 7 SP1 and later
- The MMA agent needs to be installed on Windows devices. To install the agent, some systems need to download the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) in order to collect the data with MMA. These system versions include but may not be limited to:
+ The MMA agent needs to be installed on Windows devices. To install the agent, some systems need to download the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/servicing/os/windows/2019/11/update-for-customer-experience-and-diagnostic-telemetry) in order to collect the data with MMA. These system versions include but may not be limited to:
- Windows 8.1
- Windows 7
@@ -186,8 +186,8 @@ Follow the steps below to identify the Defender for Endpoint Workspace ID and Wo
Specifically, for Windows 7 SP1, the following patches must be installed:
- - Install [KB4074598](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598)
- - Install either [.NET Framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) **or** [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework). Do not install both on the same system.
+ - Install [KB4074598](https://support.microsoft.com/servicing/os/windows-7/2018/02/february-13-2018-kb4074598-monthly-rollup)
+ - Install either [.NET Framework 4.5 or later](/dotnet/framework/install/guide-for-developers) **or** [KB3154518](https://support.microsoft.com/topic/support-for-tls-system-default-versions-included-in-the-net-framework-3-5-1-on-windows-7-sp1-and-server-2008-r2-sp1-5ef38dda-8e6c-65dc-c395-62d2df58715a). Do not install both on the same system.
1. If you're using a proxy to connect to the Internet see the Configure proxy settings section.
@@ -207,9 +207,9 @@ Microsoft Defender Antivirus is a built-in anti-malware solution that provides n
In certain industries or some select enterprise customers might have specific needs on how Antivirus is configured.
- [Quick scan versus full scan and custom scan](/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus#quick-scan-versus-full-scan-and-custom-scan)
+ [Quick scan versus full scan and custom scan](schedule-antivirus-scans.md#comparing-the-quick-scan-full-scan-and-custom-scan)
- For more information, see [Windows Security configuration framework](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework).
+ For more information, see [Windows Security configuration framework](https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md).
:::image type="content" source="media/cd7daeb392ad5a36f2d3a15d650f1e96.png" alt-text="The next-generation protection pane2" lightbox="media/cd7daeb392ad5a36f2d3a15d650f1e96.png":::
@@ -352,5 +352,3 @@ You have now successfully configured Controlled folder access in test mode.
## Related article
- [Onboarding using Microsoft Configuration Manager](onboarding-endpoint-manager.md)
-
-
diff --git a/defender-endpoint/onboarding-notification.md b/defender-endpoint/onboarding-notification.md
index fb1b9c3305a..9523a01966b 100644
--- a/defender-endpoint/onboarding-notification.md
+++ b/defender-endpoint/onboarding-notification.md
@@ -10,11 +10,11 @@ ms.collection:
- tier2
ms.topic: how-to
ms.subservice: onboard
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -38,6 +38,8 @@ You need to have access to:
## Create the notification flow
+Perform the following steps to create the notification flow in Power Automate:
+
1. Go to the [Power Automate portal](https://make.powerautomate.com/) and sign in.
1. Navigate to **My flows > New > Scheduled - from blank**.
@@ -52,7 +54,7 @@ You need to have access to:
:::image type="content" source="media/build-flow.png" alt-text="The notification flow" lightbox="media/build-flow.png":::
-1. Select the + button to add a new action. The new action is an HTTP request to the Defender for Endpoint devices API. You can also replace it with the out-of-the-box **WDATP Connector** (action: **Machines - Get list of machines**).
+1. Select the + button to add a new action. This action adds an HTTP request to the Defender for Endpoint devices API. You can also replace it with the out-of-the-box **WDATP Connector** (action: **Machines - Get list of machines**).
:::image type="content" source="media/recurrence-add.png" alt-text="The recurrence and add action" lightbox="media/recurrence-add.png":::
@@ -191,7 +193,7 @@ The following image is an example of an email notification.
Use the following tips when configuring the notification flow:
-- You can filter here using lastSeen only:
+- In the device query, you can filter by using the lastSeen property only:
- Every 60 min:
- Take all devices last seen in the past seven days.
@@ -199,15 +201,15 @@ Use the following tips when configuring the notification flow:
- If last seen property is on the one hour interval of [-7 days, -7days + 60 minutes] -> Alert for offboarding possibility.
- If first seen is on the past hour -> Alert for onboarding.
-In this solution, you don't have duplicate alerts.
+With this filtering approach, duplicate alerts are not generated.
There are tenants that have numerous devices. Getting all those devices might require paging.
You can split the device lookup into two queries:
-1. For offboarding take only this interval using the OData $filter and only notify if the conditions are met.
+1. For offboarding, take only the one-hour interval of [-7 days, -7 days + 60 minutes] using the OData $filter and only notify if the conditions are met.
-1. Take all devices last seen in the past hour and check first seen property for them (if the first seen property is on the past hour, the last seen must be there too).
+1. Take all devices last seen in the past hour and check first seen property for them (if the first seen property is within the past hour, the last seen must also be within the same past-hour window).
diff --git a/defender-endpoint/overview-client-analyzer.md b/defender-endpoint/overview-client-analyzer.md
index 2944de6ac16..44d3a4d0106 100644
--- a/defender-endpoint/overview-client-analyzer.md
+++ b/defender-endpoint/overview-client-analyzer.md
@@ -26,7 +26,7 @@ The [Microsoft Defender for Endpoint Client Analyzer](https://aka.ms/MDEClientAn
Besides obvious sensor health issues, MDECA can collect other traces, logs, and diagnostic information for troubleshooting complex scenarios such as:
- Application compatibility (AppCompat), performance, network connectivity, or
-- Unexpected behavior related to [Endpoint Data Loss Prevention](/microsoft-365/compliance/endpoint-dlp-learn-about).
+- Unexpected behavior related to [Endpoint Data Loss Prevention](/purview/endpoint-dlp-learn-about).
## Use the client analyzer on devices running Windows, Linux, or macOS
diff --git a/defender-endpoint/performance-analyzer-reference.md b/defender-endpoint/performance-analyzer-reference.md
index 7c209867b76..58ae79a28cc 100644
--- a/defender-endpoint/performance-analyzer-reference.md
+++ b/defender-endpoint/performance-analyzer-reference.md
@@ -50,7 +50,7 @@ New-MpPerformanceRecording -RecordTo
*This method doesn't override tamper protection settings that are set in the Microsoft Defender portal, Intune, or Configuration Manager, and it isn't intended to be used by organizations.* |
> [!TIP]
-> If you're using Group Policy to manage Microsoft Defender Antivirus settings, keep in mind that any changes made to tamper-protected settings are ignored. If you must make changes to a device and those changes are blocked by tamper protection, use [troubleshooting mode](enable-troubleshooting-mode.md) to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state. To change the values on tamper-protected settings permanently, disable tamper protection temporarily before turning it back on after the settings have changed. Keep in mind that temporarily disabling tamper protection can pose security risks, and doesn't work on devices that are offline when tamper protection was temporarily disabled. For this reason, we recommend using other management methods for Defender for Endpoint settings, such as Intune, instead of using Group Policy.
+> If you're using Group Policy to manage Microsoft Defender Antivirus settings, keep in mind that any changes made to tamper-protected settings are ignored. If you must make changes to a device and those changes are blocked by tamper protection, use [troubleshooting mode](enable-troubleshooting-mode.md) to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state. To change the values on tamper-protected settings permanently, disable tamper protection temporarily before turning it back on after the settings have changed. Keep in mind that temporarily disabling tamper protection can pose security risks, and doesn't work on devices that are offline when tamper protection was temporarily disabled. Because temporarily disabling tamper protection poses security risks and doesn't work on offline devices, we recommend using other management methods for Defender for Endpoint settings, such as Intune, instead of using Group Policy.
## Protect Microsoft Defender Antivirus exclusions
@@ -134,6 +137,7 @@ To learn more about Microsoft Defender Vulnerability Management, see [Dashboard
## Related content
+- [Controlled configuration in Microsoft Defender for Endpoint](secure-controlled-configuration.md)
- [Built-in protection helps guard against ransomware](built-in-protection.md)
- [Frequently asked questions on tamper protection](faqs-on-tamper-protection.yml)
- [Troubleshoot problems with tamper protection](troubleshoot-problems-with-tamper-protection.yml)
diff --git a/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus.md b/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus.md
index e7fff556b2b..42091d190d6 100644
--- a/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus.md
+++ b/defender-endpoint/prevent-end-user-interaction-microsoft-defender-antivirus.md
@@ -5,8 +5,8 @@ ms.service: defender-endpoint
ms.localizationpriority: medium
author: paulinbar
ms.author: painbar
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/17/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: pahuijbr
ms.subservice: ngp
ms.topic: how-to
@@ -50,7 +50,7 @@ With the setting set to **Disabled** or not configured:
> [!NOTE]
> Hiding the interface will also prevent Microsoft Defender Antivirus notifications from appearing on the endpoint. Microsoft Defender for Endpoint notifications will still appear. You can also individually [configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md)
-In earlier versions of Windows 10, the setting hides the Windows Defender client interface. If the user attempts to open the Windows Defender client interface, they'll receive a warning that says, "Your system administrator has restricted access to this app."
+In earlier versions of Windows 10, the **Enable headless UI mode** setting hides the Windows Defender client interface. If the user attempts to open the Windows Defender client interface, they'll receive a warning that says, "Your system administrator has restricted access to this app."
:::image type="content" source="/defender/media/wdav-headless-mode-1607.png" alt-text="The warning message when headless mode is enabled in Windows 10, versions earlier than 1703" lightbox="/defender/media/wdav-headless-mode-1607.png":::
@@ -68,14 +68,14 @@ To hide the Microsoft Defender Antivirus interface by using Group Policy, perfor
1. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Select **OK**.
-See [Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) for additional policy settings that prevent users from modifying protection on their PCs.
+See [Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) for other Microsoft Defender Antivirus policy settings that prevent users from modifying protection on their PCs.
## Prevent users from pausing a scan
You can prevent users from pausing scans, which can be helpful to ensure scheduled or on-demand scans aren't interrupted by users.
> [!NOTE]
-> This setting is not supported on Windows 10.
+> The **Allow users to pause scan** setting is not supported on Windows 10.
### Use Group Policy to prevent users from pausing a scan
@@ -96,12 +96,14 @@ To prevent users from pausing a scan by using Group Policy, perform the followin
The `UILockdown` parameter indicates whether to disable UI Lockdown mode. If you specify a value of `$True`, Microsoft Defender Antivirus disables UI Lockdown mode. If you specify a value of `$False` or don't specify a value, UI Lockdown mode is enabled.
-```
+```powershell
PS C:\>Set-MpPreference -UILockdown $true
```
## Related articles
+For more information, see the following articles:
+
- [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md)
- [Configure end-user interaction with Microsoft Defender Antivirus](configure-local-policy-overrides-microsoft-defender-antivirus.md)
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-windows.md)
diff --git a/defender-endpoint/production-deployment.md b/defender-endpoint/production-deployment.md
index b91bbb88391..30341241787 100644
--- a/defender-endpoint/production-deployment.md
+++ b/defender-endpoint/production-deployment.md
@@ -11,10 +11,10 @@ ms.collection:
- m365solution-scenario
- highpri
- tier1
-ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1014
+ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1016
ms.topic: how-to
ms.subservice: onboard
-ms.date: 06/17/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
@@ -34,7 +34,7 @@ In this Microsoft Defender for Endpoint deployment guide, you're guided through
[!INCLUDE [side-by-side-scenarios](includes/side-by-side-scenarios.md)]
-This Defender for Endpoint deployment guide covers only deployments that use Microsoft Configuration Manager. Defender for Endpoint supports the use of other onboarding tools but we won't cover those scenarios in the deployment guide. For more information, see [Identify Defender for Endpoint architecture and deployment method](deployment-strategy.md).
+This Defender for Endpoint deployment guide covers only deployments that use Microsoft Configuration Manager. Defender for Endpoint supports the use of other onboarding tools but this deployment guide doesn't cover those onboarding-tool scenarios. For more information, see [Identify Defender for Endpoint architecture and deployment method](deployment-strategy.md).
[!Include [defender-endpoint-setup-guide.md](../includes/mde-automated-setup-guide.md)]
@@ -46,7 +46,8 @@ Checking the license state and whether the license was properly provisioned can
- In the [Microsoft Azure portal](https://portal.azure.com/#home), under **Manage Microsoft Entra ID**, select **View**. Then, under **Manage**, select **Licenses**.
-## Cloud Service Provider validation
+
+## Validate your Cloud Solution Provider setup
If you're a Cloud Service Provider (CSP) partner managing a customer tenant, you can check which licenses are provisioned and verify their state through the Microsoft 365 admin center.
@@ -56,7 +57,8 @@ If you're a Cloud Service Provider (CSP) partner managing a customer tenant, you
:::image type="content" source="media/atp-O365-admin-portal-customer.png" alt-text="The Office 365 admin portal" lightbox="media/atp-O365-admin-portal-customer.png":::
-## Tenant Configuration
+
+## Configure your tenant settings
To provision Defender for Endpoint in your tenant, follow these steps:
@@ -67,11 +69,13 @@ To provision Defender for Endpoint in your tenant, follow these steps:
- Under **Assets**, select **Devices**.
- Under **Endpoints**, select an item, such as **Dashboard** or **Endpoint security policies**.
-## Data center location
+
+## Review data center location requirements
-Microsoft Defender for Endpoint stores and process data in the [same location as used by Microsoft Defender XDR](/defender-xdr/m365d-enable). If Microsoft Defender XDR hasn't been turned on yet, onboarding to Defender for Endpoint also turns on Defender XDR, and a new data center location is automatically selected based on the location of active Microsoft 365 security services. The selected data center location is shown on the screen.
+Microsoft Defender for Endpoint stores and process data in the [same location as used by Microsoft Defender XDR](/defender-xdr/m365d-enable). If Microsoft Defender XDR hasn't been turned on yet, onboarding to Defender for Endpoint also turns on Defender XDR, and a new data center location is automatically selected based on the location of active Microsoft 365 security services. The selected data center location is shown in the Microsoft Defender portal.
-## Network configuration
+
+## Configure network access for deployment
Ensure devices can connect to the Defender for Endpoint cloud services. The use of a proxy is recommended. See the following articles to configure your network:
@@ -81,12 +85,12 @@ Ensure devices can connect to the Defender for Endpoint cloud services. The use
1. [Verify client connectivity to Microsoft Defender for Endpoint service URLs](verify-connectivity.md).
-In environments that restrict outbound URL-based filtering, you might want to allow traffic to specific IP addresses. Not all services are accessible in this way and you need to evaluate how to address this potential issue in your environment. For example, you might need to download updates to a central location and then distribute them. For more information, see [Configure connectivity using static IP ranges](./configure-device-connectivity.md#option-2-configure-connectivity-using-static-ip-ranges).
+In environments that restrict outbound URL-based filtering, you might want to allow traffic to specific IP addresses. Not all services are accessible through specific IP addresses, and you need to evaluate how to address this potential issue in your environment. For example, you might need to download updates to a central location and then distribute them. For more information, see [Configure connectivity using static IP ranges](./configure-device-connectivity.md#option-2-configure-connectivity-using-static-ip-ranges).
## Next steps
-After you complete the environment setup described in this article, proceed to assign the required roles and permissions:
+After you complete the environment setup described in this guide, proceed to assign the required roles and permissions:
> [!div class="nextstepaction"]
> [Step 2 - Assign roles and permissions](prepare-deployment.md)
diff --git a/defender-endpoint/rbac.md b/defender-endpoint/rbac.md
index 5a682b50d77..ab9dc63bc3f 100644
--- a/defender-endpoint/rbac.md
+++ b/defender-endpoint/rbac.md
@@ -9,18 +9,15 @@ ms.collection:
- m365-security
- tier2
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 07/28/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
# Manage portal access using role-based access control
-> [!NOTE]
-> If you are running the Microsoft Defender XDR preview program, you can now experience the new Microsoft Defender 365 Unified role-based access control (RBAC) model. For more information, see [Microsoft Defender 365 Unified role-based access control (RBAC)](/defender-xdr/manage-rbac).
-
> [!IMPORTANT]
> Starting February 16, 2025, new Microsoft Defender for Endpoint customers will only have access to the Unified Role-Based Access Control (URBAC).
> Existing customers keep their current roles and permissions. For more information, see URBAC [Unified Role-Based Access Control (URBAC) for Microsoft Defender for Endpoint](/defender-xdr/manage-rbac)
@@ -57,7 +54,7 @@ To implement role-based access, you need to define admin roles, assign correspon
## Before you begin
-Before using RBAC, it's important that you understand the roles that can grant permissions and the consequences of turning on RBAC.
+Before using RBAC, it's important that you understand which Microsoft Entra roles can grant Defender for Endpoint permissions and the consequences of turning on RBAC.
> [!WARNING]
> Before enabling RBAC, it's important that you have an appropriate role, such as Security Administrator assigned in Microsoft Entra ID, and that you have your Microsoft Entra groups ready to reduce the risk of being locked out of the Microsoft Defender portal.
diff --git a/defender-endpoint/release-notes-mde-archive.md b/defender-endpoint/release-notes-mde-archive.md
index c798c9d769a..3ca92b5cafb 100644
--- a/defender-endpoint/release-notes-mde-archive.md
+++ b/defender-endpoint/release-notes-mde-archive.md
@@ -6,7 +6,7 @@ ms.subservice: reference
ms.author: lwainstein
author: limwainstein
ms.localizationpriority: medium
-ms.date: 02/18/2026
+ms.date: 08/25/2026
ai-usage: ai-assisted
ms.collection:
- m365-security
@@ -26,22 +26,22 @@ This page contains archived platform-specific build and version history for Micr
### May-2024 (Release version: 10.8750.27558.1004)
-|OS |KB |Release version |
-| -------- | -------- | -------- |
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8750.27558.1004|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8750.27558.1004|
#### What's new
##### Configuration Management
-- Fixed an issue that caused empty policies to appear in the UI.
-- Configured Windows Defender Application Control (WDAC) policies to block undesired applications from running on the device.
+- Fixed an issue that caused empty policies to appear in the UI.
+- Configured Windows Defender Application Control (WDAC) policies to block undesired applications from running on the device.
### Feb-2024 (Release version: 10.8735.26020.1009)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8735.26020.1009|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8735.26020.1009|
#### What's new
@@ -49,7 +49,7 @@ This page contains archived platform-specific build and version history for Micr
- Enabled support for IPV6 connections in Live Response connection commands.
- Fixed an issue in Downlevel Unified Agent that caused ServerRoles not to be populated.
-
+
##### Threat Vulnerability Management
- An issue related to the agent's monitoring of deleted registry keys no longer occurs.
@@ -59,20 +59,20 @@ This page contains archived platform-specific build and version history for Micr
- Introduced performance enhancements to minimize the CPU and memory footprint of the agent.
- Enhanced the accuracy of network detections.
-
+
##### Data Loss Prevention (DLP)
- Introduced multiple performance and stability fixes.
-
+
##### Security Configuration Management
-- Policies that include special characters are now supported.
+- Policies that include special characters are now supported.
### Dec-2023 (Release version: 10.8672.25926.1019)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8672.25926.1019|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8672.25926.1019|
#### What's new
@@ -80,9 +80,9 @@ This page contains archived platform-specific build and version history for Micr
### Sept-2023 (Release version: 10.8560.25364.1036)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8560.25364.1036|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8560.25364.1036|
#### What's new
@@ -90,9 +90,9 @@ This page contains archived platform-specific build and version history for Micr
### May-2023 (Release version: 10.8295.22621.1023)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8295.22621.1023|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8295.22621.1023|
#### What's new
@@ -100,9 +100,9 @@ This page contains archived platform-specific build and version history for Micr
### Jan/Feb-2023 (Release version: 10.8295.22621.1019)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8295.22621.1019|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8295.22621.1019|
#### What's new
@@ -110,23 +110,23 @@ This page contains archived platform-specific build and version history for Micr
### Dec-2022 (Release version: 10.8210.22621.1016)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8210.22621.1016|
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8210.22621.1016|
-**What's new**
+#### What's new
- Bug fixes and stability improvements
### Aug-2022 (Release version: 10.8210.*)
-|OS |KB |Release version |
-|---------|---------|---------|
-|Windows Server 2012 R2, 2016 |[KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)|10.8210.22621.1011|
-|Windows 11 21H2 (Cobalt)
(Windows 11 SV 21H2) | [KB5016691](https://support.microsoft.com/topic/august-25-2022-kb5016691-os-build-22000-918-preview-59097044-915a-49a0-8870-49823236adbd) | 10.8210.22000.918 |
-|Server 2022 (Iron) | [KB5016693](https://support.microsoft.com/topic/august-16-2022-kb5016693-os-build-20348-946-preview-ee90d0bc-c162-4124-b7c6-f963ee7b17ed) |10.8210.20348.946 |
-|Windows 10 20H2/21H1/21H2
Windows Server 20H2 (Vibranium) | [KB5016688](https://support.microsoft.com/topic/august-26-2022-kb5016688-os-builds-19042-1949-19043-1949-and-19044-1949-preview-ec31ebdc-067d-44dd-beb0-eabcc984d843) | 10.8210.19041.1949 |
-|Windows Server 2019 (RS5) |[KB5016690](https://support.microsoft.com/topic/august-23-2022-kb5016690-os-build-17763-3346-preview-b81d1ac5-75c7-42c1-b638-f13aa4242f42) |10.8210.17763.3346 |
+|OS|KB|Release version|
+|---|---|---|
+|Windows Server 2012 R2, 2016|[KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor)|10.8210.22621.1011|
+|Windows 11 21H2 (Cobalt)
(Windows 11 SV 21H2)|[KB5016691](https://support.microsoft.com/servicing/os/windows-11/2022/08/august-25-2022-kb5016691-os-build-22000-918-preview)|10.8210.22000.918|
+|Server 2022 (Iron)|[KB5016693](https://support.microsoft.com/servicing/os/windows-server/2022/08/august-16-2022-kb5016693-os-build-20348-946-preview)|10.8210.20348.946|
+|Windows 10 20H2/21H1/21H2
Windows Server 20H2 (Vibranium)|[KB5016688](https://support.microsoft.com/servicing/os/windows-10/2022/08/august-26-2022-kb5016688-os-builds-19042-1949-19043-1949-and-19044-1949-preview)|10.8210.19041.1949|
+|Windows Server 2019 (RS5)|[KB5016690](https://support.microsoft.com/servicing/os/windows-10/2022/08/august-23-2022-kb5016690-os-build-17763-3346-preview)|10.8210.17763.3346|
#### What's new
@@ -140,7 +140,7 @@ This page contains archived platform-specific build and version history for Micr
- Live Response improvements include reduced session creation latency when using proxies, an undo remediation manual command, support for OneDrive shares in `FindFile` action, and improved isolation and stability.
- [Security Management for Microsoft Defender for Endpoint](/intune/intune-service/protect/mde-security-integration#configure-your-tenant-to-support-microsoft-defender-for-endpoint-security-configuration-management) now provides the ability to sync the device configuration on demand instead of waiting for a specific cadence.
- > [!NOTE]
+ > [!NOTE]
> Update package KB5005292 is on a gradual rollout schedule through Windows Update. Towards the end of this schedule, the package will be published completely, including to the update catalog for manual download. For the current release, this will be in the second half of October. If you want to test the package sooner, you can use [gradual rollout controls for platform updates](configure-updates.md) to select the Preview channel.
## macOS releases
@@ -149,225 +149,224 @@ This page contains archived platform-specific build and version history for Micr
#### Release details
-| Release version | Engine version | Signature version |
-| -------- | -------- |-------- |
-|20.125062.6.0 |1.1.25070.3000 |1.435.357.0 |
+|Release version|Engine version|Signature version|
+|---|---|---|
+|20.125062.6.0|1.1.25070.3000|1.435.357.0|
#### Enhancements and features
-| Feature area | Update summary |
-|--------------|---------------|
-| General | Bug and performance fixes. |
+|Feature area|Update summary|
+|---|---|
+|General|Bug and performance fixes.|
-### Jul-2025 (Build: 101.25062.0005 | Release version: 20.125062.5.0)
+### Jul-2025 (Build: 101.25062.0005 | Release version: 20.125062.5.0)
-| Build: | **101.25062.0005** |
-|--------------------|----------------------|
-| Release version: | **20.125062.5.0** |
-| Engine version: | **1.1.25040.3000** |
-| Signature version: | **1.427.248.0** |
+|Build:|**101.25062.0005**|
+|---|---|
+|Release version:|**20.125062.5.0**|
+|Engine version:|**1.1.25040.3000**|
+|Signature version:|**1.427.248.0**|
-##### What's new
+#### What's new
- Bug and performance fixes
-### Jun-2025 (Build: 101.25052.0012 | Release version: 20.125052.12.0)
+### Jun-2025 (Build: 101.25052.0012 | Release version: 20.125052.12.0)
-| Build: | **101.25052.0012** |
-|--------------------|----------------------|
-| Release version: | **20.125052.12.0** |
-| Engine version: | **1.1.25060.3000** |
-| Signature version: | **1.431.226.0** |
+|Build:|**101.25052.0012**|
+|---|---|
+|Release version:|**20.125052.12.0**|
+|Engine version:|**1.1.25060.3000**|
+|Signature version:|**1.431.226.0**|
-##### What's new
+#### What's new
- Bug and performance fixes
-### May-2025 (Build: 101.25042.0009 | Release version: 20.125042.9.0)
+### May-2025 (Build: 101.25042.0009 | Release version: 20.125042.9.0)
-| Build: | **101.25042.0009** |
-|--------------------|----------------------|
-| Release version: | **20.125042.9.0** |
-| Engine version: | **1.1.25040.3000** |
-| Signature version: | **1.429.521.0** |
+|Build:|**101.25042.0009**|
+|---|---|
+|Release version:|**20.125042.9.0**|
+|Engine version:|**1.1.25040.3000**|
+|Signature version:|**1.429.521.0**|
-##### What's new
+#### What's new
- `mdatp health --details edr` now includes Azure Active Directory information
- Bug and performance fixes
-### Apr-2025 (Build: 101.25032.0006 | Release version: 20.125032.6.0)
+### Apr-2025 (Build: 101.25032.0006 | Release version: 20.125032.6.0)
-| Build: | **101.25032.0006** |
-|--------------------|----------------------|
-| Release version: | **20.125032.6.0** |
-| Engine version: | **1.1.25020.3000** |
-| Signature version: | **1.427.158.0** |
+|Build:|**101.25032.0006**|
+|---|---|
+|Release version:|**20.125032.6.0**|
+|Engine version:|**1.1.25020.3000**|
+|Signature version:|**1.427.158.0**|
-##### What's new
+#### What's new
- Hardware UUID is now displayed in the Security Portal
- Bug and performance fixes
- **(GA) Behavior Monitoring for macOS**: For information on Behavior Monitoring for Microsoft Defender for Endpoint on macOS, see [Behavior Monitoring in Microsoft Defender for Endpoint on macOS](behavior-monitor-macos.md).
-### Mar-2025 (Build: 101.25022.0003 | Release version: 20.125022.3.0)
+### Mar-2025 (Build: 101.25022.0003 | Release version: 20.125022.3.0)
-| Build: | **101.25022.0003** |
-|--------------------|-----------------------|
-| Release version: | **20.125022.3.0** |
-| Engine version: | **1.1.24090.12** |
-| Signature version: | **1.423.249.0** |
+|Build:|**101.25022.0003**|
+|---|---|
+|Release version:|**20.125022.3.0**|
+|Engine version:|**1.1.24090.12**|
+|Signature version:|**1.423.249.0**|
-##### What's new
+#### What's new
- Bug and performance fixes
-### Mar-2025 (Build: 101.25012.0008 | Release version: 20.125012.7.0)
+### Mar-2025 (Build: 101.25012.0008 | Release version: 20.125012.7.0)
-| Build: | **101.25012.0008** |
-|--------------------|-----------------------|
-| Release version: | **20.125012.7.0** |
-| Engine version: | **1.1.25020.3000** |
-| Signature version: | **1.423.211.0** |
+|Build:|**101.25012.0008**|
+|---|---|
+|Release version:|**20.125012.7.0**|
+|Engine version:|**1.1.25020.3000**|
+|Signature version:|**1.423.211.0**|
-##### What's new
+#### What's new
- Bug fixes and performance improvements
-### Feb-2025 (Build: 101.24122.0011 | Release version: 20.124122.11.0)
+### Feb-2025 (Build: 101.24122.0011 | Release version: 20.124122.11.0)
-| Build: | **101.24122.0011** |
-|--------------------|-----------------------|
-| Release version: | **20.124122.11.0** |
-| Engine version: | **1.1.24080.11** |
-| Signature version: | **1.419.351.0** |
+|Build:|**101.24122.0011**|
+|---|---|
+|Release version:|**20.124122.11.0**|
+|Engine version:|**1.1.24080.11**|
+|Signature version:|**1.419.351.0**|
-##### What's new
+#### What's new
- Fixed an issue with the auth prompt during new installation on macOS with multiple active users
- Improved stability when using the antivirus engine in passive mode
-### Jan-2025 (Build: 101.24122.0005 | Release version: 20.124122.5.0)
+### Jan-2025 (Build: 101.24122.0005 | Release version: 20.124122.5.0)
-| Build: | **101.24122.0005** |
-|--------------------|-----------------------|
-| Release version: | **20.124122.4.0** |
-| Engine version: | **1.1.24080.11** |
-| Signature version: | **1.419.351.0** |
+|Build:|**101.24122.0005**|
+|---|---|
+|Release version:|**20.124122.4.0**|
+|Engine version:|**1.1.24080.11**|
+|Signature version:|**1.419.351.0**|
-##### What's new
+#### What's new
- Removed support of macOS 12, the minimal requirement is now macOS 13.0 or later
- Fix: Defender quarantines a file even if it's marked as immutable
- `mdatp health` can return [`out_of_date`](device-health-microsoft-defender-antivirus-health.md#up-to-date-definitions) status for `definitions_status`
- Bug and performance fixes
-### Dec-2024 (Build: 101.24102.0018 | Release version: 20.124102.18.0)
+### Dec-2024 (Build: 101.24102.0018 | Release version: 20.124102.18.0)
-| Build: | **101.24102.0018** |
-|--------------------|-----------------------|
-| Release version: | **20.124102.18.0** |
-| Engine version: | **1.1.24080.10** |
-| Signature version: | **1.419.298.0** |
+|Build:|**101.24102.0018**|
+|---|---|
+|Release version:|**20.124102.18.0**|
+|Engine version:|**1.1.24080.10**|
+|Signature version:|**1.419.298.0**|
-##### What's new
+#### What's new
- **Improved User/Group Permission Handling** - Added reporting in `mdatp-health` for user/group permission issues for Defender files. On restart Defender attempts to cure these issues.
- Bug and performance fixes.
-### Oct-2024 (Build: 101.24092.0004 | Release version: 20.124092.4.0)
+### Oct-2024 (Build: 101.24092.0004 | Release version: 20.124092.4.0)
-| Build: | **101.24092.0004** |
-|--------------------|-----------------------|
-| Release version: | **20.124092.4.0** |
-| Engine version: | **1.1.24080.11** |
-| Signature version: | **1.421.14.0** |
+|Build:|**101.24092.0004**|
+|---|---|
+|Release version:|**20.124092.4.0**|
+|Engine version:|**1.1.24080.11**|
+|Signature version:|**1.421.14.0**|
-##### What's new
+#### What's new
- Bug and performance fixes
-### Oct-2024 (Build: 101.24082.0009 | Release version: 20.124082.9.0)
+### Oct-2024 (Build: 101.24082.0009 | Release version: 20.124082.9.0)
-| Build: | **101.24082.0009** |
-|--------------------|-----------------------|
-| Release version: | **20.124082.9.0** |
-| Engine version: | **1.1.24080.9** |
-| Signature version: | **1.411.410.0** |
+|Build:|**101.24082.0009**|
+|---|---|
+|Release version:|**20.124082.9.0**|
+|Engine version:|**1.1.24080.9**|
+|Signature version:|**1.411.410.0**|
-##### What's new
+#### What's new
- Product improvements and performance fixes
-### Sep-2024 (Build: 101.24072.0007 | Release version: 20.124072.7)
+### Sep-2024 (Build: 101.24072.0007 | Release version: 20.124072.7)
-| Build: | **101.24072.0007** |
-|--------------------|-----------------------|
-| Release version: | **20.124072.7** |
-| Engine version: | **1.1.24080.9** |
-| Signature version: | **1.411.410.0** |
+|Build:|**101.24072.0007**|
+|---|---|
+|Release version:|**20.124072.7**|
+|Engine version:|**1.1.24080.9**|
+|Signature version:|**1.411.410.0**|
-##### What's new
+#### What's new
- Resolved the issue causing outdated vulnerability assessments impacting some macOS devices
-### Aug-2024 (Build: 101.24072.0006 | Release version: 20.124072.6.0)
+### Aug-2024 (Build: 101.24072.0006 | Release version: 20.124072.6.0)
-| Build: | **101.24072.0006** |
-|--------------------|-----------------------|
-| Release version: | **20.124072.6.0** |
-| Engine version: | **1.1.24060.7** |
-| Signature version: | **1.417.325.0** |
+|Build:|**101.24072.0006**|
+|---|---|
+|Release version:|**20.124072.6.0**|
+|Engine version:|**1.1.24060.7**|
+|Signature version:|**1.417.325.0**|
-##### What's new
+#### What's new
- Product improvements and performance fixes
-### Jul-2024 (Build: 101.24062.0009 | Release version: 20.124062.9.0)
+### Jul-2024 (Build: 101.24062.0009 | Release version: 20.124062.9.0)
-| Build: | **101.24062.0009** |
-|--------------------|-----------------------|
-| Release version: | **20.124062.9.0** |
-| Engine version: | **1.1.24050.7** |
-| Signature version: | **1.411.410.0** |
+|Build:|**101.24062.0009**|
+|---|---|
+|Release version:|**20.124062.9.0**|
+|Engine version:|**1.1.24050.7**|
+|Signature version:|**1.411.410.0**|
-##### What's new
+#### What's new
- Product improvements and performance fixes
-### Jun-2024 (Build: 101.24052.0013 | Release version: 20.124052.13.0)
+### Jun-2024 (Build: 101.24052.0013 | Release version: 20.124052.13.0)
-| Build: | **101.24052.0013** |
-|--------------------|-----------------------|
-| Release version: | **20.124052.13.0** |
-| Engine version: | **1.1.24040.2** |
-| Signature version: | **1.411.153.0** |
+|Build:|**101.24052.0013**|
+|---|---|
+|Release version:|**20.124052.13.0**|
+|Engine version:|**1.1.24040.2**|
+|Signature version:|**1.411.153.0**|
-##### What's new
+#### What's new
- [[device control](mac-device-control-overview.md)] Secure Digital cards aren't recognized on newer macOS
- Product improvements and performance fixes
-### May-2024 (Build: 101.24042.0008 | Release version: 20.124042.8.0)
+### May-2024 (Build: 101.24042.0008 | Release version: 20.124042.8.0)
-| Build: | **101.24042.0008** |
-|--------------------|----------------------|
-| Release version: | **20.124042.8.0** |
-| Engine version: | **1.1.24040.1** |
-| Signature version: | **1.413.13.0** |
+|Build:|**101.24042.0008**|
+|---|---|
+|Release version:|**20.124042.8.0**|
+|Engine version:|**1.1.24040.1**|
+|Signature version:|**1.413.13.0**|
#### What's new
- Product improvements and performance fixes
-### Apr-2024 (Build: 101.24032.0006 | Release version: 20.124032.06.0)
-
-| Build: | **101.24032.0006** |
-|--------------------|-----------------------|
-| Release version: | **20.124012.10.0** |
-| Engine version: | **1.1.24030.4** |
-| Signature version: | **1.407.521.0** |
+### Apr-2024 (Build: 101.24032.0006 | Release version: 20.124032.06.0)
+|Build:|**101.24032.0006**|
+|---|---|
+|Release version:|**20.124012.10.0**|
+|Engine version:|**1.1.24030.4**|
+|Signature version:|**1.407.521.0**|
#### What's new
@@ -375,32 +374,32 @@ This page contains archived platform-specific build and version history for Micr
- Remove Big Sur from supported versions of macOS
- [[device control](mac-device-control-overview.md)] Fix Bluetooth support on Sonoma (see the note later in this section)
- Product improvements and performance fixes
-- **(GA) Troubleshooting mode for macOS**. Troubleshooting mode helps you identify instances where antivirus might be causing issues with your applications or system resources. To learn more, see [Troubleshooting mode in Microsoft Defender for Endpoint on macOS](mac-troubleshoot-mode.md).
+- **(GA) Troubleshooting mode for macOS**. Troubleshooting mode helps you identify instances where antivirus might be causing issues with your applications or system resources. To learn more, see [Troubleshooting mode in Microsoft Defender for Endpoint on macOS](mac-troubleshoot-mode.md).
> [!NOTE]
> You need to deploy a new MDM configuration profile for Defender to access Bluetooth.
> See details for [JAMF](mac-jamfpro-policies.md#step-10-grant-bluetooth-permissions) and [Intune](mac-install-with-intune.md#step-7-bluetooth-permissions).
-### Mar-2024 (Build: 101.24012.0010 | Release version: 20.124012.10.0)
+### Mar-2024 (Build: 101.24012.0010 | Release version: 20.124012.10.0)
-| Build: | **101.24012.0010** |
-|--------------------|-----------------------|
-| Release version: | **20.124012.10.0** |
-| Engine version: | **1.1.24020.3** |
-| Signature version: | **1.405.788.0** |
+|Build:|**101.24012.0010**|
+|---|---|
+|Release version:|**20.124012.10.0**|
+|Engine version:|**1.1.24020.3**|
+|Signature version:|**1.405.788.0**|
#### What's new
- Product improvements and performance fixes
- **(GA) Built-in Scheduled Scan for macOS**: For information on Scheduled Scan built-in for Microsoft Defender for Endpoint on macOS, see [How to schedule scans with Microsoft Defender for Endpoint on macOS](mac-schedule-scan.md).
-### Jan-2024 (Build: 101.23122.0005 | Release version: 20.123122.5.0)
+### Jan-2024 (Build: 101.23122.0005 | Release version: 20.123122.5.0)
-| Build: | **101.23122.0005** |
-|--------------------|-----------------------|
-| Release version: | **20.123122.5.0** |
-| Engine version: | **1.1.23100.2010** |
-| Signature version: | **1.403.3022.0** |
+|Build:|**101.23122.0005**|
+|---|---|
+|Release version:|**20.123122.5.0**|
+|Engine version:|**1.1.23100.2010**|
+|Signature version:|**1.403.3022.0**|
#### What's new
@@ -409,11 +408,11 @@ This page contains archived platform-specific build and version history for Micr
### Dec-2023 (Build: 101.23102.0020 | Release version: 20.123102.20.0)
-| Build: | **101.23102.0020** |
-|--------------------|--------------------|
-| Release version: | **20.123102.20.0** |
-| Engine version: | **1.1.23090.2005** |
-| Signature version: | **1.401.1729.0** |
+|Build:|**101.23102.0020**|
+|---|---|
+|Release version:|**20.123102.20.0**|
+|Engine version:|**1.1.23090.2005**|
+|Signature version:|**1.401.1729.0**|
#### What's new
@@ -421,11 +420,11 @@ This page contains archived platform-specific build and version history for Micr
### Nov-2023 (Build: 101.23092.0007 | Release version: 20.123092.7.0)
-| Build: | **101.23092.0007** |
-|--------------------|----------------------------|
-| Release version: | **20.123092.7.0** |
-| Engine version: | **1.1.23090.2005** |
-| Signature version: | **1.399.1196.0** |
+|Build:|**101.23092.0007**|
+|---|---|
+|Release version:|**20.123092.7.0**|
+|Engine version:|**1.1.23090.2005**|
+|Signature version:|**1.399.1196.0**|
#### What's new
@@ -437,13 +436,13 @@ This page contains archived platform-specific build and version history for Micr
> Device Control v1 will be considered deprecated in the nearest future.
> To check, run the `[mdatp health --details device_control](mac-device-control-overview.md#status)` command, and inspect the `active` property. It shouldn't contain "v1".
-### Oct-2023 (Build: 101.23082.0018 | Release version: 20.123082.18.0)
+### Oct-2023 (Build: 101.23082.0018 | Release version: 20.123082.18.0)
-| Build: | **101.23082.0018** |
-|--------------------|----------------------------|
-| Release version: | **20.123082.18.0** |
-| Engine version: | **1.1.23070.1002** |
-| Signature version: | **1.399.384.0** |
+|Build:|**101.23082.0018**|
+|---|---|
+|Release version:|**20.123082.18.0**|
+|Engine version:|**1.1.23070.1002**|
+|Signature version:|**1.399.384.0**|
#### What's new
@@ -453,11 +452,11 @@ This page contains archived platform-specific build and version history for Micr
### Sep-2023 (Build: 101.23072.0025 | Release version: 20.123072.25.0)
-| Build: | **101.23072.0025** |
-|--------------------|-----------------------|
-| Release version: | **20.123072.25.0** |
-| Engine version: | **1.1.23050.3** |
-| Signature version: | **1.397.911.0** |
+|Build:|**101.23072.0025**|
+|---|---|
+|Release version:|**20.123072.25.0**|
+|Engine version:|**1.1.23050.3**|
+|Signature version:|**1.397.911.0**|
#### What's new
@@ -466,26 +465,26 @@ This page contains archived platform-specific build and version history for Micr
- Fix: Major performance issues on macOS when Network Protection is set to Audit mode
- **(GA) macOS devices receive built-in protection**. Tamper protection is turned on in block mode by default. This setting helps secure your Mac against threats. To learn more, see [Protect macOS security settings with tamper protection](built-in-protection.md).
-### Aug-2023 (Build: 101.23062.0016 | Release version: 20.123062.16.0)
+### Aug-2023 (Build: 101.23062.0016 | Release version: 20.123062.16.0)
-| Build: | **101.23062.0016** |
-|--------------------|-----------------------|
-| Release version: | **20.123062.16.0** |
-| Engine version: | **1.1.23050.3** |
-| Signature version: | **1.395.436.0** |
+|Build:|**101.23062.0016**|
+|---|---|
+|Release version:|**20.123062.16.0**|
+|Engine version:|**1.1.23050.3**|
+|Signature version:|**1.395.436.0**|
#### What's new
- Product improvements and performance fixes
- Fix: macOS complains that uninstall background task is from unidentified developer
-### Jul-2023 (Build: 101.23052.0004 | Release version: 20.123052.4.0)
+### Jul-2023 (Build: 101.23052.0004 | Release version: 20.123052.4.0)
-| Build: | **101.23052.0004** |
-|--------------------|-----------------------|
-| Release version: | **20.123052.4.0** |
-| Engine version: | **1.1.20100.7** |
-| Signature version: | **1.391.2163.0** |
+|Build:|**101.23052.0004**|
+|---|---|
+|Release version:|**20.123052.4.0**|
+|Engine version:|**1.1.20100.7**|
+|Signature version:|**1.391.2163.0**|
#### What's new
@@ -493,13 +492,13 @@ This page contains archived platform-specific build and version history for Micr
- Fix: Defender doesn't start on a machine with certain versions of Microsoft Edge due to directory permission issue
- Product improvements and performance fixes
-### Jun-2023 (Build: 101.98.84 | Release version: 20.123042.19884.0)
+### Jun-2023 (Build: 101.98.84 | Release version: 20.123042.19884.0)
-| Build: | **101.98.84** |
-|--------------------|-----------------------|
-| Release version: | **20.123042.19884.0** |
-| Engine version: | **1.1.20300.4** |
-| Signature version: | **1.391.221.0** |
+|Build:|**101.98.84**|
+|---|---|
+|Release version:|**20.123042.19884.0**|
+|Engine version:|**1.1.20300.4**|
+|Signature version:|**1.391.221.0**|
#### What's new
@@ -509,13 +508,13 @@ This page contains archived platform-specific build and version history for Micr
Network protection for macOS is now available for all Mac devices onboarded to Defender for Endpoint. Devices must meet the minimum requirements. To learn more, see [Use network protection to help prevent macOS connections to bad sites](network-protection-macos.md).
-### May-2023 (Build: 101.98.71 | Release version: 20.123032.19871.0)
+### May-2023 (Build: 101.98.71 | Release version: 20.123032.19871.0)
-| Build: | **101.98.71** |
-|--------------------|-----------------------|
-| Release version: | **20.123032.19871.0** |
-| Engine version: | **1.1.20300.4** |
-| Signature version: | **1.389.1872.0** |
+|Build:|**101.98.71**|
+|---|---|
+|Release version:|**20.123032.19871.0**|
+|Engine version:|**1.1.20300.4**|
+|Signature version:|**1.389.1872.0**|
#### What's new
@@ -524,37 +523,37 @@ Network protection for macOS is now available for all Mac devices onboarded to D
- Fix: Remove Codesigned Artifact from App Bundle
- Product improvements and performance fixes
-### May-2023 (Build: 101.98.70 | Release version: 20.123022.19870.0)
+### May-2023 (Build: 101.98.70 | Release version: 20.123022.19870.0)
-| Build: | **101.98.70** |
-|--------------------|-----------------------|
-| Release version: | **20.123022.19870.0** |
-| Engine version: | **1.1.20300.4** |
-| Signature version: | **1.389.1396.0** |
+|Build:|**101.98.70**|
+|---|---|
+|Release version:|**20.123022.19870.0**|
+|Engine version:|**1.1.20300.4**|
+|Signature version:|**1.389.1396.0**|
#### What's new
- Product improvements and performance fixes
-### Mar-2023 (Build: 101.98.30 | Release version: 20.123012.19830.0)
+### Mar-2023 (Build: 101.98.30 | Release version: 20.123012.19830.0)
-| Build: | **101.98.30** |
-|--------------------|-----------------------|
-| Release version: | **20.123012.19830.0** |
-| Engine version: | **1.1.20100.6** |
-| Signature version: | **1.385.924.0** |
+|Build:|**101.98.30**|
+|---|---|
+|Release version:|**20.123012.19830.0**|
+|Engine version:|**1.1.20100.6**|
+|Signature version:|**1.385.924.0**|
#### What's new
- Product improvements and performance fixes
-### Feb-2023 (Build: 101.97.94 | Release version: 20.123011.19794.0)
+### Feb-2023 (Build: 101.97.94 | Release version: 20.123011.19794.0)
-| Build: | **101.97.94** |
-|--------------------|-----------------------|
-| Release version: | **20.123011.19794.0** |
-| Engine version: | **1.1.20000.2** |
-| Signature version: | **1.383.104.0** |
+|Build:|**101.97.94**|
+|---|---|
+|Release version:|**20.123011.19794.0**|
+|Engine version:|**1.1.20000.2**|
+|Signature version:|**1.383.104.0**|
#### What's new
@@ -568,46 +567,49 @@ Network protection for macOS is now available for all Mac devices onboarded to D
- **(GA) Live Response available for macOS**
-Live Response for macOS is now available for all Mac devices onboarded to Defender for Endpoint. Devices must meet the minimum requirements. To learn more, see [Investigate entities on devices using live response](live-response.md)
+Live Response for macOS is now available for all Mac devices onboarded to Defender for Endpoint. Devices must meet the minimum requirements. To learn more, see [Investigate entities on devices using live response](live-response.md)
### Nov-2022 (Build: 101.87.30 | Release version: 20.122082.18681.0)
- Released: **Nov 5, 2022**
- Published: **Nov 5, 2022**
- Build: **101.87.30**
- Release version: **20.122082.18681.0**
- Engine version: **1.1.19700.3**
- Signature version: **1.379.17.0**
+|Build:|**101.87.30**|
+|---|---|
+|Released:|**Nov 5, 2022**|
+|Published:|**Nov 5, 2022**|
+|Release version:|**20.122082.18681.0**|
+|Engine version:|**1.1.19700.3**|
+|Signature version:|**1.379.17.0**|
-**What's new**
+#### What's new
- Fix for some users experiencing performance issues and temporary system hangs
- Product improvements and performance fixes
### Oct-2022 (Build: 101.86.81 | Release version: 20.122082.18681.0)
- Released: **Oct 25, 2022**
- Published: **Oct 25, 2022**
- Build: **101.86.81**
- Release version: **20.122082.18681.0**
- Engine version: **1.1.19700.3**
- Signature version: **1.377.636.0**
+|Build:|**101.86.81**|
+|---|---|
+|Released:|**Oct 25, 2022**|
+|Published:|**Oct 25, 2022**|
+|Release version:|**20.122082.18681.0**|
+|Engine version:|**1.1.19700.3**|
+|Signature version:|**1.377.636.0**|
-**What's new**
+#### What's new
- Issue resolution: Upgrade fails if `\_mdatp` user is a member of `\_lpadmin` group
> [!IMPORTANT]
> This is a minimal recommended MDE version for macOS Ventura.
-### Oct-2022 (Build: 101.82.21 | Release version: 20.122082.18221.0)
+### Oct-2022 (Build: 101.82.21 | Release version: 20.122082.18221.0)
- Build: **101.82.21**
- Release version: **20.122082.18221.0**
- Engine version: **1.1.19400.3**
- Signature version: **1.369.962.0**
+|Build:|**101.82.21**|
+|---|---|
+|Release version:|**20.122082.18221.0**|
+|Engine version:|**1.1.19400.3**|
+|Signature version:|**1.369.962.0**|
-**What's new**
+#### What's new
- Fix - macOS TP in Block mode causing device hang on shutdown/crashes on reboot
- Add a mdatp command-line switch to view the on-demand scan history
@@ -617,12 +619,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Sep-2022 (Build: 101.78.13)
- Build: **101.78.13**
- Release version: **20.122072.17813.0**
- Engine version: **1.1.19500.2**
- Signature version: **1.373.556.0**
+|Build:|**101.78.13**|
+|---|---|
+|Release version:|**20.122072.17813.0**|
+|Engine version:|**1.1.19500.2**|
+|Signature version:|**1.373.556.0**|
-**What's new**
+#### What's new
- Fix for uninstaller to properly delete Application Support folder
- Fix for Network Protection not filtering Safari when Firewall or iCloud Private Relay is on
@@ -633,14 +636,15 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Aug-2022 (Build: 101.75.90 | Release version: 20.122071.17590.0)
- Released: **Aug 3, 2022**
- Published: **Aug 3, 2022**
- Build: **101.75.90**
- Release version: **20.122071.17590.0**
- Engine version: **1.1.19300.3**
- Signature version: **1.369.395.0**
+|Build:|**101.75.90**|
+|---|---|
+|Released:|**Aug 3, 2022**|
+|Published:|**Aug 3, 2022**|
+|Release version:|**20.122071.17590.0**|
+|Engine version:|**1.1.19300.3**|
+|Signature version:|**1.369.395.0**|
-**What's new**
+#### What's new
- Added a new field in the output of `mdatp health` that can be used to query the enforcement level of the network protection feature. The new field is called `network_protection_enforcement_level` and can take one of the following values: `audit`, `block`, or `disabled`.
- Addressed a product issue where multiple detections of the same content could lead to duplicate entries in the threat history.
@@ -648,14 +652,15 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jul-2022 (Build: 101.73.77 | Release version: 20.122062.17377.0)
- Released: **Jul 21, 2022**
- Published: **Jul 21, 2022**
- Build: **101.73.77**
- Release version: **20.122062.17377.0**
- Engine version: **1.1.19200.3**
- Signature version: **1.367.1011.0**
+|Build:|**101.73.77**|
+|---|---|
+|Released:|**Jul 21, 2022**|
+|Published:|**Jul 21, 2022**|
+|Release version:|**20.122062.17377.0**|
+|Engine version:|**1.1.19200.3**|
+|Signature version:|**1.367.1011.0**|
-**What's new**
+#### What's new
- Addressed an issue where printing couldn't be completed successfully due to the network extension
- Added an option to [configure file hash computation](mac-preferences.md#configure-file-hash-computation-feature)
@@ -665,12 +670,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jul-2022 (Build: 101.71.18 | Release version: 20.122052.17118.0)
- Released: **Jul 7, 2022**
- Published: **Jul 7, 2022**
- Build: **101.71.18**
- Release version: **20.122052.17118.0**
+|Build:|**101.71.18**|
+|---|---|
+|Released:|**Jul 7, 2022**|
+|Published:|**Jul 7, 2022**|
+|Release version:|**20.122052.17118.0**|
-**What's new**
+#### What's new
- `mdatp connectivity test` added an extra URL. The new URL is [https://go.microsoft.com/fwlink/?linkid=2144709](https://go.microsoft.com/fwlink/?linkid=2144709).
- Up until now, the product log level didn't persist between product restarts. Beginning in this version, there's a new command-line tool switch that persists the log level. The new command is `mdatp log level persist --level
- Published: **Jun 14, 2022**
- Build: **101.70.19**
- Release version: **20.122051.17019.0**
+|Build:|**101.70.19**|
+|---|---|
+|Released:|**Jun 14, 2022**|
+|Published:|**Jun 14, 2022**|
+|Release version:|**20.122051.17019.0**|
-**What's new**
+#### What's new
- Resolved an issue where threat-related notifications weren't always presented to the end user.
- Performance improvements & other updates.
### Jun-2022 (Build: 101.70.18 | Release version: 20.122042.17018.0)
- Released: **Jun 2, 2022**
- Published: **Jun 2, 2022**
- Build: **101.70.18**
- Release version: **20.122042.17018.0**
+|Build:|**101.70.18**|
+|---|---|
+|Released:|**Jun 2, 2022**|
+|Published:|**Jun 2, 2022**|
+|Release version:|**20.122042.17018.0**|
-**What's new**
+#### What's new
- Resolved an issue where the installation package was sometimes hanging indefinitely during product updates
- Resolved an issue where the product sometimes was incorrectly detecting files inside the quarantine folder
@@ -705,24 +713,26 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### May-2022 (Build: 101.66.54 | Release version: 20.122041.16654.0)
- Released: **May 11, 2022**
- Published: **May 11, 2022**
- Build: **101.66.54**
- Release version: **20.122041.16654.0**
+|Build:|**101.66.54**|
+|---|---|
+|Released:|**May 11, 2022**|
+|Published:|**May 11, 2022**|
+|Release version:|**20.122041.16654.0**|
-**What's new**
+#### What's new
- Addressed an issue where `mdatp diagnostic real-time-protection-statistics` wasn't printing the correct process path in some cases.
- Product improvements
### Apr-2022 (Build: 101.64.15 | Release version: 20.122032.16415.0)
- Released: **Apr 26, 2022**
- Published: **Apr 26, 2022**
- Build: **101.64.15**
- Release version: **20.122032.16415.0**
+|Build:|**101.64.15**|
+|---|---|
+|Released:|**Apr 26, 2022**|
+|Published:|**Apr 26, 2022**|
+|Release version:|**20.122032.16415.0**|
-**What's new**
+#### What's new
- Fixed a regression introduced in version 101.61.69 where the status menu icon was sometimes showing an error icon, even though no action was required from the end user
- Improved the `conflicting_applications` field in `mdatp health` to show only the most recent 10 processes and also to include the process names. This improvement makes it easier to identify which processes are potentially conflicting with Microsoft Defender for Endpoint for macOS.
@@ -731,34 +741,37 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Mar-2022 (Build: 101.61.69 | Release version: 20.122022.16169.0)
- Released: **Mar 25, 2022**
- Published: **Mar 25, 2022**
- Build: **101.61.69**
- Release version: **20.122022.16169.0**
+|Build:|**101.61.69**|
+|---|---|
+|Released:|**Mar 25, 2022**|
+|Published:|**Mar 25, 2022**|
+|Release version:|**20.122022.16169.0**|
-**What's new**
+#### What's new
- Product improvements
### Mar-2022 (Build: 101.60.91 | Release version: 20.122021.16091.0)
- Released: **Mar 8, 2022**
- Published: **Mar 8, 2022**
- Build: **101.60.91**
- Release version: **20.122021.16091.0**
+|Build:|**101.60.91**|
+|---|---|
+|Released:|**Mar 8, 2022**|
+|Published:|**Mar 8, 2022**|
+|Release version:|**20.122021.16091.0**|
-**What's new**
+#### What's new
- This version contains a security update for [CVE-2022-23278](https://msrc-blog.microsoft.com/2022/03/guidance-for-cve-2022-23278-spoofing-in-microsoft-defender-for-endpoint/)
### Feb-2022 (Build: 101.59.50 | Release version: 20.122021.15950.0)
- Released: **Feb 28, 2022**
- Published: **Feb 28, 2022**
- Build: **101.59.50**
- Release version: **20.122021.15950.0**
+|Build:|**101.59.50**|
+|---|---|
+|Released:|**Feb 28, 2022**|
+|Published:|**Feb 28, 2022**|
+|Release version:|**20.122021.15950.0**|
-**What's new**
+#### What's new
- This version adds support for macOS 12.3. Starting with macOS 12.3, [Apple is removing Python 2.7](https://developer.apple.com/documentation/macos-release-notes/macos-12_3-release-notes). There's no Python version preinstalled on macOS by default. **ACTION NEEDED**:
- Users must update Microsoft Defender for Endpoint for Mac to version 101.59.50 (or newer) before updating their devices to macOS Monterey 12.3 (or newer). This minimal version 101.59.50 is a prerequisite to eliminating Python-related issues with Microsoft Defender for Endpoint for macOS devices on macOS Monterey.
@@ -766,12 +779,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Feb-2022 (Build: 101.59.10 | Release version: 20.122012.15910.0)
- Released: **Feb 22, 2022**
- Published: **Feb 22, 2022**
- Build: **101.59.10**
- Release version: **20.122012.15910.0**
+|Build:|**101.59.10**|
+|---|---|
+|Released:|**Feb 22, 2022**|
+|Published:|**Feb 22, 2022**|
+|Release version:|**20.122012.15910.0**|
-**What's new**
+#### What's new
- The command-line tool now supports restoring quarantined files to a location other than the one where the file was originally detected. Restoration can be done through `mdatp threat quarantine restore --id [threat-id] --path [destination-folder]`.
- Extended device control to handle devices connected over Thunderbolt 3
@@ -780,27 +794,29 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Feb-2022 (Build: 101.56.62 | Release version: 20.121122.15662.0)
- Released: **Feb 7, 2022**
- Published: **Feb 7, 2022**
- Build: **101.56.62**
- Release version: **20.121122.15662.0**
+|Build:|**101.56.62**|
+|---|---|
+|Released:|**Feb 7, 2022**|
+|Published:|**Feb 7, 2022**|
+|Release version:|**20.121122.15662.0**|
-**What's new**
+#### What's new
- Product improvements
### Jan-2022 (Build: 101.56.35 | Release version: 20.121121.15635.0)
- Released: **Jan 30, 2022**
- Published: **Jan 30, 2022**
- Build: **101.56.35**
- Release version: **20.121121.15635.0**
+|Build:|**101.56.35**|
+|---|---|
+|Released:|**Jan 30, 2022**|
+|Published:|**Jan 30, 2022**|
+|Release version:|**20.121121.15635.0**|
-**What's new**
+#### What's new
- The application is renamed from *Microsoft Defender ATP* to *Microsoft Defender*. End users observe the following changes:
- - The application installation path changed from `/Application/Microsoft Defender ATP.app` to `/Applications/Microsoft Defender.app`.
- - Within the user experience, occurrences of *Microsoft Defender ATP* are replaced by *Microsoft Defender*
+ - The application installation path changed from `/Application/Microsoft Defender ATP.app` to `/Applications/Microsoft Defender.app`.
+ - Within the user experience, occurrences of *Microsoft Defender ATP* are replaced by *Microsoft Defender*
- Resolved an issue where some VPN applications couldn't connect due to the network content filter that is distributed with Microsoft Defender for Endpoint for macOS.
- Addressed an issue discovered in macOS 12.2 preview 2 where the installation package couldn't be opened due to a change in the operating system (OS) that prevents installation of packages with certain characteristics. While it appears that this OS change isn't included in the final release of macOS 12.2, it's likely that it will be reintroduced in a future macOS version. As such, we encourage all enterprise administrators to refresh the Microsoft Defender for Endpoint package in their management console to this product version (or a newer version).
- Addressed an issue seen on some M1 devices where the product was stuck with invalid anti-malware definitions and couldn't successfully update to a working set of definitions.
@@ -809,12 +825,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jan-2022 (Build: 101.54.16 | Release version: 20.121111.15416.0)
- Released: **Jan 12, 2022**
- Published: **Jan 12, 2022**
- Build: **101.54.16**
- Release version: **20.121111.15416.0**
+|Build:|**101.54.16**|
+|---|---|
+|Released:|**Jan 12, 2022**|
+|Published:|**Jan 12, 2022**|
+|Release version:|**20.121111.15416.0**|
-**What's new**
+#### What's new
- macOS 10.14 (Mojave) is no longer supported
- After a product setting stops being managed by the administrator through MDM, it now reverts to the value it had before it was managed (the value configured locally by the end user or, if no such local value was explicitly provided, the default value used by the product). Prior to this change, after a setting stopped being managed, its managed value persisted and was still used by the product.
@@ -822,39 +839,43 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Nov-2021 (Build: 101.49.25)
- Build: **101.49.25**
- Release version: **20.121092.14925.0**
+|Build:|**101.49.25**|
+|---|---|
+|Release version:|**20.121092.14925.0**|
-**What's new**
+#### What's new
- Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured through `mdatp config scan-archives --value [enabled/disabled]`. By default, this is set to enabled.
- Product improvements
### Oct-2021 (Build: 101.47.27)
- Build: **101.47.27**
- Release version: **20.121082.14727.0**
+|Build:|**101.47.27**|
+|---|---|
+|Release version:|**20.121082.14727.0**|
-**What's new**
+#### What's new
-- Fix for a system freeze occurring on shutdown on macOS Mojave and macOS Catalina.
+- Fix for a system freeze occurring on shutdown on macOS Mojave and macOS Catalina.
### Oct-2021 (Build: 101.43.84)
- Build: **101.43.84**
- Release version: **20.121082.14384.0**
+|Build:|**101.43.84**|
+|---|---|
+|Release version:|**20.121082.14384.0**|
-**What's new**
+#### What's new
- Candidate build for macOS 12 (Monterey)
- Product improvements
### Sep-2021 (Build: 101.41.10)
- Build: **101.41.10**
- Release version: **20.121072.14110.0**
+|Build:|**101.41.10**|
+|---|---|
+|Release version:|**20.121072.14110.0**|
-**What's new**
+#### What's new
- Added new switches to the command-line tool:
- Control degree of parallelism for on-demand scans. This can be configured through `mdatp config maximum-on-demand-scan-threads --value [number-between-1-and-64]`. By default, a degree of parallelism of 2 is used.
@@ -864,47 +885,52 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Aug-2021 (Build: 101.40.84)
- Build: **101.40.84**
- Release version: **20.121071.14084.0**
+|Build:|**101.40.84**|
+|---|---|
+|Release version:|**20.121071.14084.0**|
-**What's new**
+#### What's new
- M1 chip native support
- Performance improvements & Product improvements
### Jul-2021 (Build: 101.37.97)
- Build: **101.37.97**
- Release version: **20.121062.13797.0**
+|Build:|**101.37.97**|
+|---|---|
+|Release version:|**20.121062.13797.0**|
-**What's new**
+#### What's new
- Performance improvements & Product improvements
### Jun-2021 (Build: 101.34.28)
- Build: **101.34.28**
- Release version: **20.121061.13428.0**
+|Build:|**101.34.28**|
+|---|---|
+|Release version:|**20.121061.13428.0**|
-**What's new**
+#### What's new
- Product improvements
### Jun-2021 (Build: 101.34.27)
- Build: **101.34.27**
- Release version: **20.121052.13427.0**
+|Build:|**101.34.27**|
+|---|---|
+|Release version:|**20.121052.13427.0**|
-**What's new**
+#### What's new
- Product improvements
### May-2021 (Build: 101.34.20)
- Build: **101.34.20**
- Release version: **20.121051.13420.0**
+|Build:|**101.34.20**|
+|---|---|
+|Release version:|**20.121051.13420.0**|
-**What's new**
+#### What's new
- [Device control for macOS](mac-device-control-overview.md) is now in general availability.
- Addressed an issue where a quick scan couldn't be started from the status menu on macOS 11 (Big Sur).
@@ -912,19 +938,21 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Apr-2021 (Build: 101.32.69)
- Build: **101.32.69**
- Release version: **20.121042.13269.0**
+|Build:|**101.32.69**|
+|---|---|
+|Release version:|**20.121042.13269.0**|
-**What's new**
+#### What's new
- Addressed an issue where concurrent access to the keychain from Microsoft Defender for Endpoint and other applications can lead to keychain corruption.
### Mar-2021 (Build: 101.29.64)
- Build: **101.29.64**
- Release version: **20.121042.12964.0**
+|Build:|**101.29.64**|
+|---|---|
+|Release version:|**20.121042.12964.0**|
-**What's new**
+#### What's new
- Starting with this version, threats detected during on-demand antivirus scans triggered through the command-line client are automatically remediated. Threats detected during scans triggered through the user interface still require manual action.
- `mdatp diagnostic real-time-protection-statistics` now supports two other switches:
@@ -934,78 +962,87 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Feb-2021 (Build: 101.27.50)
- Build: **101.27.50**
- Release version: **20.121022.12750.0**
+|Build:|**101.27.50**|
+|---|---|
+|Release version:|**20.121022.12750.0**|
-**What's new**
+#### What's new
-- Fix to accommodate for Apple certificate expiration for macOS Catalina and earlier. This fix restores Microsoft Defender Vulnerability Management (MDVM) functionality.
+- Fix to accommodate for Apple certificate expiration for macOS Catalina and earlier. This fix restores Microsoft Defender Vulnerability Management (MDVM) functionality.
### Feb-2021 (Build: 101.25.69)
- Build: **101.25.69**
- Release version: **20.121022.12569.0**
+|Build:|**101.25.69**|
+|---|---|
+|Release version:|**20.121022.12569.0**|
-**What's new**
+#### What's new
- Microsoft Defender for Endpoint on macOS is now available in preview for US Government customers. For more information, see [Microsoft Defender for Endpoint for US Government customers](gov.md).
- Performance improvements (specifically for the situation when the XCode Simulator app is used) & Product improvements.
### Jan-2021 (Build: 101.23.64)
- Build: **101.23.64**
- Release version: **20.121021.12364.0**
+|Build:|**101.23.64**|
+|---|---|
+|Release version:|**20.121021.12364.0**|
-**What's new**
+#### What's new
- Added a new option to the command-line tool to view information about the last on-demand scan. To view information about the last on-demand scan, run `mdatp health --details antivirus`.
- Performance improvements & Product improvements
### Dec-2020 (Build: 101.22.79)
- Build: **101.22.79**
- Release version: **20.121012.12279.0**
+|Build:|**101.22.79**|
+|---|---|
+|Release version:|**20.121012.12279.0**|
-**What's new**
+#### What's new
- Performance improvements & Product improvements
### Nov-2020 (Build: 101.19.88)
- Build: **101.19.88**
- Release version: **20.121011.11988.0**
+|Build:|**101.19.88**|
+|---|---|
+|Release version:|**20.121011.11988.0**|
-**What's new**
+#### What's new
- Performance improvements & Product improvements
### Nov-2020 (Build: 101.19.48)
- Build: **101.19.48**
- Release version: **20.120121.11948.0**
+|Build:|**101.19.48**|
+|---|---|
+|Release version:|**20.120121.11948.0**|
-**What's new**
+#### What's new
> [!NOTE]
-> The old command-line tool syntax has been deprecated with this release. For information on the new syntax, see [Resources](mac-resources.md#configuring-from-the-command-line).
-- Added a new command-line switch to disable the network extension: `mdatp system-extension network-filter disable`. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint on Mac.
-- Performance improvements & Product improvements
+>
+> - The old command-line tool syntax has been deprecated with this release. For information on the new syntax, see [Resources](mac-resources.md#configuring-from-the-command-line).
+> - Added a new command-line switch to disable the network extension: `mdatp system-extension network-filter disable`. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint on Mac.
+> - Performance improvements & Product improvements
### Oct-2020 (Build: 101.19.21)
- Build: **101.19.21**
- Release version: **20.120101.11921.0**
+|Build:|**101.19.21**|
+|---|---|
+|Release version:|**20.120101.11921.0**|
-**What's new**
+#### What's new
- Product improvements
### Oct-2020 (Build: 101.15.26)
- Build: **101.15.26**
- Release version: **20.120102.11526.0**
+|Build:|**101.15.26**|
+|---|---|
+|Release version:|**20.120102.11526.0**|
-**What's new**
+#### What's new
- Improved the reliability of the agent when running on macOS 11 Big Sur.
- Added a new command-line switch (`--ignore-exclusions`) to ignore AV exclusions during custom scans (`mdatp scan custom`).
@@ -1013,28 +1050,31 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Sep-2020 (Build: 101.13.75)
- Build: **101.13.75**
- Release version: **20.120101.11375.0**
+|Build:|**101.13.75**|
+|---|---|
+|Release version:|**20.120101.11375.0**|
-**What's new**
+#### What's new
- Removed conditions when Microsoft Defender for Endpoint was triggering a macOS 11 (Big Sur) issue that manifests into a kernel panic.
- Fixed a memory leak in the Endpoint Security system extension when running on macOS 11 (Big Sur).
- Product improvements
-### Aug-2020 (Build: 101.10.72)
+### Aug-2020 (Build: 101.10.72)
- Build: **101.10.72**
+|Build:|**101.10.72**|
+|---|---|
-**What's new**
+#### What's new
- Product improvements
### Jul-2020 (Build: 101.09.61)
- Build: **101.09.61**
+|Build:|**101.09.61**|
+|---|---|
-**What's new**
+#### What's new
- Added a new managed preference for [disabling the option to send feedback](mac-preferences.md#show--hide-option-to-send-feedback).
- Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator.
@@ -1042,22 +1082,26 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jul-2020 (Build: 101.09.50)
- Build: **101.09.50**
+|Build:|**101.09.50**|
+|---|---|
-**What's new**
+#### What's new
- This product version is validated on macOS Big Sur 11 preview 9.
- The new syntax for the mdatp command-line tool is now the default one. For more information on the new syntax, see [Resources for Microsoft Defender for Endpoint on macOS](mac-resources.md#configuring-from-the-command-line).
-> [!NOTE]
-> The old command-line tool syntax will be removed from the product on **January 1st, 2021**.
+
+ > [!NOTE]
+ > The old command-line tool syntax will be removed from the product on **January 1st, 2021**.
+
- Extended `mdatp diagnostic create` with a new parameter (`--path [directory]`) that allows the diagnostic logs to be saved to a different directory.
- Performance improvements & Product improvements
### Jul-2020 (Build: 101.09.49)
- Build: **101.09.49**
+|Build:|**101.09.49**|
+|---|---|
-**What's new**
+#### What's new
- User interface improvements to differentiate exclusions that are managed by the IT administrator versus exclusions defined by the local user.
- Improved CPU utilization during on-demand scans.
@@ -1065,9 +1109,10 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jun-2020 (Build: 101.07.23)
- Build: **101.07.23**
+|Build:|**101.07.23**|
+|---|---|
-**What's new**
+#### What's new
- Added new fields to the output of `mdatp --health` for checking the status of passive mode and the EDR group ID.
@@ -1080,29 +1125,34 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### May-2020 (Build: 101.06.63)
- Build: **101.06.63**
+|Build:|**101.06.63**|
+|---|---|
-**What's new**
+#### What's new
- Addressed a performance regression introduced in version `101.05.17`. The regression was introduced with the fix to eliminate the kernel panics some customers observed when accessing SMB shares. We reverted this code change and are investigating alternative ways to eliminate the kernel panics.
### May-2020 (Build: 101.05.17)
- Build: **101.05.17**
+|Build:|**101.05.17**|
+|---|---|
-**What's new**
+#### What's new
> [!IMPORTANT]
> We're working on a new and enhanced syntax for the `mdatp` command-line tool. The new syntax is currently the default in the Insider Fast and Insider Slow update channels. We encourage you to familiarize yourself with this new syntax.
+>
> We continue supporting the old syntax in parallel with the new syntax and provide more communications around the deprecation plan for the old syntax in the upcoming months.
+
- Addressed a kernel panic that occurred sometimes when accessing SMB file shares.
- Performance improvements & Product improvements
### Apr-2020 (Build: 101.05.16)
- Build: **101.05.16**
+|Build:|**101.05.16**|
+|---|---|
-**What's new**
+#### What's new
- Improvements to quick scan logic to significantly reduce the number of scanned files.
- Added [autocompletion support](mac-resources.md#how-to-enable-autocompletion) for the command-line tool.
@@ -1110,17 +1160,19 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Mar-2020 (Build: 101.03.12)
- Build: **101.03.12**
+|Build:|**101.03.12**|
+|---|---|
-**What's new**
+#### What's new
- Performance improvements & Product improvements
### Feb-2020 (Build: 101.01.54)
- Build: **101.01.54**
+|Build:|**101.01.54**|
+|---|---|
-**What's new**
+#### What's new
- Improvements around compatibility with Time Machine
- Accessibility improvements
@@ -1128,9 +1180,10 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jan-2020 (Build: 101.00.31)
- Build: **101.00.31**
+|Build:|**101.00.31**|
+|---|---|
-**What's new**
+#### What's new
- Improved [product onboarding experience for Intune users](/intune/intune-service/apps/apps-advanced-threat-protection-macos)
- Antivirus [exclusions now support wildcards](mac-exclusions.md#supported-exclusion-types)
@@ -1140,9 +1193,10 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### 2019 releases (Build: 100.90.27)
- Build: **100.90.27**
+|Build:|**100.90.27**|
+|---|---|
-**What's new**
+#### What's new
- You can now [set an update channel](mac-updates.md#set-the-channel-name) for Microsoft Defender for Endpoint on macOS that is different from the system-wide update channel.
- New product icon
@@ -1151,9 +1205,10 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### 2019 releases (Build: 100.86.92)
- Build: **100.86.92**
+|Build:|**100.86.92**|
+|---|---|
-**What's new**
+#### What's new
- Improvements around compatibility with Time Machine
- Addressed an issue where the product was sometimes not cleaning all files under `/Library/Application Support/Microsoft/Defender` during uninstallation.
@@ -1162,9 +1217,10 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### 2019 releases (Build: 100.86.91)
- Build: **100.86.91**
+|Build:|**100.86.91**|
+|---|---|
-**What's new**
+#### What's new
> [!CAUTION]
> To ensure the most complete protection for your macOS devices and in alignment with Apple stopping delivery of macOS native security updates to OS versions older than [current - 2], MDATP for macOS deployment and updates will no longer be supported on macOS Sierra [10.12]. MDATP for macOS updates and enhancements are delivered to devices running versions Catalina [10.15], Mojave [10.14], and High Sierra [10.13].
@@ -1175,9 +1231,10 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### 2019 releases (Build: 100.83.73)
- Build: **100.83.73**
+|Build:|**100.83.73**|
+|---|---|
-**What's new**
+#### What's new
- Added more controls for IT administrators around [management of exclusions](mac-preferences.md#exclusion-merge-policy), [management of threat type settings](mac-preferences.md#threat-type-settings-merge-policy), and [disallowed threat actions](mac-preferences.md#disallowed-threat-actions).
- When Full Disk Access isn't enabled on the device, a warning is now displayed in the status menu.
@@ -1185,25 +1242,28 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### 2019 releases (Build: 100.82.60)
- Build: **100.82.60**
+|Build:|**100.82.60**|
+|---|---|
-**What's new**
+#### What's new
- Addressed an issue where the product fails to start following a definition update.
### 2019 releases (Build: 100.80.42)
- Build: **100.80.42**
+|Build:|**100.80.42**|
+|---|---|
-**What's new**
+#### What's new
- Product improvements
### 2019 releases (Build: 100.79.42)
- Build: **100.79.42**
+|Build:|**100.79.42**|
+|---|---|
-**What's new**
+#### What's new
- Fixed an issue where Microsoft Defender for Endpoint on macOS was sometimes interfering with Time Machine.
- Added a new switch to the command-line utility for testing the connectivity with the backend service
@@ -1217,40 +1277,46 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### 2019 releases (Build: 100.72.15)
- Build: **100.72.15**
+|Build:|**100.72.15**|
+|---|---|
-**What's new**
+#### What's new
- Product improvements
### 2019 releases (Build: 100.70.99)
- Build: **100.70.99**
+|Build:|**100.70.99**|
+|---|---|
-**What's new**
+#### What's new
- Addressed an issue that impacts the ability of some users to upgrade to macOS Catalina when real-time protection is enabled. This sporadic issue was caused by Microsoft Defender for Endpoint locking files within Catalina upgrade package while scanning them for threats, which led to failures in the upgrade sequence.
### 2019 releases (Build: 100.68.99)
- Build: **100.68.99**
+|Build:|**100.68.99**|
+|---|---|
-**What's new**
+#### What's new
- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enforcement-level-for-antivirus-engine).
- Performance improvements & Product improvements
### 2019 releases (Build: 100.65.28)
- Build: **100.65.28**
+|Build:|**100.65.28**|
+|---|---|
-**What's new**
+#### What's new
- Added support for macOS Catalina.
> [!CAUTION]
> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications aren't able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint isn't able to fully protect your device.
+>
> The mechanism for granting this consent depends on how you deployed Microsoft Defender for Endpoint:
+>
> - For manual deployments, see the updated instructions in the [Manual deployment article](mac-install-manually.md#allow-full-disk-access).
> - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) articles.
@@ -1260,120 +1326,113 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### July-2025 Build: 101.25052.0007 | Release version: 30.125052.0007.0
-|Build: |**101.25052.0007** |
-|-------------------|----------------------|
-|Released: |**July 22, 2025** |
-|Published: |**July 22, 2025** |
-|Release version: |**30.125052.0007.0** |
-|Engine version: |**1.1.25020.4000** |
-|Signature version: |**1.427.370.0** |
+|Build:|**101.25052.0007**|
+|---|---|
+|Released:|**July 22, 2025**|
+|Published:|**July 22, 2025**|
+|Release version:|**30.125052.0007.0**|
+|Engine version:|**1.1.25020.4000**|
+|Signature version:|**1.427.370.0**|
#### What's new
+
- Fixed issue to generate unique Machine identifiers to ensure each onboarded device is uniquely identified.
- Other stability improvements and bug fixes.
### June-2025 Build: 101.25042.0003 | Release version: 30.125042.0003.0
-|Build: |**101.25042.0003** |
-|-------------------|----------------------|
-|Released: |**June 30, 2025** |
-|Published: |**June 30, 2025** |
-|Release version: |**30.125042.0003.0** |
-|Engine version: |**1.1.25020.4000** |
-|Signature version: |**1.427.370.0** |
+|Build:|**101.25042.0003**|
+|---|---|
+|Released:|**June 30, 2025**|
+|Published:|**June 30, 2025**|
+|Release version:|**30.125042.0003.0**|
+|Engine version:|**1.1.25020.4000**|
+|Signature version:|**1.427.370.0**|
#### What's new
+
- The Defender for Endpoint package rollout into production happens gradually. From the time the release notes are published, it might take up to a week for the package to be pushed to all production machines.
- Removed external dependency of uuid-runtime from the Defender for Endpoint package
- Other stability improvements and bug fixes
### May-2025 Build: 101.25032.0010 | Release version: 30.125032.0010.0
-|Build: |**101.25032.0010** |
-|-------------------|----------------------|
-|Released: |**May 23, 2025** |
-|Published: |**May 23, 2025** |
-|Release version: |**30.125032.0010.0** |
-|Engine version: |**1.1.25020.4000** |
-|Signature version: |**1.427.370.0** |
+|Build:|**101.25032.0010**|
+|---|---|
+|Released:|**May 23, 2025**|
+|Published:|**May 23, 2025**|
+|Release version:|**30.125032.0010.0**|
+|Engine version:|**1.1.25020.4000**|
+|Signature version:|**1.427.370.0**|
#### What's new
- Removed external dependency of MDE Netfilter and libpcre from MDE package
-
- Fix for Python script executing unverified binaries with root-level privileges to identify Java processes using outdated versions of log4j (CVE-2025-26684) has been addressed.
-
- Added detection mechanism for CVE-2025-31324 affecting the "Visual Composer" component of the SAP NetWeaver application server.
### April-2025 Build: 101.25022.0002 | Release version: 30.125022.0001.0
-|Build: |**101.25022.0002** |
-|-------------------|----------------------|
-|Released: |**April 07, 2025** |
-|Published: |**April 07, 2025** |
-|Release version: |**30.125022.0001.0** |
-|Engine version: |**1.1.24090.13** |
-|Signature version: |**1.421.226.0** |
+|Build:|**101.25022.0002**|
+|---|---|
+|Released:|**April 07, 2025**|
+|Published:|**April 07, 2025**|
+|Release version:|**30.125022.0001.0**|
+|Engine version:|**1.1.24090.13**|
+|Signature version:|**1.421.226.0**|
#### What's new
- mdatp diagnostic ebpf-statistics command requires sudo privilege now
-
- Manage dynamic signature file share source by setting URL and update interval
-
- Other stability improvements and bug fixes
-
-- Support for ARM64 Linux servers
+- Support for ARM64 Linux servers
### Mar-2025 Build: 101.25012.0000 | Release version: 30.125012.0000.0
-| Build: | **101.25012.0000** |
-|-------------------|----------------------|
-|Released: | **March 11, 2025** |
-|Published: | **March 11, 2025** |
-|Release version: | **30.125012.0000.0** |
-|Engine version: | **1.1.24090.13** |
-|Signature version: | **1.421.226.0** |
+|Build:|**101.25012.0000**|
+|---|---|
+|Released:|**March 11, 2025**|
+|Published:|**March 11, 2025**|
+|Release version:|**30.125012.0000.0**|
+|Engine version:|**1.1.24090.13**|
+|Signature version:|**1.421.226.0**|
#### What's new
- The MDATP package rollout into production will be done gradually. From the time the release notes are published, it might take up to a week for the package to be pushed to all production machines.
-
- The vulnerability in curl, CVE-2024-7264, has been addressed.
-
- Other stability improvements and bug fixes.
-##### Known Issues
+#### Known Issues
- There's a known issue where MDE is deleting the configuration file located at /etc/systemd/system/mdatp.service.d on each service start. As a workaround, customers can use the Immutable attribute that prevents the files from being modified or deleted.
To set the file to be unmodifiable, execute the following command:
-
-```bash
+ ```bash
sudo chattr +i /etc/systemd/system/mdatp.service.d/[file name]
```
-
+
This command makes the file unchangeable. If you need to restore modification permissions, use the following command:
```bash
-
sudo chattr -i /etc/systemd/system/mdatp.service.d/[file name]
```
-
- Note that the chattr command can only be used on supported file systems, such as ext4.
-
- If you need further assistance, you can reach out to our support team with your organization ID, and we can implement a temporary mitigation to prevent deletion. A permanent fix for this issue is available in MDE version 101.25032.0000.
+
+ Note that the `chattr` command can only be used on supported file systems, such as ext4.
+
+If you need further assistance, you can reach out to our support team with your organization ID, and we can implement a temporary mitigation to prevent deletion. A permanent fix for this issue is available in MDE version 101.25032.0000.
### Feb-2025 Build: 101.24122.0008 | Release version: 30.124112.0008.0
-| Build: | **101.24122.0008** |
-|--------------------|-----------------------|
-| Released: | **February 20, 2025** |
-| Published: | **February 20, 2025** |
-| Release version: | **30.124122.0008.0** |
-| Engine version: | **1.1.24090.13** |
-| Signature version: | **1.421.226.0** |
+|Build:|**101.24122.0008**|
+|---|---|
+|Released:|**February 20, 2025**|
+|Published:|**February 20, 2025**|
+|Release version:|**30.124122.0008.0**|
+|Engine version:|**1.1.24090.13**|
+|Signature version:|**1.421.226.0**|
#### What's new
@@ -1382,13 +1441,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Feb-2025 Build: 101.24112.0003 | Release version: 30.124112.0003.0
-| Build: | **101.24112.0003** |
-|--------------------|-----------------------|
-| Released: | **February 04, 2025** |
-| Published: | **February 04, 2025** |
-| Release version: | **30.124112.0003.0** |
-| Engine version: | **1.1.24090.13** |
-| Signature version: | **1.421.1681.0** |
+|Build:|**101.24112.0003**|
+|---|---|
+|Released:|**February 04, 2025**|
+|Published:|**February 04, 2025**|
+|Release version:|**30.124112.0003.0**|
+|Engine version:|**1.1.24090.13**|
+|Signature version:|**1.421.1681.0**|
#### What's new
@@ -1397,20 +1456,20 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jan-2025 Build: 101.24112.0001 | Release version: 30.124112.0001.0
-| Build: | **101.24112.0001** |
-|--------------------|-----------------------|
-| Released: | **January 13, 2025** |
-| Published: | **January 13, 2025** |
-| Release version: | **30.124112.0001.0** |
-| Engine version: | **1.1.24090.13** |
-| Signature version: | **1.421.226.0** |
+|Build:|**101.24112.0001**|
+|---|---|
+|Released:|**January 13, 2025**|
+|Published:|**January 13, 2025**|
+|Release version:|**30.124112.0001.0**|
+|Engine version:|**1.1.24090.13**|
+|Signature version:|**1.421.226.0**|
#### What's new
- Upgraded the Bond version to 13.0.1 to address security vulnerabilities in versions 12 or lower.
- Mdatp package no longer has a dependency on SELinux packages.
-
+
- Users can now query the status of supplementary event provider eBPF using the threat hunting query in `DeviceTvmInfoGathering`. To learn more about this query check: [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](linux-support-ebpf.md). The result of this query can return the following two values as eBPF status:
- Enabled: When eBPF is enabled as working as expected.
- Disabled: When eBPF is disabled due to one of the following reasons:
@@ -1426,13 +1485,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Jan-2025 Build: 101.24102.0000 | Release version: 30.124102.0000.0
-| Build: | **101.24102.0000** |
-|--------------------|-----------------------|
-| Released: | **January 8, 2025** |
-| Published: | **January 8, 2025** |
-| Release version: | **30.124102.0000.0** |
-| Engine version: | **1.1.24080.11** |
-| Signature version: | **1.419.351.0** |
+|Build:|**101.24102.0000**|
+|---|---|
+|Released:|**January 8, 2025**|
+|Published:|**January 8, 2025**|
+|Release version:|**30.124102.0000.0**|
+|Engine version:|**1.1.24080.11**|
+|Signature version:|**1.419.351.0**|
#### What's new
@@ -1442,13 +1501,13 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Nov-2024 Build: 101.24092.0002 | Release version: 30.124092.0002.0
-| Build: | **101.24092.0002** |
-|--------------------|-----------------------|
-| Released: | **November 14, 2024** |
-| Published: | **November 14, 2024** |
-| Release version: | **30.124092.0002.0** |
-| Engine version: | **1.1.24080.9** |
-| Signature version: | **1.417.659.0** |
+|Build:|**101.24092.0002**|
+|---|---|
+|Released:|**November 14, 2024**|
+|Published:|**November 14, 2024**|
+|Release version:|**30.124092.0002.0**|
+|Engine version:|**1.1.24080.9**|
+|Signature version:|**1.417.659.0**|
#### What's new
@@ -1458,31 +1517,30 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### Oct-2024 Build: 101.24082.0004 | Release version: 30.124082.0004.0
-| Build: | **101.24082.0004** |
-|--------------------|-----------------------|
-| Released: | **October 15, 2024** |
-| Published: | **October 15, 2024** |
-| Release version: | **30.124082.0004** |
-| Engine version: | **1.1.24080.9** |
-| Signature version: | **1.417.659.0** |
+|Build:|**101.24082.0004**|
+|---|---|
+|Released:|**October 15, 2024**|
+|Published:|**October 15, 2024**|
+|Release version:|**30.124082.0004**|
+|Engine version:|**1.1.24080.9**|
+|Signature version:|**1.417.659.0**|
#### What's new
- Starting with this version, Defender for Endpoint on Linux no longer supports `AuditD` as a supplementary event provider. For improved stability and performance, we have transitioned to eBPF. If you disable eBPF, or in the event eBPF isn't supported on any specific kernel, Defender for Endpoint on Linux automatically switches back to Net link as a fallback supplementary event provider. Net link provides reduced functionality and tracks only process-related events. In this case, all process operations continue to flow seamlessly, but you could miss specific file and socket-related events that eBPF would otherwise capture. For more information, see [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](linux-support-ebpf.md). If you have any concerns or need assistance during this transition, contact support.
- Stability and performance improvements
-
- Other bug fixes
### Sept-2024 Build: 101.24072.0001 | Release version: 30.124072.0001.0
-| Build: | **101.24072.0001** |
-|--------------------|-----------------------|
-| Released: | **September 23, 2024** |
-| Published: | **September 23, 2024** |
-| Release version: | **30.124072.0001.0** |
-| Engine version: | **1.1.24060.6** |
-| Signature version: | **1.415.228.0** |
+|Build:|**101.24072.0001**|
+|---|---|
+|Released:|**September 23, 2024**|
+|Published:|**September 23, 2024**|
+|Release version:|**30.124072.0001.0**|
+|Engine version:|**1.1.24060.6**|
+|Signature version:|**1.415.228.0**|
#### What's new
@@ -1492,39 +1550,34 @@ Live Response for macOS is now available for all Mac devices onboarded to Defend
### July-2024 Build: 101.24062.0001 | Release version: 30.124062.0001.0
-| Build: | **101.24072.0001** |
-|--------------------|-----------------------|
-| Released: | **July 31, 2024** |
-| Published: | **July 31, 2024** |
-| Release version: | **30.124062.0001.0** |
-| Engine version: | **1.1.24050.7** |
-| Signature version: | **1.411.410.0** |
+|Build:|**101.24072.0001**|
+|---|---|
+|Released:|**July 31, 2024**|
+|Published:|**July 31, 2024**|
+|Release version:|**30.124062.0001.0**|
+|Engine version:|**1.1.24050.7**|
+|Signature version:|**1.411.410.0**|
#### What's new
There are multiple fixes and new changes in this release.
- Fixes bug in which infected command-line threat information wasn't showing correctly in security portal.
-
- Fixes a bug where disabling a preview feature required a Defender of Endpoint to disable it.
-
- Global Exclusions feature using managed JSON is now in Public Preview. available in insiders slow from 101.23092.0012. For more information, see [linux-exclusions](linux-exclusions.md).
-
- Updated the Linux default engine version to 1.1.24050.7 and default signature version to 1.411.410.0.
-
- Stability and performance improvements.
-
- Other bug fixes.
### June-2024 Build: 101.24052.0002 | Release version: 30.124052.0002.0
-| Build: | **101.24052.0002** |
-|--------------------|-----------------------|
-| Released: | **June 24, 2024** |
-| Published: | **June 24, 2024** |
-| Release version: | **30.124052.0002.0** |
-| Engine version: | **1.1.24040.2** |
-| Signature version: | **1.411.153.0** |
+|Build:|**101.24052.0002**|
+|---|---|
+|Released:|**June 24, 2024**|
+|Published:|**June 24, 2024**|
+|Release version:|**30.124052.0002.0**|
+|Engine version:|**1.1.24040.2**|
+|Signature version:|**1.411.153.0**|
#### What's new
@@ -1533,62 +1586,57 @@ There are multiple fixes and new changes in this release.
- This release fixes a bug related to high memory usage eventually leading to high CPU due to eBPF memory leak in kernel space resulting in servers going into unusable states. This only affected the kernel versions 3.10x and <= 4.16x, majorly on RHEL/CentOS distros. Update to the latest MDE version to avoid any impact.
- We have now simplified the output of `mdatp health --detail features`
-
- Stability and performance improvements.
-
- Other bug fixes.
### May-2024 Build: 101.24042.0002 | Release version: 30.124042.0002.0
-| Build: | **101.24042.0002** |
-|--------------------|-----------------------|
-| Released: | **May 29, 2024** |
-| Published: | **May 29, 2024** |
-| Release version: | **30.124042.0002.0** |
-| Engine version: | **1.1.24030.4** |
-| Signature version: | **1.407.521.0** |
+|Build:|**101.24042.0002**|
+|---|---|
+|Released:|**May 29, 2024**|
+|Published:|**May 29, 2024**|
+|Release version:|**30.124042.0002.0**|
+|Engine version:|**1.1.24030.4**|
+|Signature version:|**1.407.521.0**|
#### What's new
There are multiple fixes and new changes in this release:
- In version 24032.0007, there was a known issue where the enrollment of devices to MDE Security Management failed when using the "Device Tagging" mechanism via the mdatp_managed.json file. This issue has been resolved in the current release.
-
- Stability and performance improvements.
-
- Other bug fixes.
### May-2024 Build: 101.24032.0007 | Release version: 30.124032.0007.0
-| Build: | **101.24032.0007** |
-|--------------------|-----------------------|
-| Released: | **May 15, 2024** |
-| Published: | **May 15, 2024** |
-| Release version: | **30.124032.0007.0** |
-| Engine version: | **1.1.24020.3** |
-| Signature version: | **1.403.3500.0** |
+|Build:|**101.24032.0007**|
+|---|---|
+|Released:|**May 15, 2024**|
+|Published:|**May 15, 2024**|
+|Release version:|**30.124032.0007.0**|
+|Engine version:|**1.1.24020.3**|
+|Signature version:|**1.403.3500.0**|
#### What's new
There are multiple fixes and new changes in this release:
- In passive and on-demand modes, antivirus engine remains in idle state and is used only during scheduled custom scans. Thus as part of performance improvements, we have made changes to keep the AV engine down in passive and on-demand mode except during scheduled custom scans. If the real time protection is enabled, antivirus engine will always be up and running. This has no impact on your server protection in any mode.
-
+
To keep users informed of the state of antivirus engine, we have introduced a new field called "engine_load_status" as part of MDATP health. It indicates whether antivirus engine is currently running or not.
- | `Field name` | `engine_load_status` |
+ |`Field name`|`engine_load_status`|
|---|---|
- | Possible values | Engine not loaded (AV engine process is down), Engine load succeeded (AV engine process up and running) |
+ |Possible values|Engine not loaded (AV engine process is down), Engine load succeeded (AV engine process up and running)|
Healthy scenarios:
- - If RTP is enabled, engine_load_status should be "Engine load succeeded"
- - If MDE is in on-demand or passive mode, and custom scan isn't running then "engine_load_status" should be "Engine not loaded"
- - If MDE is in on-demand or passive mode, and custom scan is running then "engine_load_status" should be "Engine load succeeded"
-- Bug fix to enhance behavioral detections.
+ - If RTP is enabled, engine_load_status should be "Engine load succeeded"
+ - If MDE is in on-demand or passive mode, and custom scan isn't running then "engine_load_status" should be "Engine not loaded"
+ - If MDE is in on-demand or passive mode, and custom scan is running then "engine_load_status" should be "Engine load succeeded"
+- Bug fix to enhance behavioral detections.
- Stability and performance improvements.
-
- Other bug fixes.
#### Known Issues
@@ -1598,96 +1646,90 @@ There are multiple fixes and new changes in this release:
```bash
sudo mdatp edr tag set --name GROUP --value MDE-Management
```
- **The issue has been fixed in Build: 101.24042.0002**
+
+ **The issue has been fixed in Build: 101.24042.0002**
### March-2024 Build: 101.24022.0001 | Release version: 30.124022.0001.0
-| Build: | **101.24022.0001** |
-|--------------------|-----------------------|
-| Released: | **March 22,2024** |
-| Published: | **March 22,2024** |
-| Release version: | **30.124022.0001.0** |
-| Engine version: | **1.1.23110.4** |
-| Signature version: | **1.403.87.0** |
+|Build:|**101.24022.0001**|
+|---|---|
+|Released:|**March 22,2024**|
+|Published:|**March 22,2024**|
+|Release version:|**30.124022.0001.0**|
+|Engine version:|**1.1.23110.4**|
+|Signature version:|**1.403.87.0**|
#### What's new
There are multiple fixes and new changes in this release:
- The addition of a new log file - `microsoft_defender_scan_skip.log`. This logs the filenames that were skipped from various antivirus scans by Microsoft Defender for Endpoint due to any reason.
-
- Stability and performance improvements.
-
- Bug fixes.
### March-2024 Build: 101.24012.0001 | Release version: 30.124012.0001.0
-| Build: | **101.24012.0001** |
-|--------------------|-----------------------|
-| Released: | **March 12,2024** |
-| Published: | **March 12,2024** |
-| Release version: | **30.124012.0001.0** |
-| Engine version: | **1.1.23110.4** |
-| Signature version: | **1.403.87.0** |
+|Build:|**101.24012.0001**|
+|---|---|
+|Released:|**March 12,2024**|
+|Published:|**March 12,2024**|
+|Release version:|**30.124012.0001.0**|
+|Engine version:|**1.1.23110.4**|
+|Signature version:|**1.403.87.0**|
#### What's new
There are multiple fixes and new changes in this release:
- Updated default engine version to `1.1.23110.4`, and default signatures version to `1.403.87.0`.
-
- Stability and performance improvements.
-
- Bug fixes.
### February-2024 Build: 101.23122.0002 | Release version: 30.123122.0002.0
-| Build: | **101.23122.0002** |
-|--------------------|-----------------------|
-| Released: | **February 5,2024** |
-| Published: | **February 5,2024** |
-| Release version: | **30.123122.0002.0** |
-| Engine version: | **1.1.23100.2010** |
-| Signature version: | **1.399.1389.0** |
+|Build:|**101.23122.0002**|
+|---|---|
+|Released:|**February 5,2024**|
+|Published:|**February 5,2024**|
+|Release version:|**30.123122.0002.0**|
+|Engine version:|**1.1.23100.2010**|
+|Signature version:|**1.399.1389.0**|
#### What's new
There are multiple fixes and new changes in this release:
- Updated default engine version to `1.1.23100.2010`, and default signatures version to `1.399.1389.0`.
-
- General stability and performance improvements.
-
- Bug fixes.
-
- Microsoft Defender for Endpoint on Linux now officially supports the following distros and versions:
- | Distro & version | Ring | Package |
- |---|---|---|
- | Mariner 2 | Production | https://packages.microsoft.com/cbl-mariner/2.0/prod/extras/x86_64/config.repo |
- | Rocky 8.7 and higher | Insiders Slow | https://packages.microsoft.com/config/rocky/8/insiders-slow.repo |
- | Rocky 9.2 and higher | Insiders Slow | https://packages.microsoft.com/config/rocky/9/insiders-slow.repo |
- | Alma 8.4 and higher | Insiders Slow | https://packages.microsoft.com/config/alma/8/insiders-slow.repo |
- | Alma 9.2 and higher | Insiders Slow | https://packages.microsoft.com/config/alma/9/insiders-slow.repo |
+ |Distro & version|Ring|Package|
+ |---|---|---|
+ |Mariner 2|Production|https://packages.microsoft.com/cbl-mariner/2.0/prod/extras/x86_64/config.repo|
+ |Rocky 8.7 and higher|Insiders Slow|https://packages.microsoft.com/config/rocky/8/insiders-slow.repo|
+ |Rocky 9.2 and higher|Insiders Slow|https://packages.microsoft.com/config/rocky/9/insiders-slow.repo|
+ |Alma 8.4 and higher|Insiders Slow|https://packages.microsoft.com/config/alma/8/insiders-slow.repo|
+ |Alma 9.2 and higher|Insiders Slow|https://packages.microsoft.com/config/alma/9/insiders-slow.repo|
-If you already have Defender for Endpoint running on any of these distros and facing any issues in the older versions, upgrade to the latest Defender for Endpoint version from the corresponding ring mentioned above.
+If you already have Defender for Endpoint running on any of these distros and facing any issues in the older versions, upgrade to the latest Defender for Endpoint version from the corresponding ring mentioned above.
-> [!NOTE]
-> Known issues:
->
-> Microsoft Defender for Endpoint for Linux on Rocky and Alma currently has the following known issues:
-> - Live Response and Threat Vulnerability Management are currently not supported (work in progress).
-> - Operating system info for devices isn't visible in the Microsoft Defender portal
+#### Known issues:
+
+Microsoft Defender for Endpoint for Linux on Rocky and Alma currently has the following known issues:
+
+- Live Response and Threat Vulnerability Management are currently not supported (work in progress).
+- Operating system info for devices isn't visible in the Microsoft Defender portal
### January-2024 Build: 101.23112.0009 | Release version: 30.123112.0009.0
-| Build: | **101.23112.0009** |
-|--------------------|-----------------------|
-| Released: | **January 29,2024** |
-| Published: | **January 29,2024** |
-| Release version: | **30.123112.0009.0** |
-| Engine version: | **1.1.23100.2010** |
-| Signature version: | **1.399.1389.0** |
+|Build:|**101.23112.0009**|
+|---|---|
+|Released:|**January 29,2024**|
+|Published:|**January 29,2024**|
+|Release version:|**30.123112.0009.0**|
+|Engine version:|**1.1.23100.2010**|
+|Signature version:|**1.399.1389.0**|
#### What's new
@@ -1701,13 +1743,13 @@ If you already have Defender for Endpoint running on any of these distros and fa
### November-2023 Build: 101.23102.0003 | Release version: 30.123102.0003.0
-| Build: | **101.23102.0003** |
-|--------------------|-----------------------|
-| Released: | **November 28,2023** |
-| Published: | **November 28,2023** |
-| Release version: | **30.123102.0003.0** |
-| Engine version: | **1.1.23090.2008** |
-| Signature version: | **1.399.690.0** |
+|Build:|**101.23102.0003**|
+|---|---|
+|Released:|**November 28,2023**|
+|Published:|**November 28,2023**|
+|Release version:|**30.123102.0003.0**|
+|Engine version:|**1.1.23090.2008**|
+|Signature version:|**1.399.690.0**|
#### What's new
@@ -1723,29 +1765,31 @@ If you already have Defender for Endpoint running on any of these distros and fa
### November-2023 Build: 101.23092.0012 | Release version: 30.123092.0012.0
-| Build: | **101.23092.0012** |
-|--------------------|-----------------------|
-| Released: | **November 14,2023** |
-| Published: | **November 14,2023** |
-| Release version: | **30.123092.0012.0** |
-| Engine version: | **1.1.23080.2007** |
-| Signature version: | **1.395.1560.0** |
+|Build:|**101.23092.0012**|
+|---|---|
+|Released:|**November 14,2023**|
+|Published:|**November 14,2023**|
+|Release version:|**30.123092.0012.0**|
+|Engine version:|**1.1.23080.2007**|
+|Signature version:|**1.395.1560.0**|
#### What's new
-There are multiple fixes and new changes in this release:
+There are multiple fixes and new changes in this release:
- Support added to restore threat based on original path using the following command:
-
+
```bash
sudo mdatp threat quarantine restore threat-path --path [threat-original-path] --destination-path [destination-folder]
```
+
- From this release, Microsoft Defender for Endpoint on Linux will no longer be shipping a solution for RHEL 6.
-
+
RHEL 6 'Extended end of life support' is poised to end by June 30, 2024 and customers are advised to plan their RHEL upgrades accordingly aligned with guidance from Red Hat. Customers who need to run Defender for Endpoint on RHEL 6 servers can continue to use version 101.23082.0011 (doesn't expire before June 30, 2024) supported on kernel versions 2.6.32-754.49.1.el6.x86_64 or prior.
- - Engine Update to `1.1.23080.2007` and Signatures Ver: `1.395.1560.0`.
- - Streamlined device connectivity experience is now in public preview mode. [public blog](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-a-streamlined-device-connectivity-experience-for/ba-p/3956236)
- - Performance improvements & bug fixes.
+
+- Engine Update to `1.1.23080.2007` and Signatures Ver: `1.395.1560.0`.
+- Streamlined device connectivity experience is now in public preview mode. [public blog](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-a-streamlined-device-connectivity-experience-for/ba-p/3956236)
+- Performance improvements & bug fixes.
#### Known issues
@@ -1753,20 +1797,18 @@ There are multiple fixes and new changes in this release:
### November-2023 Build: 101.23082.0011 | Release version: 30.123082.0011.0
-| Build: | **101.23082.0011** |
-|--------------------|-----------------------|
-| Released: | **November 1,2023** |
-| Published: | **November 1,2023** |
-| Release version: | **30.123082.0011.0** |
-| Engine version: | **1.1.23070.1002** |
-| Signature version: | **1.393.1305.0** |
+|Build:|**101.23082.0011**|
+|---|---|
+|Released:|**November 1,2023**|
+|Published:|**November 1,2023**|
+|Release version:|**30.123082.0011.0**|
+|Engine version:|**1.1.23070.1002**|
+|Signature version:|**1.393.1305.0**|
#### What's new
- This new release is built over October 2023 release (101.23082.0009) with addition of following changes. There's no change for other customers and upgrading is optional.
-
- Fix for immutable mode of auditd when supplementary subsystem is ebpf: In ebpf mode all mdatp audit rules should be cleaned after switching to ebpf and rebooting. After the reboot, mdatp audit rules weren't cleaned due to which it was resulting in hang of the server. The fix cleans these rules, user shouldn't see any mdatp rules loaded on reboot
-
- Fix for MDE not starting up on RHEL 6.
#### Known issues
@@ -1781,32 +1823,33 @@ There are two ways to mitigate this upgrade issue:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
2. As an alternative you can follow the instructions to [uninstall](./linux-off-board-endpoints.md#uninstall-the-defender-application-from-a-linux-server), then [install](linux-install-manually.md#application-installation) the latest version of the package.
-If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
-Some customers (<1%) experience issues with this method.
+If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading. Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### October-2023 Build: 101.23082.0009 | Release version: 30.123082.0009.0
-| Build: | **101.23082.0009** |
-|--------------------|-----------------------|
-| Released: | **October 9,2023** |
-| Published: | **October 9,2023** |
-| Release version: | **30.123082.0009.0** |
-| Engine version: | **1.1.23070.1002** |
-| Signature version: | **1.393.1305.0** |
+|Build:|**101.23082.0009**|
+|---|---|
+|Released:|**October 9,2023**|
+|Published:|**October 9,2023**|
+|Release version:|**30.123082.0009.0**|
+|Engine version:|**1.1.23070.1002**|
+|Signature version:|**1.393.1305.0**|
#### What's new
-- This new release is built over October 2023 release (`101.23082.0009`) with addition of new CA Certificates. There's no change for other customers and upgrading is optional.
+- This new release is built over October 2023 release (`101.23082.0009`) with addition of new CA Certificates. There's no change for other customers and upgrading is optional.
#### Known issues
@@ -1835,55 +1878,58 @@ sudo systemctl disable mdatp
### October-2023 Build: 101.23082.0006 | Release version: 30.123082.0006.0
-| Build: | **101.23082.0006** |
-|--------------------|-----------------------|
-| Released: | **October 9,2023** |
-| Published: | **October 9,2023** |
-| Release version: | **30.123082.0006.0** |
-| Engine version: | **1.1.23070.1002** |
-| Signature version: | **1.393.1305.0** |
+|Build:|**101.23082.0006**|
+|---|---|
+|Released:|**October 9,2023**|
+|Published:|**October 9,2023**|
+|Release version:|**30.123082.0006.0**|
+|Engine version:|**1.1.23070.1002**|
+|Signature version:|**1.393.1305.0**|
#### What's new
- Feature updates and new changes
-
- eBPF sensor is now the default supplementary event provider for endpoints
-
- Microsoft Intune tenant attach feature is in public preview (as of mid July)
- You must add "*.dm.microsoft.com" to firewall exclusions for the feature to work correctly
-
+
- Defender for Endpoint is now available for Debian 12 and Amazon Linux 2023
-
+
- Support to enable Signature verification of updates downloaded
- You must update the manajed.json as shown:
- ```
+
+ ```json
"features":{
"OfflineDefinitionUpdateVerifySig":"enabled"
}
```
-
+
- Prerequisite to enable feature
- Engine version on the device must be "1.1.23080.007" or above. Check your engine version by using the following command.
- ``` mdatp health --field engine_version ```
-
+
+ ```bash
+ mdatp health --field engine_version
+ ```
+
- Option to support monitoring of NFS and FUSE mount points. These are ignored by default.
The following example shows how to monitor all filesystem while ignoring only NFS:
- ```
- "antivirusEngine": {
- "unmonitoredFilesystems": ["nfs"]
- }
- ```
-
+ ```json
+ "antivirusEngine": {
+ "unmonitoredFilesystems": ["nfs"]
+ }
+ ```
+
Example to monitor all filesystems including NFS and FUSE:
- ```
+
+ ```json
"antivirusEngine": {
"unmonitoredFilesystems": []
}
```
- Other performance improvements
-
+
- Bug Fixes
#### Known issues
@@ -1897,6 +1943,7 @@ There are two ways to mitigate this upgrade issue:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
@@ -1912,24 +1959,21 @@ sudo systemctl disable mdatp
### September-2023 Build: 101.23072.0021 | Release version: 30.123072.0021.0
-| Build: | **101.23072.0021** |
-|--------------------|-----------------------|
-| Released: | **September 11,2023** |
-| Published: | **September 11,2023** |
-| Release version: | **30.123072.0021.0** |
-| Engine version: | **1.1.20100.7** |
-| Signature version: | **1.385.1648.0** |
+|Build:|**101.23072.0021**|
+|---|---|
+|Released:|**September 11,2023**|
+|Published:|**September 11,2023**|
+|Release version:|**30.123072.0021.0**|
+|Engine version:|**1.1.20100.7**|
+|Signature version:|**1.385.1648.0**|
#### What's new
There are multiple fixes and new changes in this release:
- In `mde_installer.sh` v0.6.3, users can use the `--channel` argument to provide the channel of the configured repository during cleanup. For example, `sudo ./mde_installer --clean --channel prod`
-
- The Network Extension can now be reset by administrators using `mdatp network-protection reset`.
-
- Other performance improvements
-
- Bug Fixes
#### Known issues
@@ -1944,6 +1988,7 @@ There are two ways to mitigate this upgrade issue:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
@@ -1954,39 +1999,33 @@ Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### July-2023 Build: 101.23062.0010 | Release version: 30.123062.0010.0
-| Build: | **101.23062.0010** |
-|--------------------|-----------------------|
-| Released: | **July 26,2023** |
-| Published: | **July 26,2023** |
-| Release version: | **30.123062.0010.0** |
-| Engine version: | **1.1.20100.7** |
-| Signature version: | **1.385.1648.0** |
+|Build:|**101.23062.0010**|
+|---|---|
+|Released:|**July 26,2023**|
+|Published:|**July 26,2023**|
+|Release version:|**30.123062.0010.0**|
+|Engine version:|**1.1.20100.7**|
+|Signature version:|**1.385.1648.0**|
#### What's new
-There are multiple fixes and new changes in this release
+There are multiple fixes and new changes in this release:
- If a proxy is set for Defender for Endpoint, then it's visible in the `mdatp health` command output. With this release we provided two options in mdatp diagnostic hot-event-sources:
-
- - Files
- - Executables
-
+ - Files
+ - Executables
- Network Protection: Connections that are blocked by Network Protection and have the block overridden by users is now correctly reported to Microsoft Defender XDR
-
- Improved logging in Network Protection block and audit events for debugging
-
- Other fixes and improvements
-
- - From this version, enforcementLevel are in passive mode by default giving admins more control over where they want 'RTP on' within their estate
- - This change only applies to fresh MDE deployments, for example, servers where Defender for Endpoint is being deployed for the first time. In update scenarios, servers that have Defender for Endpoint deployed with RTP ON, continue operating with RTP ON even post update to version 101.23062.0010
-
+ - From this version, enforcementLevel are in passive mode by default giving admins more control over where they want 'RTP on' within their estate
+ - This change only applies to fresh MDE deployments, for example, servers where Defender for Endpoint is being deployed for the first time. In update scenarios, servers that have Defender for Endpoint deployed with RTP ON, continue operating with RTP ON even post update to version 101.23062.0010
- Bug fix: RPM database corruption issue in Defender Vulnerability Management baseline is fixed.
-
- Other performance improvements
#### Known issues
@@ -2001,6 +2040,7 @@ There are two ways to mitigate this upgrade issue:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
@@ -2011,26 +2051,28 @@ Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### July-2023 Build: 101.23052.0009 | Release version: 30.123052.0009.0
-| Build: | **101.23052.0009** |
-|--------------------|-----------------------|
-| Released: | **July 10,2023** |
-| Published: | **July 10,2023** |
-| Release version: | **30.123052.0009.0** |
-| Engine version: | **1.1.20100.7** |
-| Signature version: | **1.385.1648.0** |
+|Build:|**101.23052.0009**|
+|---|---|
+|Released:|**July 10,2023**|
+|Published:|**July 10,2023**|
+|Release version:|**30.123052.0009.0**|
+|Engine version:|**1.1.20100.7**|
+|Signature version:|**1.385.1648.0**|
#### What's new
-- There are multiple fixes and new changes in this release
- - The build version schema is updated from this release. While the major version number remains same as 101, the minor version number now has five digits followed by four digit patch number that is, `101.xxxxx.yyy`
- - Improved Network Protection memory consumption under stress
- - Updated the engine version to `1.1.20300.5` and signature version to `1.391.2837.0`.
- - Bug fixes.
+There are multiple fixes and new changes in this release:
+
+- The build version schema is updated from this release. While the major version number remains same as 101, the minor version number now has five digits followed by four digit patch number that is, `101.xxxxx.yyy`
+- Improved Network Protection memory consumption under stress
+- Updated the engine version to `1.1.20300.5` and signature version to `1.391.2837.0`.
+- Bug fixes.
#### Known issues
@@ -2044,6 +2086,7 @@ There are two ways to mitigate this upgrade issue:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
@@ -2054,33 +2097,29 @@ Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### June-2023 Build: 101.98.89 | Release version: 30.123042.19889.0
-| Build: | **101.98.89** |
-|--------------------|-----------------------|
-| Released: | **June 12,2023** |
-| Published: | **June 12,2023** |
-| Release version: | **30.123042.19889.0** |
-| Engine version: | **1.1.20100.7** |
-| Signature version: | **1.385.1648.0** |
+|Build:|**101.98.89**|
+|---|---|
+|Released:|**June 12,2023**|
+|Published:|**June 12,2023**|
+|Release version:|**30.123042.19889.0**|
+|Engine version:|**1.1.20100.7**|
+|Signature version:|**1.385.1648.0**|
#### What's new
-There are multiple fixes and new changes in this release
+There are multiple fixes and new changes in this release:
- Improved Network Protection Proxy handling.
-
- In Passive mode, Defender for Endpoint no longer scans when Definition update happens.
-
- Devices continue to be protected even after Defender for Endpoint agent is expired. We recommend upgrading the Defender for Endpoint Linux agent to the latest available version to receive bug fixes, features, and performance improvements.
-
- Removed semanage package dependency.
-
- Engine Update to `1.1.20100.7` and Signatures Ver: `1.385.1648.0`.
-
- Bug fixes.
#### Known issues
@@ -2100,8 +2139,8 @@ There are two ways to mitigate this upgrade issue:
2. As an alternative you can follow the instructions to [uninstall](./linux-off-board-endpoints.md#uninstall-the-defender-application-from-a-linux-server), then [install](linux-install-manually.md#application-installation) the latest version of the package.
-If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
-Some customers (<1%) experience issues with this method.
+If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
+Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
@@ -2110,34 +2149,26 @@ sudo systemctl disable mdatp
### May-2023 Build: 101.98.64 | Release version: 30.123032.19864.0
-| Build: | **101.98.64** |
-|--------------------|-----------------------|
-| Released: | **May 3,2023** |
-| Published: | **May 3,2023** |
-| Release version: | **30.123032.19864.0** |
-| Engine version: | **1.1.20100.6** |
-| Signature version: | **1.385.68.0** |
+|Build:|**101.98.64**|
+|---|---|
+|Released:|**May 3,2023**|
+|Published:|**May 3,2023**|
+|Release version:|**30.123032.19864.0**|
+|Engine version:|**1.1.20100.6**|
+|Signature version:|**1.385.68.0**|
#### What's new
-There are multiple fixes and new changes in this release
+There are multiple fixes and new changes in this release:
- Health message improvements to capture details about auditd failures.
-
- Improvements to handle augenrules, which was causing installation failure.
-
- Periodic memory cleanup in engine process.
-
- Fix for memory issue in mdatp audisp plugin.
-
- Handled missing plugin directory path during installation.
-
- When conflicting application is using blocking fanotify, with default configuration mdatp health shows unhealthy. This is now fixed.
-
- Support for ICMP traffic inspection in BM.
-
- Engine Update to `1.1.20100.6` and Signatures Ver: `1.385.68.0`.
-
- Bug fixes.
#### Known issues
@@ -2157,8 +2188,8 @@ There are two ways to mitigate this upgrade issue:
2. As an alternative you can follow the instructions to [uninstall](./linux-off-board-endpoints.md#uninstall-the-defender-application-from-a-linux-server), then [install](linux-install-manually.md#application-installation) the latest version of the package.
-If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
-Caution: Some customers (<1%) experience issues with this method.
+If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
+Caution: Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
@@ -2167,28 +2198,23 @@ sudo systemctl disable mdatp
### April-2023 Build: 101.98.58 | Release version: 30.123022.19858.0
-| Build: | **101.98.58** |
-|--------------------|-----------------------|
-| Released: | **April 20,2023** |
-| Published: | **April 20,2023** |
-| Release version: | **30.123022.19858.0** |
-| Engine version: | **1.1.20000.2** |
-| Signature version: | **1.381.3067.0** |
+|Build:|**101.98.58**|
+|---|---|
+|Released:|**April 20,2023**|
+|Published:|**April 20,2023**|
+|Release version:|**30.123022.19858.0**|
+|Engine version:|**1.1.20000.2**|
+|Signature version:|**1.381.3067.0**|
#### What's new
-There are multiple fixes and new changes in this release
+There are multiple fixes and new changes in this release:
- Logging and error reporting improvements for auditd.
-
- Handle failure in reload of auditd configuration.
-
- Handling for empty auditd rule files during MDE install.
-
- Engine Update to `1.1.20000.2` and Signatures Ver: `1.381.3067.0`.
-
- Addressed a health issue in mdatp that occurs due to selinux denials.
-
- Bug fixes.
#### Known issues
@@ -2197,6 +2223,7 @@ There are multiple fixes and new changes in this release
```bash
echo -c >> /etc/audit/rules.d/audit.rules
+
augenrules --load
```
@@ -2205,38 +2232,40 @@ There are multiple fixes and new changes in this release
There are two ways to mitigate this upgrade issue:
1. Use your package manager to uninstall the `101.75.43` or `101.78.13` mdatp version.
-
+
Example:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
2. As an alternative you can follow the instructions to [uninstall](./linux-off-board-endpoints.md#uninstall-the-defender-application-from-a-linux-server), then [install](linux-install-manually.md#application-installation) the latest version of the package.
-If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
-Caution: Some customers (<1%) experience issues with this method.
+If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
+Caution: Some customers (<1%) experience issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### March-2023 Build: 101.98.30 | Release version: 30.123012.19830.0
-| Build: | **101.98.30** |
-|--------------------|-----------------------|
-| Released: | **March 20, 2023** |
-| Published: | **March 20, 2023** |
-| Release version: | **30.123012.19830.0** |
-| Engine version: | **1.1.19900.2** |
-| Signature version: | **1.379.1299.0** |
+|Build:|**101.98.30**|
+|---|---|
+|Released:|**March 20, 2023**|
+|Published:|**March 20, 2023**|
+|Release version:|**30.123012.19830.0**|
+|Engine version:|**1.1.19900.2**|
+|Signature version:|**1.379.1299.0**|
#### What's new
-- This new release is built over March 2023 release (`101.98.05`) with a fix for Live response commands failing for one of our customers. There's no change for other customers and upgrade is optional.
-
+- This new release is built over March 2023 release (`101.98.05`) with a fix for Live response commands failing for one of our customers. There's no change for other customers and upgrade is optional.
+
#### Known issues
- With mdatp version 101.98.30 you might see a health false issue in some of the cases, because SELinux rules aren't defined for certain scenarios. The health warning could look something like this:
@@ -2247,6 +2276,7 @@ The issue could be mitigated by running the following commands.
```bash
sudo ausearch -c 'mdatp_audisp_pl' --raw | sudo audit2allow -M my-mdatpaudisppl_v1
+
sudo semodule -i my-mdatpaudisppl_v1.pp
```
@@ -2254,11 +2284,17 @@ Here, my-mdatpaudisppl_v1 represents the policy module name. After you run the c
```bash
sudo service auditd stop
+
sudo systemctl stop mdatp
+
cd /var/log/audit
+
sudo gzip audit.*
+
sudo service auditd start
+
sudo systemctl start mdatp
+
mdatp health
```
@@ -2266,49 +2302,38 @@ In case the issue reappears with some different denials. We need to run the miti
### March-2023 Build: 101.98.05 | Release version: 30.123012.19805.0
-| Build: | **101.98.05** |
-|--------------------|-----------------------|
-| Released: | **March 08, 2023** |
-| Published: | **March 08, 2023** |
-| Release version: | **30.123012.19805.0** |
-| Engine version: | **1.1.19900.2** |
-| Signature version: | **1.379.1299.0** |
+|Build:|**101.98.05**|
+|---|---|
+|Released:|**March 08, 2023**|
+|Published:|**March 08, 2023**|
+|Release version:|**30.123012.19805.0**|
+|Engine version:|**1.1.19900.2**|
+|Signature version:|**1.379.1299.0**|
#### What's new
- Improved Data Completeness for Network Connection events
-
- Improved Data Collection capabilities for file ownership/permissions changes
-
- seManage in part of the package, to that seLinux policies can be configured in different distro (fixed).
-
- Improved enterprise daemon stability
-
- AuditD stop path clean-up
-
- Improved the stability of mdatp stop flow.
-
- Added new field to wdavstate to keep track of platform update time.
-
- Stability improvements to parsing Defender for Endpoint onboarding blob.
-
- Scan doesn't proceed if a valid license isn't present (fixed)
-
- Added performance tracing option to xPlatClientAnalyzer, with tracing enabled mdatp process dumps the flow in all_process.zip file that can be used for analysis of performance issues.
-
- Added support in Defender for Endpoint for the following RHEL-6 kernel versions:
-
- - `2.6.32-754.43.1.el6.x86_64`
- - `2.6.32-754.49.1.el6.x86_64`
-
+ - `2.6.32-754.43.1.el6.x86_64`
+ - `2.6.32-754.49.1.el6.x86_64`
- Other fixes
-
+
#### Known issues
While upgrading mdatp to version 101.94.13, you might notice that health is false, with health_issues as "no active supplementary event provider". This can happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines need to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Make sure to back up following file: `/etc/audit/rules.d/audit.rules` as these steps are only to identify failures.
```bash
echo -c >> /etc/audit/rules.d/audit.rules
+
augenrules --load
```
@@ -2322,13 +2347,14 @@ Example:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
As an alternative, you can follow the instructions to [uninstall](./linux-off-board-endpoints.md#uninstall-the-defender-application-from-a-linux-server), then [install](linux-install-manually.md#application-installation) the latest version of the package.
-In case you don't want to uninstall mdatp you can disable rtp and mdatp in sequence before upgrade.
-Caution: Some customers(<1%) are experiencing issues with this method.
+In case you don't want to uninstall mdatp you can disable rtp and mdatp in sequence before upgrade.
+Caution: Some customers(<1%) are experiencing issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
@@ -2337,27 +2363,28 @@ sudo systemctl disable mdatp
### Jan-2023 Build: 101.94.13 | Release version: 30.122112.19413.0
-| Build: | **101.94.13** |
-|--------------------|-----------------------|
-| Released: | **January 10, 2023** |
-| Published: | **January 10, 2023** |
-| Release version: | **30.122112.19413.0** |
-| Engine version: | **1.1.19700.3** |
-| Signature version: | **1.377.550.0** |
+|Build:|**101.94.13**|
+|---|---|
+|Released:|**January 10, 2023**|
+|Published:|**January 10, 2023**|
+|Release version:|**30.122112.19413.0**|
+|Engine version:|**1.1.19700.3**|
+|Signature version:|**1.377.550.0**|
#### What's new
-- There are multiple fixes and new changes in this release
- - Skip quarantine of threats in passive mode by default.
- - New config, nonExecMountPolicy, can now be used to specify behavior of RTP on mount point marked as noexec.
- - New config, unmonitoredFilesystems, can be used to unmonitor certain filesystems.
- - Improved performance under high load and in speed test scenarios.
- - Fixes an issue with accessing SMB shares behind Cisco AnyConnect VPN connections.
- - Fixes an issue with Network Protection and SMB.
- - lttng performance tracing support.
- - TVM, eBPF, auditd, telemetry, and mdatp cli improvements.
- - mdatp health now reports behavior_monitoring
- - Other fixes.
+There are multiple fixes and new changes in this release:
+
+- Skip quarantine of threats in passive mode by default.
+- New config, nonExecMountPolicy, can now be used to specify behavior of RTP on mount point marked as noexec.
+- New config, unmonitoredFilesystems, can be used to unmonitor certain filesystems.
+- Improved performance under high load and in speed test scenarios.
+- Fixes an issue with accessing SMB shares behind Cisco AnyConnect VPN connections.
+- Fixes an issue with Network Protection and SMB.
+- lttng performance tracing support.
+- TVM, eBPF, auditd, telemetry, and mdatp cli improvements.
+- mdatp health now reports behavior_monitoring
+- Other fixes.
#### Known issues
@@ -2378,6 +2405,7 @@ Example:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
@@ -2388,29 +2416,31 @@ Caution: Some customers(<1%) are experiencing issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### Nov-2022 Build: 101.85.27 | Release version: 30.122092.18527.0
-| Build: | **101.85.27** |
-|--------------------|-----------------------|
-| Released: | **November 02, 2022** |
-| Published: | **November 02, 2022** |
-| Release version: | **30.122092.18527.0** |
-| Engine version: | **1.1.19500.2** |
-| Signature version: | **1.371.1369.0** |
+|Build:|**101.85.27**|
+|---|---|
+|Released:|**November 02, 2022**|
+|Published:|**November 02, 2022**|
+|Release version:|**30.122092.18527.0**|
+|Engine version:|**1.1.19500.2**|
+|Signature version:|**1.371.1369.0**|
#### What's new
-- There are multiple fixes and new changes in this release
- - V2 engine is default with this release and V1 engine bits are removed for enhanced security.
- - V2 engine support configuration path for AV definitions. (mdatp definition set path)
- - Removed external packages dependencies from MDE package. Removed dependencies are libatomic1, libselinux, libseccomp, libfuse, and libuuid
- - In case crash collection is disabled by configuration, crash monitoring process isn't launched.
- - Performance fixes to optimally use system events for AV capabilities.
- - Stability improvement when restarting mdatp and load epsext issues.
- - Other fixes
+There are multiple fixes and new changes in this release:
+
+- V2 engine is default with this release and V1 engine bits are removed for enhanced security.
+- V2 engine support configuration path for AV definitions. (mdatp definition set path)
+- Removed external packages dependencies from MDE package. Removed dependencies are libatomic1, libselinux, libseccomp, libfuse, and libuuid
+- In case crash collection is disabled by configuration, crash monitoring process isn't launched.
+- Performance fixes to optimally use system events for AV capabilities.
+- Stability improvement when restarting mdatp and load epsext issues.
+- Other fixes
#### Known issues
@@ -2424,6 +2454,7 @@ Example:
```bash
sudo apt purge mdatp
+
sudo apt-get install mdatp
```
@@ -2434,18 +2465,19 @@ Caution: Some customers(<1%) are experiencing issues with this method.
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
### Sep-2022 Build: 101.80.97 | Release version: 30.122072.18097.0
-| Build: | **101.80.97** |
-|--------------------|-----------------------|
-| Released: | **September 14, 2022** |
-| Published: | **September 14, 2022** |
-| Release version: | **30.122072.18097.0** |
-| Engine version: | **1.1.19300.3** |
-| Signature version: | **1.369.395.0** |
+|Build:|**101.80.97**|
+|---|---|
+|Released:|**September 14, 2022**|
+|Published:|**September 14, 2022**|
+|Release version:|**30.122072.18097.0**|
+|Engine version:|**1.1.19300.3**|
+|Signature version:|**1.369.395.0**|
#### What's new
@@ -2457,6 +2489,7 @@ sudo systemctl disable mdatp
```bash
sudo mdatp config real-time-protection --value=disabled
+
sudo systemctl disable mdatp
```
@@ -2466,27 +2499,27 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Aug-2022 Build: 101.78.13 | Release version: 30.122072.17813.0
-| Build: | **101.78.13** |
-|--------------------|-----------------------|
-| Released: | **August 24, 2022** |
-| Published: | **August 24, 2022** |
-| Release version: | **30.122072.17813.0** |
-| Engine version: | **1.1.19300.3** |
-| Signature version: | **1.369.395.0** |
-
+|Build:|**101.78.13**|
+|---|---|
+|Released:|**August 24, 2022**|
+|Published:|**August 24, 2022**|
+|Release version:|**30.122072.17813.0**|
+|Engine version:|**1.1.19300.3**|
+|Signature version:|**1.369.395.0**|
+
#### What's new
- Rolled back due to reliability issues
### Aug-2022 (Build: 101.75.43 | Release version: 30.122071.17543.0)
-| Build: | **101.75.43** |
-|--------------------|-----------------------|
-| Released: | **August 2, 2022** |
-| Published: | **August 2, 2022** |
-| Release version: | **30.122071.17543.0** |
-| Engine version: | **1.1.19300.3** |
-| Signature version: | **1.369.395.0** |
+|Build:|**101.75.43**|
+|---|---|
+|Released:|**August 2, 2022**|
+|Published:|**August 2, 2022**|
+|Release version:|**30.122071.17543.0**|
+|Engine version:|**1.1.19300.3**|
+|Signature version:|**1.369.395.0**|
#### What's new
@@ -2498,13 +2531,13 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Jul-2022 Build: 101.73.77 | Release version: 30.122062.17377.0
-| Build: | **101.73.77** |
-|--------------------|-----------------------|
-| Released: | **July 21, 2022** |
-| Published: | **July 21, 2022** |
-| Release version: | **30.122062.17377.0** |
-| Engine version: | **1.1.19200.3** |
-| Signature version: | **1.367.1011.0** |
+|Build:|**101.73.77**|
+|---|---|
+|Released:|**July 21, 2022**|
+|Published:|**July 21, 2022**|
+|Release version:|**30.122062.17377.0**|
+|Engine version:|**1.1.19200.3**|
+|Signature version:|**1.367.1011.0**|
#### What's new
@@ -2515,11 +2548,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Jun-2022 Build: 101.71.18 | Release version: 30.122052.17118.0
-| Build: | **101.71.18** |
-|--------------------|-----------------------|
-| Released: | **June 24, 2022** |
-| Published: | **June 24, 2022** |
-| Release version: | **30.122052.17118.0** |
+|Build:|**101.71.18**|
+|---|---|
+|Released:|**June 24, 2022**|
+|Published:|**June 24, 2022**|
+|Release version:|**30.122052.17118.0**|
#### What's new
@@ -2533,11 +2566,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### May-2022 Build: 101.68.80 | Release version: 30.122042.16880.0
-| Build: | **101.68.80** |
-|--------------------|-----------------------|
-| Released: | **May 23, 2022** |
-| Published: | **May 23, 2022** |
-| Release version: | **30.122042.16880.0** |
+|Build:|**101.68.80**|
+|---|---|
+|Released:|**May 23, 2022**|
+|Published:|**May 23, 2022**|
+|Release version:|**30.122042.16880.0**|
#### What's new
@@ -2550,11 +2583,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### May-2022 Build: 101.65.77 | Release version: 30.122032.16577.0
-| Build: | **101.65.77** |
-|--------------------|-----------------------|
-| Released: | **May 2, 2022** |
-| Published: | **May 2, 2022** |
-| Release version: | **30.122032.16577.0** |
+|Build:|**101.65.77**|
+|---|---|
+|Released:|**May 2, 2022**|
+|Published:|**May 2, 2022**|
+|Release version:|**30.122032.16577.0**|
#### What's new
@@ -2563,11 +2596,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Mar-2022 (Build: 101.62.74 | Release version: 30.122022.16274.0)
-| Build: | **101.62.74** |
-|--------------------|-----------------------|
-| Released: | **Mar 24, 2022** |
-| Published: | **Mar 24, 2022** |
-| Release version: | **30.122022.16274.0** |
+|Build:|**101.62.74**|
+|---|---|
+|Released:|**Mar 24, 2022**|
+|Published:|**Mar 24, 2022**|
+|Release version:|**30.122022.16274.0**|
#### What's new
@@ -2576,11 +2609,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Mar-2022 Build: 101.60.93 | Release version: 30.122012.16093.0
-| Build: | **101.60.93** |
-|--------------------|-----------------------|
-| Released: | **Mar 9, 2022** |
-| Published: | **Mar 9, 2022** |
-| Release version: | **30.122012.16093.0** |
+|Build:|**101.60.93**|
+|---|---|
+|Released:|**Mar 9, 2022**|
+|Published:|**Mar 9, 2022**|
+|Release version:|**30.122012.16093.0**|
#### What's new
@@ -2588,11 +2621,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Mar-2022 Build: 101.60.05 | Release version: 30.122012.16005.0
-| Build: | **101.60.05** |
-|--------------------|-----------------------|
-| Released: | **Mar 3, 2022** |
-| Published: | **Mar 3, 2022** |
-| Release version: | **30.122012.16005.0** |
+|Build:|**101.60.05**|
+|---|---|
+|Released:|**Mar 3, 2022**|
+|Published:|**Mar 3, 2022**|
+|Release version:|**30.122012.16005.0**|
#### What's new
@@ -2601,11 +2634,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Feb-2022 Build: 101.58.80 | Release version: 30.122012.15880.0
-| Build: | **101.58.80** |
-|--------------------|-----------------------|
-| Released: | **Feb 20, 2022** |
-| Published: | **Feb 20, 2022** |
-| Release version: | **30.122012.15880.0** |
+|Build:|**101.58.80**|
+|---|---|
+|Released:|**Feb 20, 2022**|
+|Published:|**Feb 20, 2022**|
+|Release version:|**30.122012.15880.0**|
#### What's new
@@ -2615,11 +2648,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Jan-2022 Build: 101.56.62 | Release version: 30.121122.15662.0
-| Build: | **101.56.62** |
-|--------------------|-----------------------|
-| Released: | **Jan 26, 2022** |
-| Published: | **Jan 26, 2022** |
-| Release version: | **30.121122.15662.0** |
+|Build:|**101.56.62**|
+|---|---|
+|Released:|**Jan 26, 2022**|
+|Published:|**Jan 26, 2022**|
+|Release version:|**30.121122.15662.0**|
#### What's new
@@ -2627,11 +2660,11 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### Jan-2022 Build: 101.53.02 | Release version: 30.121112.15302.0
-| Build: | **101.53.02** |
-|--------------------|-----------------------|
-| Released: | **Jan 8, 2022** |
-| Published: | **Jan 8, 2022** |
-| Release version: | **30.121112.15302.0** |
+|Build:|**101.53.02**|
+|---|---|
+|Released:|**Jan 8, 2022**|
+|Published:|**Jan 8, 2022**|
+|Release version:|**30.121112.15302.0**|
#### What's new
@@ -2641,47 +2674,44 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
#### Build: 101.52.57 | Release version: 30.121092.15257.0
-| Build: | **101.52.57** |
-|--------------------|-----------------------|
-| Release version: | **30.121092.15257.0** |
+|Build:|**101.52.57**|
+|---|---|
+|Release version:|**30.121092.15257.0**|
-##### What's new
+##### What's new
- Added a capability to detect vulnerable Log4j jars in use by Java applications. The machine is periodically inspected for running Java processes with loaded Log4j jars. The information is reported to the Microsoft Defender for Endpoint backend and is exposed in the Vulnerability Management area of the portal.
-#### Build: 101.47.76 | Release version: 30.121092.14776.0
+#### Build: 101.47.76 | Release version: 30.121092.14776.0
+
+|Build:|**101.47.76**|
+|---|---|
+|Release version:|**30.121092.14776.0**|
-| Build: | **101.47.76** |
-|--------------------|-----------------------|
-| Release version: | **30.121092.14776.0** |
-
##### What's new
- Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured through mdatp config scan-archives--value [enabled/disabled]. By default, this setting is set to enabled.
-
- Bug fixes
#### Build: 101.45.13 | Release version: 30.121082.14513.0
-| Build: | **101.45.13** |
-|--------------------|-----------------------|
-| Release version: | **30.121082.14513.0** |
+|Build:|**101.45.13**|
+|---|---|
+|Release version:|**30.121082.14513.0**|
##### What's new
- Beginning with this version, we're bringing Microsoft Defender for Endpoint support to the following distros:
-
- RHEL6.7-6.10 and CentOS6.7-6.10 versions.
- Amazon Linux 2
- Fedora 33 or higher
-
- Bug fixes
#### Build: 101.45.00 | Release version: 30.121072.14500.0
-| Build: | **101.45.00** |
-|--------------------|-----------------------|
-| Release version: | **30.121072.14500.0** |
+|Build:|**101.45.00**|
+|---|---|
+|Release version:|**30.121072.14500.0**|
##### What's new
@@ -2693,9 +2723,9 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
#### Build: 101.39.98 | Release version: 30.121062.13998.0
-| Build: | **101.39.98** |
-|--------------------|-----------------------|
-| Release version: | **30.121062.13998.0** |
+|Build:|**101.39.98**|
+|---|---|
+|Release version:|**30.121062.13998.0**|
##### What's new
@@ -2703,9 +2733,9 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
#### Build: 101.34.27 | Release version: 30.121052.13427.0
-| Build: | **101.34.27** |
-|--------------------|-----------------------|
-| Release version: | **30.121052.13427.0** |
+|Build:|**101.34.27**|
+|---|---|
+|Release version:|**30.121052.13427.0**|
##### What's new
@@ -2713,9 +2743,9 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
#### Build: 101.29.64 | Release version: 30.121042.12964.0
-| Build: | **101.29.64** |
-|--------------------|-----------------------|
-| Release version: | **30.121042.12964.0** |
+|Build:|**101.29.64**|
+|---|---|
+|Release version:|**30.121042.12964.0**|
##### What's new
@@ -2727,21 +2757,21 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
#### Build: 101.25.72 | Release version: 30.121022.12563.0
-| Build: | **101.25.72** |
-|--------------------|-----------------------|
-| Release version: | **30.121022.12563.0** |
+|Build:|**101.25.72**|
+|---|---|
+|Release version:|**30.121022.12563.0**|
##### What's new
- Microsoft Defender for Endpoint on Linux is now available in preview for US Government customers. For more information, see [Microsoft Defender for Endpoint for US Government customers](gov.md).
- Fixed an issue where usage of Microsoft Defender for Endpoint on Linux on systems with FUSE filesystems was leading to OS hang
- Performance improvements & other bug fixes
-
+
#### Build: 101.25.63 | Release version: 30.121022.12563.0
-| Build: | **101.25.63** |
-|--------------------|-----------------------|
-| Release version: | **30.121022.12563.0** |
+|Build:|**101.25.63**|
+|---|---|
+|Release version:|**30.121022.12563.0**|
##### What's new
@@ -2749,9 +2779,9 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
#### Build: 101.23.64 | Release version: 30.121021.12364.0
-| Build: | **101.23.64** |
-|--------------------|-----------------------|
-| Release version: | **30.121021.12364.0** |
+|Build:|**101.23.64**|
+|---|---|
+|Release version:|**30.121021.12364.0**|
##### What's new
@@ -2764,7 +2794,6 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
##### What's new
- EDR for Linux is now [generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-is-generally-available/ba-p/2048539)
-
- Added a new command-line switch (`--ignore-exclusions`) to ignore AV exclusions during custom scans (`mdatp scan custom`)
- Extended `mdatp diagnostic create` with a new parameter (`--path [directory]`) that allows the diagnostic logs to be saved to a different directory
- Performance improvements & bug fixes
@@ -2822,4 +2851,4 @@ As an alternative approach, follow the instructions to [uninstall](./linux-off-b
### 1.1.15010101
- With this version, we're announcing support for iPadOS/iPad devices.
-- Bug fixes.
\ No newline at end of file
+- Bug fixes.
diff --git a/defender-endpoint/respond-file-alerts.md b/defender-endpoint/respond-file-alerts.md
index 21957abc870..3bfb16ddb7d 100644
--- a/defender-endpoint/respond-file-alerts.md
+++ b/defender-endpoint/respond-file-alerts.md
@@ -11,10 +11,10 @@ ms.collection:
- mde-edr
ms.topic: how-to
ms.subservice: edr
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 2
-ms.custom: sfi-ga-nochange, msecd-doc-authoring-1014
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1016
ai-usage: ai-assisted
---
@@ -24,7 +24,7 @@ ai-usage: ai-assisted
Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check on activity details in the Action center.
-Response actions are available on a file's detailed profile page. Once on this page, you can switch between the new and old page layouts by toggling **new File page**. The rest of this article describes the newer page layout.
+Response actions are available on a file's detailed profile page. Once on this page, you can switch between the new and old page layouts by toggling **new File page**. The following sections describe the newer page layout.
Response actions run along the top of the file page, and include:
@@ -61,11 +61,11 @@ For more information on roles, see [Create and manage roles for role-based acces
You can contain an attack in your organization by stopping the malicious process and quarantining the file where it was observed.
> [!IMPORTANT]
-> You can only take this action if:
+> You can only take the **Stop and Quarantine File** action if:
>
> - The device you're taking the action on is running Windows 10, version 1703 or later, Windows 11, and Windows Server 2012 R2+
> - The file does not belong to trusted non-Microsoft publishers or is not signed by Microsoft
-> - Microsoft Defender Antivirus must at least be running on Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).
+> - Microsoft Defender Antivirus must at least be running on Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md).
The **Stop and Quarantine File** action includes stopping running processes, quarantining the files, and deleting persistent data such as registry keys.
@@ -213,14 +213,14 @@ If a file hasn't been seen in the organization in the past 30 days, **Collect fi
## Add indicator to block or allow a file
-Prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation prevents it from being read, written, or executed on devices in your organization.
+Prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. Blocking the file prevents it from being read, written, or executed on devices in your organization.
> [!IMPORTANT]
>
-> - The **Block or allow** feature is available if your organization uses Microsoft Defender Antivirus and Cloud-delivered protection is enabled. For more information, see [Manage cloud-delivered protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).
+> - The **Block or allow** feature is available if your organization uses Microsoft Defender Antivirus and Cloud-delivered protection is enabled. For more information, see [Manage cloud-delivered protection](deploy-manage-report-microsoft-defender-antivirus.md).
>
> - The Anti-malware client version must be 4.18.1901.x or later.
-> - The **Block or allow** feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time.
+> - The **Block or allow** feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It supports portable executable (PE) files, including _.exe_ and _.dll_ files. Support for additional file types will be extended over time.
> - The **Block or allow** response action is available for devices on Windows 10, version 1703 or later, and Windows 11.
> - The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action.
@@ -241,9 +241,9 @@ Files automatically blocked by an indicator don't show up in the file's Action c
See [Overview of indicators](indicators-overview.md) for more details on blocking and raising alerts on files.
-To stop blocking a file, remove the indicator. You can do so via the **Edit Indicator** action on the file's profile page. The **Edit Indicator** action is visible in the same position as the **Add Indicator** action, before you added the indicator.
+To stop blocking a file, remove the indicator. You can remove the indicator via the **Edit Indicator** action on the file's profile page. The **Edit Indicator** action is visible in the same position as the **Add Indicator** action, before you added the indicator.
-You can also edit indicators from the **Settings** page, under **Rules** \> **Indicators**. Indicators are listed in this area by their file's hash.
+You can also edit indicators from the **Settings** page, under **Rules** \> **Indicators**. Indicators are listed on the **Rules** \> **Indicators** page by their file's hash.
## Check activity details in Action center
@@ -267,7 +267,7 @@ Deep analysis supports extensive analysis of portable executable (PE) files (inc
Deep analysis of a file takes several minutes. Once the file analysis is complete, the Deep Analysis tab updates to display a summary and the date and time of the latest available results.
-The deep analysis summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. If nothing was found, these sections display a brief message.
+The deep analysis summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. If nothing was found, the Behaviors and Observables sections display a brief message.
Results of deep analysis are matched against threat intelligence and any matches generate appropriate alerts.
@@ -283,7 +283,7 @@ Learn about deep analysis in the following video:
> [!NOTE]
> Only files from Windows 10, Windows 11, and Windows Server 2012 R2+ can be automatically collected.
-You can also submit a sample through the [Microsoft Defender portal](https://www.microsoft.com/security/portal/submission/submit.aspx) if the file wasn't observed on a Windows 10 device (or Windows 11 or Windows Server 2012 R2+), and wait for **Submit for deep analysis** button to become available.
+You can also submit a sample through the [Microsoft Security Intelligence submission portal](https://www.microsoft.com/wdsi/filesubmission) if the file wasn't observed on a Windows 10 device (or Windows 11 or Windows Server 2012 R2+), and wait for **Submit for deep analysis** button to become available.
> [!NOTE]
> Due to backend processing flows in the Microsoft Defender portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Defender for Endpoint.
@@ -308,7 +308,7 @@ To submit a file for deep analysis, use the following steps:
A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done.
> [!NOTE]
-> Depending on device availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 device (or Windows 11 or Windows Server 2012 R2+) reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
+> Depending on device availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the deep analysis submission will abort if there is no online Windows 10 device (or Windows 11 or Windows Server 2012 R2+) reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
### View deep analysis reports
@@ -357,4 +357,3 @@ If you come across a problem when trying to submit a file, try each of the follo
- [Take response actions on a device](respond-machine-alerts.md)
- [Investigate files](investigate-files.md)
- [Manual response actions in Microsoft Defender for Endpoint Plan 1](defender-endpoint-plan-1.md#manual-response-actions)
-
diff --git a/defender-endpoint/respond-machine-alerts.md b/defender-endpoint/respond-machine-alerts.md
index 98ccdc81c1a..a9c92231586 100644
--- a/defender-endpoint/respond-machine-alerts.md
+++ b/defender-endpoint/respond-machine-alerts.md
@@ -1,11 +1,11 @@
---
title: Take response actions on a device in Microsoft Defender for Endpoint
-description: Take response actions on a device such as isolating devices, collecting an investigation package, managing tags, running an antivirus scan, and restricting app execution.
+description: Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.
ms.service: defender-endpoint
ms.author: lwainstein
author: limwainstein
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/23/2026
ms.collection:
- m365-security
- tier2
@@ -13,9 +13,11 @@ ms.collection:
ms.topic: how-to
ms.subservice: edr
appliesto:
+ - Microsoft Defender for Endpoint Plan 1
+ - Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Take response actions on a device
@@ -28,7 +30,7 @@ Response actions run along the top of a specific device page and include:
- Manage tags
- Initiate automated investigation
-- Initiate live response Session
+- Initiate live response session
- Collect investigation package
- Run antivirus scan
- Restrict app execution
@@ -37,7 +39,7 @@ Response actions run along the top of a specific device page and include:
- Consult a threat expert
- Action center
-[](media/response-actions.png#lightbox)
+:::image type="content" source="media/response-actions.png" alt-text="Screenshot that shows response actions across the top of a device page in the Microsoft Defender portal." lightbox="media/response-actions.png":::
> [!NOTE]
> [Defender for Endpoint Plan 1](defender-endpoint-plan-1.md) includes only the following manual response actions:
@@ -45,13 +47,13 @@ Response actions run along the top of a specific device page and include:
> - Run antivirus scan
> - Isolate device
> - Stop and quarantine a file
-> - Add an indicator to block or allow a file.
+> - Add an indicator to block or allow a file
>
> [Microsoft Defender for Business](/defender-business/mdb-overview) doesn't include the "Stop and quarantine a file" action at this time.
>
> Your subscription must include Defender for Endpoint Plan 2 to have all of the response actions described in this article.
- You can find device pages from any of the following views:
+You can find device pages from any of the following views:
- **Alerts queue**: Select the device name beside the device icon from the alerts queue.
- **Devices list**: Select the heading of the device name from the devices list.
@@ -60,9 +62,7 @@ Response actions run along the top of a specific device page and include:
> [!IMPORTANT]
> For information on availability and support for each response action, see the supported minimum operating system requirements listed in [Minimum requirements for Microsoft Defender for Endpoint](minimum-requirements.md).
-### Limiting high-impact response actions on high-value assets
-
-Some high-impact response actions can be restricted on high-value assets to prevent potential business disruption. For more information, see [Restrict response actions on high-value assets](./restrict-response-actions-high-value-assets.md).
+Some high-impact response actions can be restricted on high-value assets to prevent potential business disruption. For more information, see [Restrict response actions on high-value assets](restrict-response-actions-high-value-assets.md).
## Manage tags
@@ -72,18 +72,21 @@ For more information on device tagging, see [Create and manage device tags](mach
## Initiate automated investigation
-You can start a new, general-purpose automated investigation on the device if needed. While an investigation is running, any other alert generated from the device is added to an ongoing automated investigation until that investigation completes. In addition, if the same threat is seen on other devices, those devices are added to the investigation.
+You can start a new automated investigation on the device if needed. While an investigation runs, any other alert from the device is added to that investigation until it completes. If the same threat appears on other devices, those devices are also added.
For more information on automated investigations, see [Overview of Automated investigations](automated-investigations.md).
## Initiate live response session
-Live response is a capability that gives you instantaneous access to a device by using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats in real time.
+Live response gives you instant access to a device through a remote shell connection. Live response lets you do deep investigative work and take quick action to contain threats in real time.
-Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.
+Live response helps you collect forensic data, run scripts, send suspicious entities for analysis, fix threats, and hunt for emerging threats.
For more information on live response, see [Investigate entities on devices using live response](live-response.md).
+> [!NOTE]
+> Live response can be restricted on devices onboarded as [high-value assets](restrict-response-actions-high-value-assets.md), based on the selective response actions defined when the device was onboarded. If live response isn't available for a device, review the device's selective response actions configuration.
+
## Collect investigation package from devices
As part of the investigation or response process, you can collect an investigation package from a device. By collecting the investigation package, you can identify the current state of the device and further understand the tools and techniques used by the attacker.
@@ -100,20 +103,20 @@ Or, use this alternate procedure:
1. Select **Collect Investigation Package** from the response actions section of the device page.
- 
-
+ :::image type="content" source="media/collect-investigation-package.png" alt-text="Screenshot of the device page option to collect an investigation package." lightbox="media/collect-investigation-package.png":::
+
1. Add comments and then select **Confirm**.
- 
-
+ :::image type="content" source="media/comments-confirm.png" alt-text="Screenshot of the confirmation dialog for adding a comment to the action." lightbox="media/comments-confirm.png":::
+
1. Select **Action center** from the response actions section of the device page.
- 
-
+ :::image type="content" source="media/action-center-selected.png" alt-text="Screenshot of the Action center selected in the response actions section of the device page." lightbox="media/action-center-selected.png":::
+
1. Select **Package collection package available** to download the collection package.
- 
-
+ :::image type="content" source="media/download-package.png" alt-text="Screenshot of the option to download the collected investigation package from the Action center." lightbox="media/download-package.png":::
+
> [!NOTE]
> Collection of the investigation package might fail if the target device has a low battery level or is on a metered connection.
@@ -125,18 +128,18 @@ For Windows devices, the package contains the folders described in the following
|---|---|
|Autoruns|Contains a set of files that each represent the content of the registry of a known auto start entry point (ASEP) to help identify attacker's persistency on the device.
If the registry key isn't found, the file contains the following message: "ERROR: The system was unable to find the specified registry key or value." |
|Installed programs|This .CSV file contains the list of installed programs that can help identify what is currently installed on the device. For more information, see [Win32_Product class](https://go.microsoft.com/fwlink/?linkid=841509).|
-|Network connections|This folder contains a set of data points related to the connectivity information that can help in identifying connectivity to suspicious URLs, attacker's command and control (C&C) infrastructure, any lateral movement, or remote connections.
- `ActiveNetConnections.txt`: Displays protocol statistics and current TCP/IP network connections. Enables you to look for suspicious connectivity made by a process.
- `Arp.txt`: Displays the current address resolution protocol (ARP) cache tables for all interfaces. ARP cache can reveal other hosts on a network that were compromised or suspicious systems on the network that might be used to run an internal attack.
- `DnsCache.txt`: Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections.
- `IpConfig.txt`: Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.
- `FirewallExecutionLog.txt` and `pfirewall.log`
The `pfirewall.log` file must exist in `%windir%\system32\logfiles\firewall\pfirewall.log`. It's included in the investigation package. For more information on creating the firewall log file, see [Configure the Windows Firewall with Advanced Security Log](/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log).|
+|Network connections|This folder contains a set of data points related to the connectivity information that can help in identifying connectivity to suspicious URLs, attacker's command and control (C&C) infrastructure, any lateral movement, or remote connections.
- `ActiveNetConnections.txt`: Displays protocol statistics and current TCP/IP network connections. Enables you to look for suspicious connectivity made by a process.
- `Arp.txt`: Displays the current address resolution protocol (ARP) cache tables for all interfaces. ARP cache can reveal other hosts on a network that were compromised or suspicious systems on the network that might be used to run an internal attack.
- `DnsCache.txt`: Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. Reviewing the DNS cache can help identify suspicious connections.
- `IpConfig.txt`: Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.
- `FirewallExecutionLog.txt` and `pfirewall.log`
The `pfirewall.log` file must exist in `%windir%\system32\logfiles\firewall\pfirewall.log`. It's included in the investigation package. For more information on creating the firewall log file, see [Configure the Windows Firewall with Advanced Security Log](/windows/security/operating-system-security/network-security/windows-firewall/configure-logging).|
|Prefetch files|Windows Prefetch files are designed to speed up the application startup process. It can be used to track all the files recently used in the system and find traces for applications that might be deleted but can still be found in the prefetch file list.
- `Prefetch folder`: Contains a copy of the prefetch files from `%SystemRoot%\Prefetch`. We recommend downloading a prefetch file viewer to view the prefetch files.
- `PrefetchFilesList.txt`: Contains the list of all the copied files that can be used to track if there were any copy failures to the prefetch folder.|
-|Processes|Contains a .CSV file listing the processes currently running on the device. This can be useful when identifying a suspicious process and its state.|
+|Processes|Contains a .CSV file listing the processes currently running on the device. This process list can be useful when identifying a suspicious process and its state.|
|Scheduled tasks|Contains a .CSV file listing the scheduled tasks, which can be used to identify routines performed automatically on a chosen device to look for suspicious code that was set to run automatically.|
|Security event log|Contains the security event log, which contains records of sign-in or sign out activity, or other security-related events specified by the system's audit policy.
Open the event log file using Event viewer.|
|Services|Contains a .CSV file that lists services and their states.|
-|Windows Server Message Block (SMB) sessions|Lists shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network. This can help identify data exfiltration or lateral movement.
Contains files for `SMBInboundSessions` and `SMBOutboundSession`. If there are no sessions (inbound or outbound), you get a text file that tells you that there are no SMB sessions found.|
+|Windows Server Message Block (SMB) sessions|Lists shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network. Reviewing SMB session data can help identify data exfiltration or lateral movement.
Contains files for `SMBInboundSessions` and `SMBOutboundSession`. If there are no sessions (inbound or outbound), you get a text file that tells you that there are no SMB sessions found.|
|System Information|Contains a `SystemInformation.txt` file that lists system information such as OS version and network cards.|
|Temp Directories|Contains a set of text files that lists the files located in `%Temp%` for every user in the system. This can help to track suspicious files that an attacker might have dropped on the system.
If the file contains the following message: "The system can't find the path specified," it means that there's no temp directory for this user, and might be because the user didn't sign in to the system.|
|Users and Groups|Provides a list of files that each represent a group and its members.|
-|WdSupportLogs|Provides the `MpCmdRunLog.txt` and `MPSupportFiles.cab`. This folder is only created on Windows 10, version 1709 or later with February 2020 update rollup or more recent versions installed:
- Win10 1709 (RS3) Build 16299.1717: [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816)
- Win10 1803 (RS4) Build 17134.1345: [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795)
- Win10 1809 (RS5) Build 17763.1075: [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818)
- Win10 1903/1909 (19h1/19h2) Builds 18362.693 and 18363.693: [KB4535996](https://support.microsoft.com/help/4535996/windows-10-update-kb4535996)|
-|CollectionSummaryReport.xls|This file is a summary of the investigation package collection, it contains the list of data points, the command used to extract the data, the execution status, and the error code if there's failure. You can use this report to track if the package includes all the expected data and identify if there were any errors.|
+|WdSupportLogs|Provides the `MpCmdRunLog.txt` and `MPSupportFiles.cab`. This folder is only created on Windows 10, version 1709 or later with February 2020 update rollup or more recent versions installed:
- Win10 1709 (RS3) Build 16299.1717: [KB4537816](https://support.microsoft.com/servicing/os/windows-10/2020/02/february-25-2020-kb4537816-os-build-16299-1717)
- Win10 1803 (RS4) Build 17134.1345: [KB4537795](https://support.microsoft.com/topic/february-25-2020-kb4537795-os-build-17134-1345-36b35e62-d897-2dc3-289c-44a1327c2d8e)
- Win10 1809 (RS5) Build 17763.1075: [KB4537818](https://support.microsoft.com/servicing/os/windows-10/2020/02/february-25-2020-kb4537818-os-build-17763-1075)
- Win10 1903/1909 (19h1/19h2) Builds 18362.693 and 18363.693: [KB4535996](https://support.microsoft.com/topic/february-27-2020-kb4535996-os-builds-18362-693-and-18363-693-7974b3c8-f463-2980-1ec6-72363d291bd2)|
+|CollectionSummaryReport.xls|The CollectionSummaryReport.xls file is a summary of the investigation package collection. It contains the list of data points, the command used to extract the data, the execution status, and the error code if there's failure. You can use this report to track if the package includes all the expected data and identify if there were any errors.|
### Investigation package contents for Mac and Linux devices
@@ -164,16 +167,16 @@ As part of the investigation or response process, you can remotely initiate an a
> - The remote antivirus scan action is supported for macOS and Linux for client version 101.98.84 and above. You can also use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md)
> - A Microsoft Defender Antivirus scan can run alongside other antivirus solutions, whether Microsoft Defender Antivirus is the active antivirus solution or not. Microsoft Defender Antivirus can be in Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md).
-One you have selected **Run antivirus scan**, select the scan type that you'd like to run (quick or full) and add a comment before confirming the scan.
+Once you have selected **Run antivirus scan**, select the scan type that you'd like to run (quick or full) and add a comment before confirming the scan.
-:::image type="content" source="media/run-antivirus.png" alt-text="The notification to select quick scan or full scan and add comment" lightbox="media/run-antivirus.png":::
+:::image type="content" source="media/run-antivirus.png" alt-text="Screenshot of the notification to select a quick or full scan and add a comment." lightbox="media/run-antivirus.png":::
-The Action center shows the scan information and the device timeline include a new event, reflecting that a scan action was submitted on the device. Microsoft Defender Antivirus alerts reflect any detections that surfaced during the scan.
+The Action center shows the antivirus scan details. The device timeline includes a new event that shows a scan action was submitted on the device. Microsoft Defender Antivirus alerts show any threats found during the scan.
> [!NOTE]
-> When triggering a scan using Defender for Endpoint response action, Microsoft Defender antivirus `ScanAvgCPULoadFactor` value applies and limits the CPU impact of the scan.
+> When triggering a scan using Defender for Endpoint response action, Microsoft Defender Antivirus `ScanAvgCPULoadFactor` value applies and limits the CPU impact of the scan.
> If `ScanAvgCPULoadFactor` isn't configured, the default value is a limit of 50% maximum CPU load during a scan.
-> For more information, see [configure-advanced-scan-types-microsoft-defender-antivirus](/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus).
+> For more information, see [Configure advanced scan types for Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md).
## Restrict app execution
@@ -183,22 +186,22 @@ In addition to containing an attack by stopping malicious processes, you can als
>
> - Restrict app execution is available for devices on Windows 10, version 1709 or later, Windows 11, and Windows Server 2019 or later.
> - Restrict app execution is available if your organization uses Microsoft Defender Antivirus.
-> - Restrict app execution needs to meet the Windows Defender Application Control code integrity policy formats and signing requirements. For more information, see [Code integrity policy formats and signing](/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications)).
+> - Restrict app execution needs to meet the Windows Defender Application Control code integrity policy formats and signing requirements. For more information, see [Code integrity policy formats and signing](/windows/security/application-security/application-control/app-control-for-business/deployment/use-code-signing-for-better-control-and-protection).
-To restrict an application from running, a code integrity policy is applied that only allows files to run if they're signed by a Microsoft issued certificate. Restricting app execution to only Microsoft-signed files can help prevent an attacker from controlling compromised devices and performing further malicious activities.
+To restrict an app from running, a code integrity policy is applied. This policy only allows files to run if they're signed by a Microsoft-issued certificate. Allowing only Microsoft-signed files helps stop attackers from controlling compromised devices.
> [!NOTE]
-> You are able to reverse the restriction of applications from running at any time. The button on the device page changes to say **Remove app restrictions**, and then you take the same steps as restricting app execution.
+> You are able to reverse the restriction of applications from running at any time. The button on the device page changes to say **Remove app restrictions**, and then you select **Remove app restrictions**, type a comment, and select **Confirm**.
-Once you have selected **Restrict app execution** on the device page, type a comment and select **Confirm**. The Action center shows the scan information and the device timeline include a new event.
+Once you have selected **Restrict app execution** on the device page, type a comment and select **Confirm**. The Action center shows the app restriction details, and the device timeline includes a new event.
-:::image type="content" source="media/restrict-app-execution.png" alt-text="The application restriction notification" lightbox="media/restrict-app-execution.png":::
+:::image type="content" source="media/restrict-app-execution.png" alt-text="Screenshot of the app restriction confirmation notification." lightbox="media/restrict-app-execution.png":::
-### Notification on device user
+### Device user notification for app restriction
When an app is restricted, the following notification is displayed to inform the user that an app is being restricted from running:
-:::image type="content" source="media/atp-app-restriction.png" alt-text="The application restriction message" lightbox="media/atp-app-restriction.png":::
+:::image type="content" source="media/atp-app-restriction.png" alt-text="Screenshot of the app restriction message shown to the device user." lightbox="media/atp-app-restriction.png":::
> [!NOTE]
> The notification isn't available on Windows Server 2016 and Windows Server 2012 R2.
@@ -218,7 +221,7 @@ Depending on the severity of the attack and the sensitivity of the device, you m
- `ip6tables`
- Linux kernel with `CONFIG_NETFILTER`, `CONFIG_IP_NF_IPTABLES`, and `CONFIG_IP_NF_MATCH_OWNER` for kernel version lower than 5.x and `CONFIG_NETFILTER_XT_MATCH_OWNER` from 5.x kernel.
-- Selective isolation is available for devices running on Windows 11, Windows 10 version 1703 or later, Windows Server 2012 R2 and later, Azure Stack HCI OS, version 23H2 and later, and macOS. For more information about selective isolation, see [Isolation exclusions](./isolation-exclusions.md).
+- Selective isolation is available for devices running on Windows 11, Windows 10 version 1703 or later, Windows Server 2012 R2 and later, Azure Stack HCI OS, version 23H2 and later, and macOS. For more information about selective isolation, see [Isolation exclusions](network-isolation-exclusions.md).
- When isolating a device, only certain processes and destinations are allowed. Therefore, devices that are behind a full VPN tunnel won't be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. We recommend using a split-tunneling VPN for Microsoft Defender for Endpoint and Microsoft Defender Antivirus cloud-based protection-related traffic.
- The feature supports VPN connection.
- You must have at least the `Active remediation actions` role assigned. For more information, see [Create and manage roles](user-roles.md).
@@ -226,6 +229,7 @@ Depending on the severity of the attack and the sensitivity of the device, you m
- Exclusions, such as e-mail, messaging application, and other applications for both macOS and Linux isolation aren't supported.
- An isolated device is removed from isolation when an administrator modifies or adds a new `iptable` rule to the isolated device.
- Isolating a server running on Microsoft Hyper-V blocks network traffic to all child virtual machines of the server.
+- Device isolation is automatically lifted after seven days.
The device isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device. On Windows 10, version 1709 or later, you can use selective isolation for more control over the network isolation level. You can also choose to enable Outlook and Microsoft Teams connectivity.
@@ -234,7 +238,7 @@ The device isolation feature disconnects the compromised device from the network
>
> If a device is inactive or offline when an isolation action is submitted, Microsoft Defender for Endpoint retries enforcing the isolation for up to three days. If the device doesn't reconnect in that time, the isolation won't be retried, and administrators should reissue the isolation action after the device becomes active.
-Once you have selected **Isolate device** on the device page, type a comment and select **Confirm**. The Action center shows the scan information and the device timeline include a new event.
+Once you have selected **Isolate device** on the device page, type a comment and select **Confirm**. The Action center shows the scan information and the device timeline includes a new event.
:::image type="content" source="media/isolate-device.png" alt-text="An isolated device details page" lightbox="media/isolate-device.png":::
@@ -245,7 +249,7 @@ Once you have selected **Isolate device** on the device page, type a comment and
## Isolate device - automatic attack disruption (Preview)
-When a device in your organization is suspected to be compromised, Microsoft Defender for Endpoint can automatically isolate the device as part of [automatic attack disruption](/defender-xdr/automatic-attack-disruption). Automatic isolation helps reduce the risk of further impact on the organization, limit attacker lateral movement, and prevent impacts such as data exfiltration and ransomware propagation.
+When a device in your organization might be compromised, Microsoft Defender for Endpoint can automatically isolate it as part of [automatic attack disruption](/defender-xdr/automatic-attack-disruption). Automatic isolation helps reduce further impact on the organization and limit attacker lateral movement. It also helps prevent data exfiltration and ransomware spread.
When a device is isolated automatically:
- The compromised device is disconnected from the network, reducing the risk of further impact on the organization.
@@ -261,49 +265,75 @@ When a device is isolated automatically:
After automatic isolation is applied, you can review the action and its status in the Defender portal:
- Open the relevant incident and review the **Activities** tab.
-
+
:::image type="content" source="/defender/media/defender-endpoint/view-automatic-device-isolation-activities.png" alt-text="Screenshot showing how to view automatic device isolation in the Activities tab." lightbox="/defender/media/defender-endpoint/view-automatic-device-isolation-activities.png":::
+
- Open the affected device page and confirm the device isolation status.
- Open **Action center** to review action history and current state.
-
- :::image type="content" source="/defender/media/defender-endpoint/view-automatic-device-isolation-action.png" alt-text="Screenshot showing how to view automatic device isolation in the Action Center." lightbox="/defender/media/defender-endpoint/view-automatic-device-isolation-action.png":::
+
+ :::image type="content" source="/defender/media/defender-endpoint/view-automatic-device-isolation-action.png" alt-text="Screenshot showing how to view automatic device isolation in the Action center." lightbox="/defender/media/defender-endpoint/view-automatic-device-isolation-action.png":::
### Safeguards and business impact
+
Before deploying or responding to automatic device isolation, consider the following:
-- **Scoped action**: Isolation targets specific devices involved in the incident rather than broadly across the environment.
+- **Scoped action**: Isolation targets specific devices involved in the incident rather than broadly throughout the environment.
- **Time-limited isolation**: Isolation is automatically undone after a defined time window. You can also release isolation earlier after completing investigation and remediation.
- **Customer control**: Security operators can review the incident context and take follow-up actions, including releasing isolation when it's safe to do so.
### Isolation exclusions and automatic attack disruption exclusions
+
There are two types of exclusions relevant to automatic device isolation:
-- [Selective isolation exclusions](isolation-exclusions.md): Define which processes and network destinations remain accessible on an isolated device. Use these to preserve critical communications (for example, management tools or business applications) while the device is isolated. Selective isolation exclusions are available for devices running on Windows 11, Windows 10 version 1703 or later, Windows Server 2012 R2 and later, Azure Stack HCI OS, version 23H2 and later, and macOS.
+- [Selective isolation exclusions](network-isolation-exclusions.md): Define which processes and network destinations remain accessible on an isolated device. Use these to preserve critical communications (for example, management tools or business applications) while the device is isolated. Selective isolation exclusions are available for devices running on Windows 11, Windows 10 version 1703 or later, Windows Server 2012 R2 and later, Azure Stack HCI OS, version 23H2 and later, and macOS.
- [Automatic attack disruption exclusions](/defender-xdr/automatic-attack-disruption-exclusions): Define which devices or entities are excluded from automatic disruption actions entirely. Use these to prevent business-critical devices from being isolated in the first place.
> [!NOTE]
> When an isolation exclusion rule is defined, automatic attack disruption uses selective isolation by default and isolates the device according to the configured isolation exclusion rules.
If an automatically isolated device is business-critical, prioritize rapid validation and stakeholder coordination. Release isolation only after you confirm appropriate containment and remediation steps are in place. Consider using [automatic attack disruption exclusions](/defender-xdr/automatic-attack-disruption-exclusions) to reduce the likelihood of isolating devices that can't tolerate interruption.
+
### Confirm automatic device isolation
+To confirm that automatic device isolation was applied, follow these steps:
+
1. Open the relevant incident generated by automatic attack disruption in the [Microsoft Defender portal](https://security.microsoft.com).
1. Review the **Activity** tab or **Action center** to see which automated response actions were applied.
1. Open the affected device page and confirm that the device status shows that it's isolated.
- If the isolation action shows as failed or pending, confirm that the device is online and can report to Defender for Endpoint. You can retry from the device action panel if available.
- If a device appears isolated but you can't collect investigation data, verify that your investigation method (for example, live response) is supported for that device and scenario. Also confirm required service endpoints are reachable in your network configuration. For more information, see [Investigate entities on devices using live response](live-response.md) and [Configure device connectivity and proxy settings in Microsoft Defender for Endpoint](configure-device-connectivity.md).
+
### Release a device from automatic isolation
+
You can release the device from containment at any time after you mitigate the risk and complete investigation:
+
1. Select the device from the **Device inventory** or open the device page.
1. Select **Release from isolation** from the action menu.
+
For more information about releasing devices, see [Isolate devices from the network](#isolate-devices-from-the-network).
+
> [!NOTE]
> If isolation is removed unexpectedly, check whether a time-limited undo window applies in your environment and review the action history for the release event.
+### Exclude devices from automatic device isolation
+
+You can exclude specific devices from automatic device isolation by using policy applications and exclusions. Create a new device tag or use an existing tag, assign the tag to the devices you want to exclude, and configure the policy application to exclude the **Isolate device** action for that tag.
+
+For detailed instructions, see [Policy applications and exclusions (Preview)](/defender-xdr/automatic-attack-disruption-exclusions#policy-applications-and-exclusions-preview).
+
+:::image type="content" source="media/policy-application-isolate-device-exclusion.png" alt-text="Screenshot of the Configure exclusions step with the Isolate device action excluded." lightbox="media/policy-application-isolate-device-exclusion.png":::
+
+When automatic attack disruption identifies an excluded device as compromised, the **Isolate device** action isn't performed. The action appears with a **Skipped** status in the Action center, and the device continues to operate normally.
+
+:::image type="content" source="media/isolate-device-action-skipped.png" alt-text="Screenshot of a skipped Isolate device action in the Action center." lightbox="media/isolate-device-action-skipped.png":::
+
+> [!IMPORTANT]
+> If you're running a breach and attack simulation (BAS) or another security validation exercise, you might want to temporarily exclude the **Isolate device** action. This exclusion allows the simulated attack to proceed without automatically isolating the affected devices.
+
### Forcibly release device from isolation
The device isolation feature is an invaluable tool for safeguarding devices against external threats. However, there are instances when isolated devices become unresponsive.
-There's a downloadable script for these instances that you can run to forcibly release devices from isolation. The script is available through a link on the device page in the Microsoft Defender portal.
+There's a downloadable script for cases where isolated devices become unresponsive that you can run to forcibly release them from isolation. The script is available through a link on the device page in the Microsoft Defender portal.
> [!NOTE]
>
@@ -321,30 +351,31 @@ To forcibly release device from isolation:
To forcibly release a device from isolation, the device must be running Windows. The following versions are supported:
-- Windows 10 21H2 and 22H2 with KB KB5023773.
+- Windows 10 21H2 and 22H2 with KB5023773.
- Windows 11 version 21H2, all editions with KB5023774.
- Windows 11 version 22H2, all editions with KB5023778.
-### Notification on device user
+### Device user notification for isolation
When a device is being isolated, the following notification is displayed to inform the user that the device is being isolated from the network:
-:::image type="content" source="media/atp-notification-isolate.png" alt-text="A no network connection message" lightbox="media/atp-notification-isolate.png":::
+:::image type="content" source="media/atp-notification-isolate.png" alt-text="Screenshot of the no network connection message shown to the device user." lightbox="media/atp-notification-isolate.png":::
> [!NOTE]
> The notification isn't available on non-Windows platforms.
-## Containing critical assets
+
+## Contain critical assets
-When a critical asset is compromised and used to spread threats within an organization, stopping the spread can be challenging because these assets must continue to function to avoid productivity loss. Defender for Endpoint addresses this by granularly containing the critical asset, preventing the spread of the attack while ensuring the asset remains operational for business continuity.
+When a critical asset is compromised and used to spread threats, stopping the spread can be hard. These assets must keep running to avoid productivity loss. Defender for Endpoint contains the critical asset at a granular level. It stops the attack from spreading while keeping the asset running.
-Through automatic attack disruption, Defender for Endpoint incriminates a malicious device, identifies the role of the device to apply a matching policy to automatically contain a critical asset. The granular containment is done by blocking only specific ports and communication directions.
+Through automatic attack disruption, Defender for Endpoint flags a malicious device and identifies its role. It then applies a matching policy to contain the critical asset. This containment blocks only specific ports and communication directions.
You can identify critical assets by the **critical asset** tag on the device or IP page. Device containment supports critical asset types like domain controllers, DNS servers, and DHCP servers.
## Contain devices from the network
-When you have identified an unmanaged device that is compromised or potentially compromised, you might want to contain that device from the network to prevent the potential attack from moving laterally across the network. When you contain a device any Microsoft Defender for Endpoint onboarded device blocks incoming and outgoing communication with that device. Containing a device can help prevent neighboring devices from becoming compromised while the security operations analyst locates, identifies, and remediates the threat on the compromised device.
+When you find an unmanaged device that is compromised or might be compromised, you can contain it from the network. This prevents the attack from moving laterally. When you contain a device, all Defender for Endpoint onboarded devices block incoming and outgoing communication with that device. Containment helps protect nearby devices while the security analyst finds and fixes the threat.
> [!NOTE]
> Blocking incoming and outgoing communication with a 'contained' device is supported on onboarded Microsoft Defender for Endpoint Windows 10 and Windows Server 2019+ devices.
@@ -353,6 +384,8 @@ Once devices are contained, we recommend investigating and remediating the threa
### How to contain a device
+To contain a device from the Device inventory page, follow these steps:
+
1. Go to the **Device inventory** page and select the device to contain.
1. Select **Contain device** from the actions menu in the device flyout.
@@ -377,7 +410,7 @@ A device can also be contained from the device page by selecting **Contain devic
> [!IMPORTANT]
>
-> - If a contained device changes its IP address, all Microsoft Defenders for Endpoint onboarded devices recognize this and start blocking communications with the new IP address. The original IP address is no longer be blocked (It might take up to 5 minutes to see these changes).
+> - If a contained device changes its IP address, all Microsoft Defender for Endpoint onboarded devices recognize this and start blocking communications with the new IP address. The original IP address is no longer blocked (It might take up to 5 minutes to see these changes).
> - In cases where the contained device's IP is used by another device on the network, a warning while containing the device with a link to advanced hunting (with a pre-populated query) is displayed. This provides visibility to other devices using the same IP to help you make a conscious decision if you'd like to continue containing the device.
> - In cases where the contained device is a network device, a warning appears with a message that containment can cause network connectivity issues (for example, containing a router that's acting as a default gateway). At this point, you're able to choose whether to contain the device or not.
@@ -396,30 +429,31 @@ You can stop containing a device at any time.
> [!IMPORTANT]
> Some information in this article relates to prereleased product, which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-Defender for Endpoint can also contain IP addresses associated with devices that are undiscovered or aren't onboarded to Defender for Endpoint. The capability to contain an IP address prevents attackers from spreading attacks to other noncompromised devices. Containing an IP address results in Defender for Endpoint-onboarded devices blocking incoming and outgoing communication with devices using the contained IP address
+Defender for Endpoint can also contain IP addresses linked to devices that are undiscovered or not onboarded. Containing an IP address stops attackers from spreading attacks to other devices. When an IP address is contained, all onboarded devices block incoming and outgoing traffic with devices that use that IP address.
> [!NOTE]
-> Blocking incoming and outgoing communication with a 'contained' device is supported on onboarded Defender for Endpoint Windows 10, Windows 11, Windows 2012 R2, and Windows 2016 devices.
+> Blocking incoming and outgoing communication with a 'contained' device is supported on onboarded Defender for Endpoint Windows 10, Windows 11, Windows Server 2012 R2, and Windows Server 2016 devices.
Containing an IP address associated with undiscovered devices or devices not onboarded to Defender for Endpoint is done automatically through [automatic attack disruption](/defender-xdr/automatic-attack-disruption). The Contain IP policy automatically blocks a malicious IP address when Defender for Endpoint detects the IP address to be associated with an undiscovered device or a device not onboarded.
A message indicating that the action is applied appears on the applicable incident, device, or IP page. Here’s an example.
-:::image type="content" source="/defender/media/defender-endpoint/contain-ip-attack-disrupt-small.png" alt-text="Highlighting a contained IP address in the incident graph." lightbox="/defender/media/defender-endpoint/contain-ip-attack-disrupt.png":::
+:::image type="content" source="/defender/media/defender-endpoint/contain-ip-attack-disrupt-small.png" alt-text="Screenshot that highlights a contained IP address in the incident graph." lightbox="/defender/media/defender-endpoint/contain-ip-attack-disrupt.png":::
-After an IP address is contained, you can view the action in the History view of the Action Center. You can see when the action occurred and identify the IP addresses that were contained.
+After an IP address is contained, you can view the action in the History view of the Action center. You can see when the action occurred and identify the IP addresses that were contained.
-:::image type="content" source="/defender/media/defender-endpoint/contain-ip-action-center-small.png" alt-text="View the contained IP address in the Action center." lightbox="/defender/media/defender-endpoint/contain-ip-action-center.png":::
+:::image type="content" source="/defender/media/defender-endpoint/contain-ip-action-center-small.png" alt-text="Screenshot of the contained IP address in the Action center." lightbox="/defender/media/defender-endpoint/contain-ip-action-center.png":::
If a contained IP address is part of an incident, an indicator is present on the [incident graph](/defender-xdr/investigate-incidents#attack-story) and on the incident's [evidence and response](/defender-xdr/investigate-incidents#evidence-and-response) tab. Here’s an example.
-:::image type="content" source="/defender/media/defender-endpoint/contain-ip-evidence-small.png" alt-text="Highlighting a contained IP address in the Evidence and response tab of an incident." lightbox="/defender/media/defender-endpoint/contain-ip-evidence.png":::
+:::image type="content" source="/defender/media/defender-endpoint/contain-ip-evidence-small.png" alt-text="Screenshot that highlights a contained IP address in the Evidence and response tab of an incident." lightbox="/defender/media/defender-endpoint/contain-ip-evidence.png":::
-You can stop an IP address' containment at any time. To stop containment, select the **Contain IP** action in the **Action Center**. In the flyout, select **Undo**. This action restores the IP address’ connection to the network.
+You can stop an IP address' containment at any time. To stop containment, select the **Contain IP** action in the **Action center**. In the flyout, select **Undo**. This action restores the IP address’ connection to the network.
-## Contain user from the network
+
+## Contain a user from the network
-When an identity in your network might be compromised, you must prevent that identity from accessing the network and different endpoints. Defender for Endpoint can contain an identity, blocking it from access, and helping prevent attacks, specifically, ransomware. When an identity is contained, any supported Microsoft Defender for Endpoint onboarded device blocks incoming traffic in specific protocols related to attacks (deny network logons, RPC, SMB, RDP), terminate ongoing remote sessions and logoff existing RDP connections (terminating the session itself including all its related processes), while enabling legitimate traffic. Containing an identity can significantly help to reduce the impact of an attack. When an identity is contained, security operations analysts have extra time to locate, identify, and remediate the threat to the compromised identity. Once contained by automatic attack disruption, a user is automatically removed from containment in the next five days.
+When an identity in your network might be compromised, you must prevent that identity from accessing the network and different endpoints. Defender for Endpoint can contain an identity, blocking it from access, and helping prevent attacks, specifically, ransomware. When an identity is contained, all supported Defender for Endpoint onboarded devices block incoming traffic in attack-related protocols (network logons, RPC, SMB, RDP). The devices also end ongoing remote sessions and log off existing RDP connections, including all related processes. Legitimate traffic continues to flow normally. Containing an identity can significantly help to reduce the impact of an attack. When an identity is contained, security operations analysts have extra time to locate, identify, and remediate the threat to the compromised identity. Once contained by automatic attack disruption, a user is automatically removed from containment in the next five days.
### Contain user important notes
@@ -435,13 +469,13 @@ Currently, containing users is only available automatically by using automatic a
### View the contain user actions
-After a user is contained, you can view the action in this History view of the Action Center. Here, you can see when the action occurred, and which users in your organization were contained:
+After a user is contained, you can view the action in the History view of the Action Center. In the Action Center History view, you can see when the action occurred and which users in your organization were contained:
-:::image type="content" source="/defender/media/defender-endpoint/user-contain-action-center.png" alt-text="View the user contain action in the action center" lightbox="/defender/media/defender-endpoint/user-contain-action-center.png":::
+:::image type="content" source="/defender/media/defender-endpoint/user-contain-action-center.png" alt-text="Screenshot of the user contain action in the Action center." lightbox="/defender/media/defender-endpoint/user-contain-action-center.png":::
Furthermore, after an identity is considered "contained", that user will be blocked by Defender for Endpoint and can't perform any malicious lateral movement or remote encryption on or to any supported Defender for Endpoint onboarded device. These blocks show up as alerts to help you quickly see the devices the compromised user attempted access and potential attack techniques:
-:::image type="content" source="/defender/media/defender-endpoint/user-contain-lateral-move-block.png" alt-text="Shows a user contain lateral movement block event" lightbox="/defender/media/defender-endpoint/user-contain-lateral-move-block.png":::
+:::image type="content" source="/defender/media/defender-endpoint/user-contain-lateral-move-block.png" alt-text="Screenshot of a user contain lateral movement block event." lightbox="/defender/media/defender-endpoint/user-contain-lateral-move-block.png":::
To view the current status of the contain user action and other actions, see [Track the action status in the Activities tab (Preview)](/defender-xdr/autoad-results#track-the-action-status-in-the-activities-tab-preview).
@@ -454,36 +488,36 @@ To view the current status of the contain user action and other actions, see [Tr
You can release the blocks and containment on a user at any time:
-1. Select the **Contain User** action in the **Action Center**. In the side pane, select **Undo**.
+1. Select the **Contain User** action in the **Action center**. In the side pane, select **Undo**.
1. Select the user from either the user inventory, Incident page side pane, or alert side pane and select **Undo**.
This action restores the user's connection to the network.
-:::image type="content" source="/defender/media/defender-endpoint/undo-user-contain-action.png" alt-text="Shows user contain undo option in the action center" lightbox="/defender/media/defender-endpoint/undo-user-contain-action.png":::
+:::image type="content" source="/defender/media/defender-endpoint/undo-user-contain-action.png" alt-text="Screenshot of the user contain undo option in the Action center." lightbox="/defender/media/defender-endpoint/undo-user-contain-action.png":::
### Investigation capabilities with Contain User
After a user is contained, you can investigate the potential threat by viewing the blocked actions by the compromised user. In the device timeline view, you can see information about specific events, including protocol and interface granularity, and the relevant MITRE Technique associated it.
-:::image type="content" source="/defender/media/defender-endpoint/event-blocked by-contained-user.png" alt-text="Shows blocked event details for a contained users" lightbox="/defender/media/defender-endpoint/event-blocked by-contained-user.png":::
+:::image type="content" source="/defender/media/defender-endpoint/event-blocked-by-contained-user.png" alt-text="Screenshot of blocked event details for a contained user." lightbox="/defender/media/defender-endpoint/event-blocked-by-contained-user.png":::
-In addition, you can expand the investigation by using advanced hunting. Look for any action type starting with *contain* in the `DeviceEvents` table. Then, you can view all the different singular blocking events in relation to Contain User in your tenant, dive deeper into the context of each block, and extract the different entities and techniques associated with those events.
+In addition, you can expand the investigation by using advanced hunting. Look for any action type starting with *contain* in the `DeviceEvents` table. Then, you can view all the different singular blocking events in relation to Contain User in your organization, dive deeper into the context of each block, and extract the different entities and techniques associated with those events.
-:::image type="content" source="/defender/media/defender-endpoint/user-contain-advanced-hunting.png" alt-text="Shows advanced hunting for user contain events" lightbox="/defender/media/defender-endpoint/user-contain-advanced-hunting.png":::
+:::image type="content" source="/defender/media/defender-endpoint/user-contain-advanced-hunting.png" alt-text="Screenshot of advanced hunting for user contain events." lightbox="/defender/media/defender-endpoint/user-contain-advanced-hunting.png":::
-## GPO hardening (Preview)
+
## GPO hardening - predictive shielding (Preview)
-As part of the [predictive shielding](/defender-xdr/shield-predict-threats) (Preview) feature, Defender for Endpoint automatically applies the GPO hardening action. Group Policy Object (GPO) hardening temporarily stops new GPO policies from being applied to devices identified as high risk. This action helps prevent potential compromise by limiting changes to critical configurations.
+The [predictive shielding](/defender-xdr/shield-predict-threats) (Preview) feature lets Defender for Endpoint apply the GPO hardening action. GPO hardening temporarily blocks new Group Policy Object policies on high-risk devices. This helps prevent compromise by limiting changes to key settings.
-To enrich predictive shielding actions, we recommend you use the Microsoft Defender for Identity sensor in your environment. For more information, see [Enrich predictive shielding with Microsoft Defender for Identity](/defender-xdr/shield-predict-threats-manage#enrich-predictive-shielding-data).
+To get better results from predictive shielding, use the Microsoft Defender for Identity sensor. For more information, see [Enrich predictive shielding with Microsoft Defender for Identity](/defender-xdr/shield-predict-threats-manage#enrich-predictive-shielding-data).
-After the action is applied, you can view the action impact in the incident graph, track the actions in the Action center, and investigate further using advanced hunting. For more information, see [Manage predictive shielding actions](/defender-xdr/shield-predict-threats-manage).
+After the action is applied, you can view its impact in the incident graph, track it in the Action center, and investigate with advanced hunting. For more information, see [Manage predictive shielding actions](/defender-xdr/shield-predict-threats-manage).
-## Safeboot hardening (Preview)
+
## Safeboot hardening - predictive shielding (Preview)
As part of the [predictive shielding](/defender-xdr/shield-predict-threats) (Preview) feature, Defender for Endpoint automatically applies the Safeboot hardening action. Safeboot hardening helps protect devices from being compromised by enforcing stricter boot settings on devices that are predicted to be at high risk of compromise.
@@ -496,13 +530,13 @@ To view the current status of the Safeboot hardening action and other actions, s
## Consult a threat expert
-You can consult a Microsoft threat expert for more insights regarding a potentially compromised device or already compromised ones. Microsoft Threat Experts can be engaged directly from within the Defender portal for timely and accurate response. Experts provide insights not just regarding a potentially compromised device, but also to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, or a threat intelligence context that you see on your portal dashboard.
+You can consult a Microsoft threat expert for more insights about a compromised or potentially compromised device. Microsoft Threat Experts work with you directly from the Defender portal for a timely and accurate response. Experts help you understand complex threats, targeted attack alerts, and threat intelligence shown on your portal dashboard.
See [Configure and manage Endpoint Attack Notifications](configure-microsoft-threat-experts.md) for details.
## Check activity details and status
-The Action center ([https://security.microsoft.com/action-center](https://security.microsoft.com/action-center)) provides information on actions that were taken on a device or file. You are able to view the following details:
+The Action center ([https://security.microsoft.com/action-center](https://security.microsoft.com/action-center)) provides information on actions that were taken on a device or file. You can view the following details:
- Investigation package collection
- Antivirus scan
@@ -511,13 +545,12 @@ The Action center ([https://security.microsoft.com/action-center](https://securi
All other related details are also shown, for example, submission date/time, submitting user, and if the action succeeded or failed.
-:::image type="content" source="media/action-center-details.png" alt-text="The action center with information" lightbox="media/action-center-details.png":::
+:::image type="content" source="media/action-center-details.png" alt-text="Screenshot of the Action center with action details." lightbox="media/action-center-details.png":::
The **Activities** tab in the **Incident** page shows the details and status of actions that were taken as part of the incident response. For more information, see [Track the action status in the Activities tab (Preview)](/defender-xdr/autoad-results#track-the-action-status-in-the-activities-tab-preview).
-## See also
+## Related content
- [Take response actions on a file](respond-file-alerts.md)
- [Manual response actions in Microsoft Defender for Endpoint Plan 1](defender-endpoint-plan-1.md#manual-response-actions)
- [Report inaccuracy](/defender-vulnerability-management/tvm-security-recommendation#report-inaccuracy)
-
diff --git a/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus.md b/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus.md
index d9541d8cb08..19cb1c157bf 100644
--- a/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus.md
+++ b/defender-endpoint/restore-quarantined-files-microsoft-defender-antivirus.md
@@ -5,8 +5,8 @@ ms.service: defender-endpoint
ms.localizationpriority: medium
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: yongrhee, pahuijbr
ms.subservice: ngp
ms.topic: how-to
@@ -24,17 +24,20 @@ ai-usage: ai-assisted
# Restore quarantined files in Microsoft Defender Antivirus
-Depending on how Microsoft Defender Antivirus is configured, it quarantines suspicious files. If you're certain a quarantined file isn't a threat, you can restore it on your Windows device.
+Depending on how Microsoft Defender Antivirus is configured, it quarantines suspicious files. If you're certain a quarantined file isn't a threat, you can restore it on your Windows device. This article describes how to restore quarantined files by using the Windows Security app, the MpCmdRun command-line utility, or the Microsoft Defender for Endpoint portal.
## Prerequisites
+Before you restore quarantined files, verify that your environment meets the following requirements.
+
### Supported operating systems
The following operating systems support restoring quarantined files:
- Windows
-## Using the Windows Security app
+
+## Restore quarantined files using the Windows Security app
To restore a quarantined file by using the Windows Security app, perform the following steps:
@@ -46,7 +49,8 @@ To restore a quarantined file by using the Windows Security app, perform the fol
1. Select an item you want to keep, and choose an action, such as **Restore**.
-## Using the MpCmdRun command line
+
+## Restore quarantined files using MpCmdRun
Use the following steps to restore quarantined files from the command line using the MpCmdRun utility:
@@ -55,7 +59,7 @@ Use the following steps to restore quarantined files from the command line using
In an elevated Command Prompt (a Command Prompt window you opened by selecting **Run as administrator**), run the following commands:
> [!TIP]
- > The first command changes the directory to the latest version of \
- When enabled, you can choose a randomization window between **1 and 23 hours**.
- The Randomize Scheduled Task Times uses the specified window.
- If disabled or not configured, it randomizes times between **0 and 4 hours**. | Not configured (Disabled)|
+| Root | Configure scheduled task times randomization window |- This setting lets you set the start time for scheduled task scans and security updates.
- When enabled, you can choose a randomization window between **1 and 23 hours**.
- When the **Randomize scheduled task times** setting is enabled, scheduled scans use the specified window.
- If disabled or not configured, it randomizes times between **0 and 4 hours**. | Not configured (Disabled)|
> [!TIP]
-> Enable randomization for Virtual Machines (VMs), Virtual Desktop Infrastructure (VDI), and Azure Virtual Desktop (AVD) devices to ensure that scheduled scans don't run simultaneously. This helps prevent CPU and disk I/O bottlenecks on the parent partition (also known as the Host).
+> Enable randomization for Virtual Machines (VMs), Virtual Desktop Infrastructure (VDI), and Azure Virtual Desktop (AVD) devices to ensure that scheduled scans don't run simultaneously. Randomizing scan times helps prevent CPU and disk I/O bottlenecks on the parent partition (also known as the Host).
-## Group Policy settings for scheduling scans for specifying the maximum percentage of CPU utilization during a scan
+
+## Group Policy settings for maximum CPU usage during scans
-The following table describes the Group Policy setting for controlling maximum CPU utilization during scans:
+The following table describes the Group Policy setting for maximum CPU usage during scans:
| Location | Setting |Description |Default setting (if not configured) |
| -------- | -------- | -------- | -------- |
-| Scan |Specify the maximum percentage of CPU utilization during a scan|Configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization.|Enabled - 50|
+| Scan |Specify the maximum percentage of CPU utilization during a scan|Set the maximum CPU usage allowed during a scan. Enter a value from 5 to 100 (percent). A value of 0 means no CPU limit is applied.|Enabled - 50|
> [!NOTE]
-> Reducing the maximum CPU utilization during a scan to between 5% and 30% will extend the duration of the scheduled scan. For environments with a maintenance window, please take this into consideration.
+> Setting the maximum CPU usage to between 5% and 30% makes scans take longer. Keep this in mind if you have a maintenance window.
## Group Policy settings for scheduling scans for lowering the CPU priority
-The following table lists the setting that controls whether scans run only when the computer is idle, which lowers CPU priority for other tasks:
+This setting controls whether scans run only when the computer is idle. When enabled, it lowers CPU use for other tasks:
| Location | Setting | Description | Default setting (if not configured) |
|:---|:---|:---|:---|
-| Scan | Start the scheduled scan only when computer is on but not in use | Scheduled scans won't run, unless the computer is on but not in use | Enabled |
+| Scan | Start the scheduled scan only when computer is on but not in use | Scans run only when the computer is on and idle. | Enabled |
> [!NOTE]
-> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and takes full advantage of the resources available to complete the scan as fast as possible.
+> When endpoints aren't in use at scan time, the scan skips CPU throttling. It uses all available resources to finish as fast as possible.
## Group Policy settings for scheduling remediation-required scans
@@ -128,25 +136,22 @@ The following table lists the Group Policy settings for scheduling remediation-r
## Group Policy settings for scheduling scans after protection updates
-The following table describes the setting for running scans after protection updates are downloaded:
+The following table describes the setting for running scans after protection updates:
|Location |Setting |Description |Default setting (if not configured)|
|:---|:---|:---|:---|
-|Signature updates |Turn on scan after Security intelligence update |A process scan will occur immediately after a new protection update is downloaded |Enabled |
+|Signature updates |Turn on scan after Security intelligence update |Runs a scan right after a new protection update is downloaded. |Enabled |
## See also
-[Troubleshoot Microsoft Defender Antivirus scan issues](troubleshoot-mdav-scan-issues.md)
-
-[Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
-
-[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md)
-
-[Set the PowerShell cmdlet to configure and manage Microsoft Defender Antivirus](/powershell/module/defender/set-mppreference)
-
-[Defender Antivirus specific PowerShell functions](/powershell/module/defender)
+The following articles provide more information about Microsoft Defender Antivirus configuration and troubleshooting:
-[Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
+- [Troubleshoot Microsoft Defender Antivirus scan issues](troubleshoot-mdav-scan-issues.md)
+- [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
+- [Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md)
+- [Set the PowerShell cmdlet to configure and manage Microsoft Defender Antivirus](/powershell/module/defender/set-mppreference)
+- [Defender Antivirus specific PowerShell functions](/powershell/module/defender)
+- [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
> [!TIP]
> If you're looking for Antivirus related information for other platforms, see:
diff --git a/defender-endpoint/schedule-antivirus-scans-intune.md b/defender-endpoint/schedule-antivirus-scans-intune.md
index c53aade26d4..e0245b9dfb1 100644
--- a/defender-endpoint/schedule-antivirus-scans-intune.md
+++ b/defender-endpoint/schedule-antivirus-scans-intune.md
@@ -1,17 +1,17 @@
---
title: Schedule antivirus scans using Microsoft Intune
-description: Configure scheduled Microsoft Defender Antivirus scans with Microsoft Intune, including daily and weekly scan settings and deployment guidance for managed Windows devices.
+description: Configure scheduled Microsoft Defender Antivirus scans in Intune, including daily and weekly schedules, CPU usage, and catch-up scans for Windows devices.
author: chrisda
ms.author: chrisda
ms.reviewer: yongrhee
ms.service: defender-endpoint
ms.topic: how-to
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.collection:
+ms.custom: nextgen, msecd-doc-authoring-1015
+ms.collection:
- m365-security
- tier2
- mde-ngp
-ms.date: 06/16/2026
+ms.date: 08/21/2026
ms.subservice: ngp
ms.localizationpriority: medium
appliesto:
@@ -20,100 +20,142 @@ appliesto:
- Microsoft Defender for Business
- Microsoft Defender Antivirus
ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to schedule Microsoft Defender Antivirus scans in Intune so that managed Windows devices receive consistent scan coverage.
---
# Schedule antivirus scans using Microsoft Intune
-This article describes how to configure scheduled Microsoft Defender Antivirus scans on managed Windows devices using Microsoft Intune endpoint security policies. It covers creating an antivirus scan policy, configuring daily and weekly quick scan schedules, and adjusting general scan settings such as CPU throttling and catchup scans. This approach is appropriate for IT administrators who manage devices through Intune and want to ensure consistent scan coverage across their organization. To learn more about scheduling scans and about scan types, see [About scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md).
+Security administrators can use Microsoft Intune to schedule Microsoft Defender Antivirus scans on managed Windows devices. This article explains how to create an antivirus policy, schedule daily and weekly scans, and configure CPU usage and catch-up scan settings. For guidance on choosing a scan type, see [About scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md).
## Prerequisites
+Before you configure scheduled antivirus scans in Intune, verify that your devices use a supported operating system.
+
### Supported operating systems
-Scheduled antivirus scans through Intune are supported on the following operating systems:
+Intune supports scheduled antivirus scans on the following operating systems:
- Windows
- Windows Server
## Configure antivirus scans using Intune
-1. In the [Intune admin center](https://intune.microsoft.com/), go to **Endpoint security** > **Antivirus** > **Create Policy**. For **Platform**, select **Windows**, and for **Profile**, select **Microsoft Defender Antivirus**. Then select **Create**.
-
-1. On the **Basics** page, specify a name and description for the policy, and then choose **Next**.
-
-1. On the **Configuration settings** page, expand each group of settings, and configure the settings you want to manage with this policy. For more information about these settings, see [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender).
+Create an antivirus policy by following Create an endpoint security policy (opens in a new tab in the Intune documentation). Use the following settings:
-1. When you're done configuring settings, select **Next**.
+- **Policy type**: Antivirus
+- **Platform**: Windows
+- **Profile**: Microsoft Defender Antivirus
+- **Basics**: Enter a name and description for the policy.
+- **Configuration settings**: Expand each group of settings, and configure the settings you want to manage with this policy. For more information about these settings, see [Configure Microsoft Defender Antivirus using Microsoft Intune](use-intune-config-manager-microsoft-defender-antivirus.md).
+- **Scope tags**: If your organization uses [scope tags](/intune/intune-service/fundamentals/scope-tags), select the tags you want to use.
+- **Assignments**: Select the users or groups to receive this policy. For more information, see [Assign policies in Microsoft Intune](/intune/intune-service/configuration/device-profile-assign).
-1. On the **Scope tags** page, you can either use the default setting, or search for scope tags to assign to the policy. For more information, see [Use role-based access control (RBAC) and scope tags for distributed IT](/intune/intune-service/fundamentals/scope-tags).
+For more information, see [Antivirus policy for endpoint security in Intune](/intune/intune-service/protect/endpoint-security-antivirus-policy).
-1. When you're done specifying scope tags, select **Next**.
+
-1. On the **Assignments** page, select the users or groups to receive this policy. For more information, see [Assign policies in Microsoft Intune](/intune/intune-service/configuration/device-profile-assign).
+## Schedule daily quick scans using Intune
-1. When you're done assigning users or groups, select **Next**.
+Use the following Intune setting to schedule a daily quick scan on Windows devices:
-1. On the **Review + create**, review your settings. When you select **Save**, your changes are saved, and the policy is created and applied.
+- **Setting**: **Schedule Quick Scan Time**
+- **Values**:
+ - :::image type="icon" source="media/toggle-off.png" border="false"::: **Not Configured**
+ - :::image type="icon" source="media/toggle-on.png" border="false"::: **Configured**
+ - Enter a time of day from **0** (12:00 AM) through **1380** (11:00 PM). The default value is **120** (2:00 AM).
-For more information: [Antivirus policy for endpoint security in Intune ](/intune/intune-service/protect/endpoint-security-antivirus-policy)
+For example, a value of **720** schedules the daily quick scan for 12:00 PM.
-## Use Intune for scheduling daily quick scans
+
-Use the following setting to schedule a daily quick scan in Intune:
+## Schedule weekly quick or full scans using Intune
-| Description|Setting|
-| -------- | -------- |
-|Schedule Quick Scan Time|720|
+Use the following Intune settings to schedule a weekly quick or full scan on Windows devices:
-> [!NOTE]
-> In this example, a quick scan runs daily on the Windows clients at 12:00 PM. (720). In this example, we use lunch time, since many devices nowadays are turned off after-hours (e.g laptops).
+- **Setting**: **Scan parameter**
+- **Values**:
+ - **Not configured**
+ - **Quick scan (Default)**
+ - **Full scan**
-## Use Intune for scheduling Weekly Scan (Quick or Full)
+- **Setting**: **Schedule Scan Day**
+- **Values**:
+ - **Not configured**
+ - **Every day (Default)**
+ - **Sunday** to **Saturday**
+ - **No scheduled scan**
-The following example settings schedule a weekly quick or full scan in Intune:
+- **Setting**: **Schedule Scan Time**
+- **Values**:
+ - :::image type="icon" source="media/toggle-off.png" border="false"::: **Not Configured**
+ - :::image type="icon" source="media/toggle-on.png" border="false"::: **Configured**
+ - Enter a time of day from **0** (12:00 AM) through **1380** (11:00 PM). The default value is **120** (2:00 AM).
-| Description|Setting|
-| -------- | -------- |
-|Scan Parameter |Quick scan (Default) |
-|Schedule Scan Day|Windows Clients: Wednesday
|
-|Schedule Scan Time|Windows Clients: 1020
|
+The following example schedules a quick scan on Windows devices every Wednesday at 5:00 PM (**1020**):
-> [!NOTE]
-> In this example, a quick scan runs for Windows clients on Wednesdays at 5:00 PM. (1020).
+|Setting|Value|
+|---|---|
+|Scan parameter|Quick scan (Default)|
+|Schedule Scan Day|Wednesday|
+|Schedule Scan Time|:::image type="icon" source="media/toggle-on.png" border="false"::: **Configured**
**1020**|
> [!TIP]
-> Our recommendation for scheduled scans is to configure quick scan together with always-on real-time protection and [cloud protection](cloud-protection-microsoft-defender-antivirus.md), as this combination provides strong coverage against malware that starts with the system and kernel-level malware. Quick scan with always-on real-time protection and cloud protection is the default configuration. In general, there's no need to schedule a full scan, and most users never need to manually run full scans (see [Comparing quick scan, full scan, and custom scan](schedule-antivirus-scans.md)).
+> Microsoft recommends using quick scans with always-on real-time protection and [cloud protection](cloud-protection-microsoft-defender-antivirus.md). This combination provides strong coverage against malware that starts with the system and kernel-level malware. Quick scans with always-on real-time protection and cloud protection are the default configuration.
+>
+> In general, you don't need to schedule a full scan, and most users never need to run full scans manually. For more information, see [Comparing quick scan, full scan, and custom scan](schedule-antivirus-scans.md).
## Configure general settings for scheduled scans
-Review the following general scheduled-scan settings when configuring your policy:
-
-|Description| Setting|
-| -------- | -------- |
-|Check For Signatures Before Running Scan |Disabled (Default)|
-|Randomize Schedule Task Times|Not configured|
-|Scheduler Randomization Time|Scheduled tasks aren't randomized|
-|Avg CPU Load Factor|Not Configured (Default, 50)|
-|Enable Low CPU Priority|Disabled (Default)|
-|Disable Catchup Full Scan|Enabled (Default)|
-|Disable Catchup Quick Scan|Disabled (Default)|
-
-> [!NOTE]
-> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and takes full advantage of the resources available to complete the scan as fast as possible.
-
-
-## See also
+Review the following general scheduled-scan settings when you configure the policy:
+
+- **Setting**: **Check For Signatures Before Running Scan**
+- **Values**:
+ - **Not configured**
+ - **Disabled (Default)**
+ - **Enabled** (recommended)
+
+- **Setting**: **Randomize Schedule Task Times**
+- **Values**:
+ - **Not configured**
+ - **Widen or narrow the randomization period for scheduled scans (Default)** (use **Scheduler Randomization Time** to set the randomization window)
+ - **Scheduled tasks will not be randomized** (recommended)
+
+- **Setting**: **Scheduler Randomization Time**
+- **Values**:
+ - :::image type="icon" source="media/toggle-off.png" border="false"::: **Not Configured** (recommended)
+ - :::image type="icon" source="media/toggle-on.png" border="false"::: **Configured**
+ - Enter a value between **1** and **23** hours. The default value is **4** hours.
+
+- **Setting**: **Avg CPU Load Factor**
+- **Values**:
+ - :::image type="icon" source="media/toggle-off.png" border="false"::: **Not Configured** (recommended)
+ - :::image type="icon" source="media/toggle-on.png" border="false"::: **Configured**
+ - Enter a percentage from **0** to **100**. The default value is **50**.
+
+- **Setting**: **Enable Low CPU Priority**
+- **Values**:
+ - **Not configured**
+ - **Disabled (Default)** (recommended)
+ - **Enabled**
+
+- **Setting**: **Disable Catchup Full Scan**
+- **Values**:
+ - **Not configured**
+ - **Disabled** (enables catch-up full scans)
+ - **Enabled (Default)** (disables catch-up full scans and matches the Microsoft Defender Antivirus client default)
+
+- **Setting**: **Disable Catchup Quick Scan**
+- **Values**:
+ - **Not configured**
+ - **Disabled** (enables catch-up quick scans)
+ - **Enabled (Default)** (disables catch-up quick scans and matches the Microsoft Defender Antivirus client default)
+
+## Related content
- [Troubleshoot Microsoft Defender Antivirus scan issues](troubleshoot-mdav-scan-issues.md)
-
- [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
-
- [Troubleshoot performance issues related to real-time protection](troubleshoot-performance-issues.md)
-
- [Run the client analyzer on Windows](run-analyzer-windows.md)
-
- [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
-
- [Microsoft Defender Antivirus full scan considerations and best practices](mdav-scan-best-practices.md)
-
diff --git a/defender-endpoint/schedule-antivirus-scans-linux.md b/defender-endpoint/schedule-antivirus-scans-linux.md
index 7db2a6dfa35..2bd01b4d32d 100644
--- a/defender-endpoint/schedule-antivirus-scans-linux.md
+++ b/defender-endpoint/schedule-antivirus-scans-linux.md
@@ -7,12 +7,12 @@ ms.author: painbar
author: paulinbar
ms.topic: how-to
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/02/2026
ai-usage: ai-generated
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
-# Schedule antivirus scans on Linux (preview)
+# Schedule antivirus scans on Linux
This article describes how to configure scheduled antivirus scans on Microsoft Defender for Endpoint on Linux. It's intended for IT and security administrators who manage Linux devices and want to ensure continuous antivirus protection through centralized scan scheduling. Before you begin, review the [prerequisites](#prerequisites) to ensure your environment meets the necessary requirements.
@@ -105,7 +105,7 @@ You can configure scheduled antivirus scans on Linux using one of the following
1. On the **Assignments** page, select the groups that receive this profile. Then select **Next**.
1. On the **Review + create** page, when you're done, select **Save**. The new profile is displayed in the list when you select the policy type for the profile you created.
- For more information, see [Manage endpoint security policies in Microsoft Defender for Endpoint](./manage-security-policies.md).
+ For more information, see [Manage endpoint security policies in Microsoft Defender for Endpoint](endpoint-security-policies-configure.md).
:::image type="content" source="media/schedule-antivirus-scans-linux/schedule-antivirus-scans-linux.png" alt-text="Screenshot of Endpoint security policies option.":::
@@ -148,9 +148,10 @@ The following example configures:
}
```
-### Use command line
+
+### Use the command line to configure scheduled scans
-You can configure scheduled antivirus scans directly on a Linux device using the mdatp command-line tool. This approach is useful for testing or single-device configuration.
+You can configure scheduled antivirus scans directly on a Linux device using the Microsoft Defender for Endpoint command-line tool (`mdatp`). This approach is useful for testing or single-device configuration.
**Enable scheduled scans:**
diff --git a/defender-endpoint/schedule-antivirus-scans-powershell.md b/defender-endpoint/schedule-antivirus-scans-powershell.md
index 6695ec0f811..cd53799720e 100644
--- a/defender-endpoint/schedule-antivirus-scans-powershell.md
+++ b/defender-endpoint/schedule-antivirus-scans-powershell.md
@@ -5,8 +5,8 @@ ms.service: defender-endpoint
ms.localizationpriority: medium
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1015
+ms.date: 08/21/2026
ms.reviewer: pauhijbr, ksarens
ms.subservice: ngp
ms.topic: how-to
@@ -21,10 +21,11 @@ appliesto:
- Microsoft Defender Antivirus
ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to schedule Microsoft Defender Antivirus scans with PowerShell so that Windows devices receive scans at the intended times.
---
# Schedule antivirus scans using PowerShell
-This article describes how to use the [Set-MpPreference](/powershell/module/defender/set-mppreference) PowerShell cmdlet to configure scheduled scans. To learn more about scheduling scans and about scan types, see [About scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md).
+This article describes how to use the [Set-MpPreference](/powershell/module/defender/set-mppreference) PowerShell cmdlet to configure scheduled scans on Windows devices. Security administrators can use these parameters to control scan type, timing, frequency, CPU usage, and catch-up behavior for Microsoft Defender Antivirus. To learn more about scheduling scans and about scan types, see [About scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md).
## Prerequisites
@@ -84,7 +85,7 @@ The following **Set-MpPreference** parameters are important for scheduled scans:
## Use PowerShell to schedule daily quick scans
-The following command sets the daily scheduled quick scan to ±4 minutes of 12:30 PM. The device is likely on, but activity on the device is likely minimal (lunch).
+This `Set-MpPreference` command sets the daily scheduled quick scan to ±4 minutes of 12:30 PM. The device is likely on, but activity on the device is likely minimal (lunch).
```powershell
Set-MpPreference -ScanScheduleQuickScanTime 12:30:00 -ScanScheduleOffset 0 -RandomizeScheduleTaskTimes $false -ScanOnlyIfIdleEnabled $false
@@ -97,7 +98,7 @@ The preceding **Set-MpPreference** command doesn't require the following paramet
## Use PowerShell to schedule weekly full scans
-The following command schedules a weekly full scan every Wednesday at to ±4 minutes of 12:30 PM.
+This `Set-MpPreference` command schedules a weekly full scan every Wednesday at ±4 minutes of 12:30 PM.
```powershell
Set-MpPreference -ScanParameters FullScan -ScanScheduleDay Wednesday -ScanScheduleTime 12:30:00 -ScanScheduleOffset 0 -RandomizeScheduleTaskTimes $false
@@ -132,7 +133,7 @@ The following **Set-MpPreference** parameters are also available for scheduled s
- _DisableCatchupQuickScan_: Specifies whether to disable catch-up scans for missed scheduled quick scans. Valid values are:
- $true: Windows Defender doesn't run catch-up scans for missed scheduled quick scans. This value is the default.
- - $false: After two missed scheduled quick scans, Windows Defender runs a catch-up scan the next time someone signs in to the computer.
+ - $false: After two missed scheduled quick scans, Windows Defender runs a catch-up scan the next time the device powers on or resumes from sleep or hibernation.
- _EnableFullScanOnBatteryPower_: Specifies whether to enable full scans while on battery power. Valid values are:
- $true: Windows Defender does full scans while on battery power.
@@ -159,15 +160,10 @@ Scheduled full scans to complete remediation use the following parameters:
## See also
-For more information about scheduled scans and related PowerShell cmdlets, see the following articles:
-
-[Troubleshoot Microsoft Defender Antivirus scan issues](troubleshoot-mdav-scan-issues.md)
-
-[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md)
-
-[Set the PowerShell cmdlet to configure and manage Microsoft Defender Antivirus](/powershell/module/defender/set-mppreference)
-
-[Defender Antivirus specific PowerShell functions](/powershell/module/defender)
+- [Troubleshoot Microsoft Defender Antivirus scan issues](troubleshoot-mdav-scan-issues.md) - Fix common scan problems.
+- [Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) - General PowerShell guidance.
+- [Set-MpPreference cmdlet reference](/powershell/module/defender/set-mppreference) - Full parameter details.
+- [Defender Antivirus cmdlets](/powershell/module/defender) - All available cmdlets.
> [!TIP]
> If you're looking for Antivirus related information for other platforms, see the following resources:
@@ -179,4 +175,3 @@ For more information about scheduled scans and related PowerShell cmdlets, see t
> - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
> - [Configure Defender for Endpoint on Android features](android-configure.md)
> - [Configure Microsoft Defender for Endpoint on iOS features](ios-configure-features.md)
-
diff --git a/defender-endpoint/schedule-antivirus-scans-wmi.md b/defender-endpoint/schedule-antivirus-scans-wmi.md
index ad6b4b0cc31..3ab3e981c9c 100644
--- a/defender-endpoint/schedule-antivirus-scans-wmi.md
+++ b/defender-endpoint/schedule-antivirus-scans-wmi.md
@@ -1,12 +1,12 @@
---
title: Schedule antivirus scans using Windows Management Instrumentation
-description: Schedule antivirus scans using WMI
+description: Use Windows Management Instrumentation (WMI) to configure scheduled Microsoft Defender Antivirus scans, including scan timing, idle-only scans, remediation scheduling, and daily quick scan settings.
ms.service: defender-endpoint
ms.localizationpriority: medium
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: pauhijbr, ksarens, yongrhee
ms.subservice: ngp
ms.topic: how-to
@@ -38,7 +38,7 @@ WMI-based scan scheduling is supported on the following operating systems:
## Use Windows Management Instrumentation (WMI) to schedule scans
-Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties:
+**MSFT_MpPreference** is the WMI class used to configure Microsoft Defender Antivirus preferences. Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties:
The following WMI properties control scan scheduling and behavior in the Defender configuration class:
@@ -53,6 +53,9 @@ For more information and allowed parameters, see [Windows Defender WMIv2 APIs](/
## WMI for scheduling scans when an endpoint isn't in use
+> [!CAUTION]
+> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.
+
Use the [Set method of the MSFT_MpPreference class](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) for the following properties:
The following WMI property controls whether scans run only when the device is idle:
@@ -63,13 +66,10 @@ ScanOnlyIfIdleEnabled
For more information about APIs and allowed parameters, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal).
-> [!NOTE]
-> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.
-
## WMI for scheduling scans to complete remediation
-Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties:
+Remediation is the follow-up action that Microsoft Defender Antivirus takes to address detected threats after a scan, such as quarantining or removing malicious files. You can schedule when remediation occurs by using the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties:
The following WMI properties define the remediation schedule day and time:
diff --git a/defender-endpoint/schedule-antivirus-scans.md b/defender-endpoint/schedule-antivirus-scans.md
index 21400ba0069..b651e9cbf45 100644
--- a/defender-endpoint/schedule-antivirus-scans.md
+++ b/defender-endpoint/schedule-antivirus-scans.md
@@ -5,8 +5,8 @@ ms.service: defender-endpoint
ms.localizationpriority: medium
author: chrisda
ms.author: chrisda
-ms.custom: nextgen, msecd-doc-authoring-1014
-ms.date: 06/16/2026
+ms.custom: nextgen, msecd-doc-authoring-1016
+ms.date: 07/02/2026
ms.reviewer: pauhijbr, ksarens, yongrhee, bsabetghadam
ms.subservice: ngp
ms.topic: how-to
@@ -36,6 +36,8 @@ For scheduled scan instructions, see the following articles:
## Prerequisites
+Before you configure scheduled scans, make sure your device meets the following requirements.
+
### Supported operating systems
Scheduled antivirus scans are supported on the following operating systems:
@@ -95,15 +97,15 @@ Keep the following points in mind when configuring scheduled scans:
## Scheduled quick scan performance optimization
-As a performance optimization, Microsoft Defender Antivirus skips running scheduled quick scans in some situations. This optimization only applies to a quick scan when initiated by a schedule – this optimization doesn't affect a quick scan initiated by an [on-demand antivirus](run-scan-microsoft-defender-antivirus.md) scan. This optimization reduces performance degradation by avoiding a scheduled quick scan when that scan isn't necessary and skipping the scan won't affect protection.
+As a performance optimization, Microsoft Defender Antivirus skips running scheduled quick scans in some situations. This optimization only applies to a quick scan when initiated by a schedule – this optimization doesn't affect a quick scan initiated by an [on-demand antivirus](run-scan-microsoft-defender-antivirus.md) scan. The scheduled quick-scan optimization reduces performance degradation by avoiding a scheduled quick scan when that scan isn't necessary and skipping the scan won't affect protection.
-With this optimization enabled, Microsoft Defender Antivirus skips a newly scheduled quick scan if a qualified quick scan ran within the last seven days. A quick scan is considered to be *qualified* if:
+With the scheduled quick-scan optimization enabled, Microsoft Defender Antivirus skips a newly scheduled quick scan if a qualified quick scan ran within the last seven days. A quick scan is considered to be *qualified* if:
- The scan occurs after the last [Microsoft Defender Antivirus security intelligence update](microsoft-defender-antivirus-updates.md) was installed;
- [Real-time protection](configure-protection-features-microsoft-defender-antivirus.md) wasn't disabled during that time period; and,
- The machine was rebooted.
-This optimization *doesn't* apply to the following conditions:
+The scheduled quick-scan optimization *doesn't* apply to the following conditions:
- If Microsoft Defender for Endpoint is [managed by a configuration tool such as Intune or Group Policy](configuration-management-reference-microsoft-defender-antivirus.md)
- If Microsoft Defender [Endpoint Detection and Response (EDR)](overview-endpoint-detection-response.md) is installed
@@ -111,12 +113,13 @@ This optimization *doesn't* apply to the following conditions:
- If [real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md) is disabled after the last quick scan occurred
- If the last initiated quick scan wasn't completed
-This optimization applies to machines running Windows 10 Anniversary Update (version 1607) and all subsequent Windows releases, as well as Windows Server 2016 (version 1607) and subsequent Windows Server releases, but doesn't apply to Core Server installations.
+The scheduled quick-scan optimization applies to machines running Windows 10 Anniversary Update (version 1607) and all subsequent Windows releases, as well as Windows Server 2016 (version 1607) and subsequent Windows Server releases, but doesn't apply to Core Server installations.
-## See also
+
+## Related articles
- [Microsoft Defender Antivirus scan considerations and best practices](mdav-scan-best-practices.md)
-- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md)
+- [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md)
diff --git a/defender-endpoint/secure-controlled-configuration.md b/defender-endpoint/secure-controlled-configuration.md
new file mode 100644
index 00000000000..b7698128644
--- /dev/null
+++ b/defender-endpoint/secure-controlled-configuration.md
@@ -0,0 +1,183 @@
+---
+title: Controlled configuration in Microsoft Defender for Endpoint
+description: Controlled configuration makes cloud policy the single source of truth for Defender Antivirus settings, overriding Group Policy, scripts, and local changes to eliminate configuration drift.
+ms.service: defender-endpoint
+ms.localizationpriority: medium
+ms.date: 07/30/2026
+ms.topic: concept-article
+author: chrisda
+ms.author: chrisda
+ms.reviewer: jcedola
+ms.subservice: ngp
+ms.collection:
+- m365-security
+- tier2
+- mde-ngp
+appliesto:
+ - Microsoft Defender for Endpoint Plan 1
+ - Microsoft Defender for Endpoint Plan 2
+ - Microsoft Defender Antivirus
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1015
+# customer intent: As an IT admin, I want to understand how controlled configuration enforces cloud-managed Defender Antivirus policy so I can eliminate configuration drift and policy conflicts in my organization.
+---
+
+# Controlled configuration in Microsoft Defender for Endpoint
+
+> [!IMPORTANT]
+> The features described in this article are currently in Preview, aren't available in all organizations, and are subject to change.
+
+Controlled configuration is a configuration enforcement model that makes cloud-managed policy the single source of truth for Microsoft Defender Antivirus settings. When controlled configuration is enabled, Intune and Microsoft Defender for Endpoint policies take precedence. The device ignores settings from Group Policy, scripts, Microsoft Configuration Manager, and local admin changes.
+
+Controlled configuration eliminates configuration drift and policy conflicts by extending tamper-protection-style enforcement to the entire Defender Antivirus configuration surface.
+
+[Tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) and controlled configuration are complementary but distinct capabilities:
+
+|Feature|Tamper protection|Controlled configuration|
+|---|---|---|
+|**Scope**|Small fixed set of security settings (~10-13 settings)|Entire Defender Antivirus configuration surface|
+|**Configuration source**|Microsoft-defined defaults only|Organization-defined cloud policy (Intune/Defender for Endpoint)|
+|**Customization**|No customization|Full policy-driven control|
+|**Enforcement**|Prevents disabling critical protections|Overrides all non-cloud configuration channels|
+
+Controlled configuration is a superset of tamper protection that provides policy-driven control over the full Microsoft Defender Antivirus configuration.
+
+> [!NOTE]
+> Although tamper protection and controlled configuration can technically be turned on at the same time, we recommend that your organization selects one or the other.
+
+## Prerequisites
+
+- Devices must be onboarded to Microsoft Defender for Endpoint.
+- Devices must be managed through Microsoft Intune or Defender for Endpoint security settings management.
+- Devices must run Windows 10, Windows 11, or Windows Server 2019.
+- Devices must run Microsoft Defender for Endpoint EDR Sensor version later than 10.8804 (September 2025).
+- Devices must run Microsoft Defender Antivirus platform version 4.18.26060.3004 or later (June 2026).
+
+Controlled configuration doesn't currently support:
+
+- Co-management (Configuration Manager + Intune) environments.
+- GCC High environments.
+
+## What controlled configuration covers
+
+Currently, controlled configuration provides protection and enforcement for Microsoft Defender Antivirus settings, including:
+
+- Antivirus configuration (scan settings, exclusions, updates)
+- Attack surface reduction (ASR) policies
+- Defender Configuration Service Provider (CSP) and Policy CSP surface (broad set of antivirus-related controls)
+- Local admin merge behavior
+
+Currently, controlled configuration doesn't cover:
+
+- Microsoft Defender Device Control
+- Endpoint detection and response (EDR) settings
+- Windows operating system settings (such as Firewall)
+
+## How controlled configuration enforcement works
+
+Controlled configuration enforces cloud-managed policy through three mechanisms:
+
+- **Single-source enforcement**: When controlled configuration is enabled, the following enforcement rules apply:
+ - Only Intune and Defender for Endpoint policies are honored for Defender Antivirus settings.
+ - Group Policy Object (GPO), scripts, Configuration Manager, and local admin changes are ignored.
+ - Microsoft Defender Antivirus doesn't honor local exclusions. Organizations can still choose to allow local administrator-defined exclusions by enabling the local administrator merge setting through policy. When local administrator merge is enabled, locally defined exclusions can be merged with centrally managed exclusions.
+
+- **Secure defaults**: If a setting isn't explicitly configured in a policy, controlled configuration applies Microsoft-defined defaults. This behavior ensures that devices maintain a strong security posture even when administrators haven't configured every available setting.
+
+- **Conflict resolution**: Controlled configuration uses a value-based precedence model rather than a last-write-wins model:
+ - **On** takes precedence over **Off**. If one policy sets controlled configuration to On and another sets it to Off, the feature stays enabled on the device.
+ - If multiple policies assign different values, a conflict is reported, but the On value is still enforced.
+ - If multiple policies assign the same value, the result is success with no conflict.
+
+ > [!IMPORTANT]
+ > **Not configured** doesn't mean **Off**. To disable the feature, explicitly deploy a policy that sets controlled configuration to **Off**.
+
+## Enable controlled configuration
+
+You can enable controlled configuration through either Microsoft Intune or [Microsoft Defender for Endpoint security settings management](manage-security-policies.md).
+
+Controlled configuration is configured through the same policy surface as tamper protection. In the Windows Security Experience profile, Intune renames the tamper protection setting to **Controlled Configuration (Device)** when controlled configuration is available. You can't enable controlled configuration through the Settings Catalog or the Device Control v1 (DCv1) template.
+
+Because controlled configuration and tamper protection use the same policy setting, setting **Controlled Configuration (On)** supersedes the tamper protection value on that device. You don't deploy separate tamper protection and controlled configuration policies for the same setting. To migrate existing tamper protection (DCv1) policies to controlled configuration, create a Windows Security Experience policy with **Controlled Configuration (On)**, then remove the tamper protection setting from your DCv1 policies to avoid conflicts.
+
+1. On the **Endpoint security** page in the Microsoft Intune admin center at
Phase 1: Prepare | [](switch-to-mde-phase-2.md)
[Phase 2: Set up](switch-to-mde-phase-2.md) | [](switch-to-mde-phase-3.md)
[Phase 3: Onboard](switch-to-mde-phase-3.md) |
|--|--|--|
@@ -33,6 +34,8 @@ ai-usage: ai-assisted
**Welcome to the Prepare phase of [migrating to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)**.
+In this phase, you ensure your organization's environment is ready before you set up and onboard Defender for Endpoint. This includes getting licensing in place, granting portal access, verifying network connectivity, and capturing performance baselines so you can detect any changes after onboarding.
+
This migration phase includes the following steps:
1. Get and deploy updates across your organization's devices.
@@ -65,7 +68,7 @@ Need help with updating your organization's devices? See the following resources
## Step 2: Get Microsoft Defender for Endpoint Plan 1 or Plan 2
-Now that you've updated your organization's devices, the next step is to get Defender for Endpoint, assign licenses, and make sure the service is provisioned.
+After updating your organization's devices, get Defender for Endpoint, assign licenses, and make sure the service is provisioned.
1. Buy or try Defender for Endpoint today. [Start a free trial or request a quote](https://aka.ms/mdatp). Microsoft 365 E3 includes Defender for Endpoint Plan 1, and Microsoft 365 E5 includes Defender for Endpoint Plan 2.
diff --git a/defender-endpoint/switch-to-mde-phase-2.md b/defender-endpoint/switch-to-mde-phase-2.md
index 1cbea9c7d10..3bf64e1b30f 100644
--- a/defender-endpoint/switch-to-mde-phase-2.md
+++ b/defender-endpoint/switch-to-mde-phase-2.md
@@ -1,12 +1,12 @@
---
-title: Migrate to Microsoft Defender for Endpoint - Setup
+title: Set up Microsoft Defender for Endpoint during migration
description: Move to Defender for Endpoint. Review the setup process, which includes installing Microsoft Defender Antivirus.
ms.service: defender-endpoint
ms.subservice: onboard
ms.author: painbar
author: paulinbar
ms.localizationpriority: medium
-ms.date: 06/17/2026
+ms.date: 07/02/2026
ms.collection:
- m365-security
- m365solution-migratetomdatp
@@ -15,7 +15,7 @@ ms.collection:
- highpri
- tier1
ms.topic: how-to
-ms.custom: migrationguides, msecd-doc-authoring-1014
+ms.custom: migrationguides, msecd-doc-authoring-1016
ms.reviewer: jesquive, chventou, jonix, chriggs, owtho, yongrhee
appliesto:
- Microsoft Defender for Endpoint Plan 1
@@ -25,7 +25,7 @@ ai-usage: ai-assisted
---
# Migrate to Microsoft Defender for Endpoint - Phase 2: Setup
-|[](switch-to-mde-phase-1.md)
[Phase 1: Prepare](switch-to-mde-phase-1.md)|
Phase 2: Set up|[](switch-to-mde-phase-3.md)
[Phase 3: Onboard](switch-to-mde-phase-3.md)|
+|[](switch-to-mde-phase-1.md)
[Phase 1: Prepare your environment](switch-to-mde-phase-1.md)|
Phase 2: Set up|[](switch-to-mde-phase-3.md)
[Phase 3: Onboard devices to Defender for Endpoint](switch-to-mde-phase-3.md)|
|---|---|---|
||*You're here!*||
@@ -79,7 +79,8 @@ In the exclusion-list step, you add Defender for Endpoint to the exclusion list
> [!IMPORTANT]
> As a best practice, keep your organization's devices and endpoints up to date. Make sure to get the **[latest updates for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](microsoft-defender-antivirus-updates.md)**, and keep your organization's operating systems and productivity apps up to date.
-## Step 3: Configure Defender for Endpoint
+
+## Step 3: Configure Defender for Endpoint onboarding and protection settings
Configure your Defender for Endpoint capabilities before devices are onboarded.
@@ -93,7 +94,7 @@ Configure your Defender for Endpoint capabilities before devices are onboarded.
|Screen|What it means|
|---|---|
|:::image type="content" source="media/mde-hangon-provisioning.png" alt-text="Screenshot showing message that says hang on because MDE isn't provisioned yet." lightbox="media/mde-hangon-provisioning.png":::|Defender for Endpoint isn't finished provisioning yet. You might have to wait a little while for the process to finish.|
- |:::image type="content" source="media/device-inventory-empty.png" alt-text="Screenshot showing device inventory page with no device onboarded yet." lightbox="media/device-inventory-empty.png":::|Defender for Endpoint is provisioned. In this case, proceed to the next step.|
+ |:::image type="content" source="media/device-inventory-empty.png" alt-text="Screenshot showing device inventory page with no device onboarded yet." lightbox="media/device-inventory-empty.png":::|Defender for Endpoint is provisioned. In this case, proceed to step 2, Turn on tamper protection.|
1. Turn on [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md). We recommend turning tamper protection on for your whole organization. You can do this task in the [Microsoft Defender portal](https://security.microsoft.com).
@@ -137,7 +138,7 @@ Configure your Defender for Endpoint capabilities before devices are onboarded.
|---|---|
|[Intune](/intune/intune-service/fundamentals/tutorial-walkthrough-endpoint-manager)|1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** \> **Configuration profiles**, and then select the profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](/intune/intune-service/configuration/device-restrictions-configure).
2. Select **Properties**, and then select **Configuration settings: Edit**
3. Expand **Microsoft Defender Antivirus**.
4. Enable **Cloud-delivered protection**.
5. In the **Prompt users before sample submission** dropdown, select **Send all samples automatically**.
6. In the **Detect potentially unwanted applications** dropdown, select **Enable** or **Audit**.
7. Select **Review + save**, and then choose **Save**.
**TIP**: For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](/intune/intune-service/configuration/device-profiles).|
|[Configuration Manager](/intune/configmgr)|See [Create and deploy antimalware policies for Endpoint Protection in Configuration Manager](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies).
When you create and configure your antimalware policies, make sure to review the [real-time protection settings](/intune/configmgr/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) and [enable block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md).
- |[Advanced Group Policy Management](/microsoft-desktop-optimization-pack/agpm/)
or
[Group Policy Management Console](/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus)|1. Go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
2. Look for a policy called **Turn off Microsoft Defender Antivirus**.
3. Choose **Edit policy setting**, and make sure that policy is disabled. Disabling that policy enables Microsoft Defender Antivirus. (You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.)|
+ |[Advanced Group Policy Management](/microsoft-desktop-optimization-pack/agpm/)
or
[Group Policy Management Console](use-group-policy-microsoft-defender-antivirus.md)|1. Go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.
2. Look for a policy called **Turn off Microsoft Defender Antivirus**.
3. Choose **Edit policy setting**, and make sure that policy is disabled. Disabling that policy enables Microsoft Defender Antivirus. (You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.)|
|Control Panel in Windows|Follow the guidance here: [Company Portal device setting requirements for Windows](/intune/intune-service/user-help/update-device-settings-windows). (You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.)|
*If you have Defender for Endpoint Plan 1, your initial setup and configuration is complete. If you have Defender for Endpoint Plan 2, continue through steps 6-7.*
@@ -160,11 +161,12 @@ When configuring Microsoft Defender Antivirus exclusions, you add your existing
|Local group policy object|1. On the endpoint or device, open the Local Group Policy Editor.
2. Go to **Computer Configuration** \> **Administrative Templates** \> **Windows Components** \> **Microsoft Defender Antivirus** \> **Exclusions**. (You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows.)
3. Specify your path and process exclusions.|
|Registry key|1. Export the following registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\exclusions`.
2. Import the registry key. Here are two examples:
- Local path: `regedit.exe /s c:\temp\MDAV_Exclusion.reg`
- Network share: `regedit.exe /s \\FileServer\ShareName\MDAV_Exclusion.reg`|
-[Learn more about exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md).
+[Learn more about exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-exclusions-overview.md).
-### Keep the following points about exclusions in mind
+
+### Important considerations for Microsoft Defender Antivirus exclusions
-When you add [exclusions to Microsoft Defender Antivirus scans](/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus), you should add path and process exclusions.
+When you add [exclusions to Microsoft Defender Antivirus scans](/defender-endpoint/microsoft-defender-antivirus-exclusions-configure), you should add path and process exclusions.
- *Path exclusions* exclude specific files and whatever those files access.
- *Process exclusions* exclude whatever a process touches, but doesn't exclude the process itself.
diff --git a/defender-endpoint/switch-to-mde-phase-3.md b/defender-endpoint/switch-to-mde-phase-3.md
index 844b026285d..217802c2066 100644
--- a/defender-endpoint/switch-to-mde-phase-3.md
+++ b/defender-endpoint/switch-to-mde-phase-3.md
@@ -1,6 +1,6 @@
---
title: Migrate to Microsoft Defender for Endpoint - Onboard
-description: Move to Microsoft Defender for Endpoint. Onboard devices and then uninstall your non-Microsoft solution.
+description: Onboard devices to Microsoft Defender for Endpoint, run a detection test, confirm Microsoft Defender Antivirus passive mode, get antivirus updates, and uninstall your non-Microsoft solution.
ms.service: defender-endpoint
ms.subservice: onboard
ms.author: painbar
@@ -12,11 +12,11 @@ ms.collection:
- highpri
- tier1
ms.custom:
- - msecd-doc-authoring-1014
+ - msecd-doc-authoring-1016
- migrationguides
- admindeeplinkDEFENDER
ms.topic: how-to
-ms.date: 06/17/2026
+ms.date: 07/02/2026
ms.reviewer: jesquive, chventou, jonix, chriggs, owtho, yongrhee
appliesto:
- Microsoft Defender for Endpoint Plan 1
@@ -31,7 +31,7 @@ ai-usage: ai-assisted
|--|--|--|
|| |*You're here!* |
-**Welcome to Phase 3 of [migrating to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)**. This migration phase includes the following steps:
+**Welcome to Phase 3 of [migrating to Defender for Endpoint](switch-to-mde-overview.md#the-migration-process)**. Before you begin, make sure you've completed [Phase 1: Prepare](switch-to-mde-phase-1.md) and [Phase 2: Set up](switch-to-mde-phase-2.md). This migration phase includes the following steps:
1. Onboard devices to Defender for Endpoint.
1. Run a detection test.
@@ -80,7 +80,7 @@ Deployment methods vary, depending on operating system and preferred methods. Th
## Step 2: Run a detection test
-To verify that your onboarded devices are properly connected to Defender for Endpoint, you can run a detection test.
+To verify that your onboarded devices are properly connected to Defender for Endpoint, you can run a detection test. Before running a detection test on macOS or Linux, make sure the device meets the system requirements for [macOS](microsoft-defender-endpoint-mac.md) or [Linux](mde-linux-prerequisites.md).
|Operating system|Guidance|
|---|---|
@@ -103,7 +103,7 @@ Now that your endpoints have been onboarded to Defender for Endpoint, your next
### Set Microsoft Defender Antivirus on Windows Server to passive mode manually
-To set Microsoft Defender Antivirus to passive mode on Windows Server 2019 and later, Windows Server, version 1803 or later and Azure Stack HCI OS, version 23H2 and later, follow these steps:
+The **ForceDefenderPassiveMode** registry value controls whether Microsoft Defender Antivirus stays in passive mode on supported Windows Server versions. To set this value on Windows Server 2019 and later, Windows Server, version 1803 or later and Azure Stack HCI OS, version 23H2 and later, follow these steps:
1. Open Registry Editor, and then navigate to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`.
@@ -116,7 +116,7 @@ To set Microsoft Defender Antivirus to passive mode on Windows Server 2019 and l
> You can use other methods to set the registry key, such as the following:
>
> - [Group Policy Preference](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn581922(v=ws.11))
-> - [Local Group Policy Object tool](/windows/security/threat-protection/security-compliance-toolkit-10#what-is-the-local-group-policy-object-lgpo-tool)
+> - [Local Group Policy Object tool](/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10#what-is-the-local-group-policy-object-lgpo-tool)
> - [A package in Configuration Manager](/intune/configmgr/apps/deploy-use/packages-and-programs)
### Start Microsoft Defender Antivirus on Windows Server 2016
@@ -128,7 +128,7 @@ If you're using Windows Server 2016, you might need to start Microsoft Defender
> [!TIP]
> The first command changes the directory to the latest version of \
Windows 10, [version 1803](/lifecycle/announcements/windows-server-1803-end-of-servicing) or later (See [Windows 10 release information](/windows/release-health/release-information))
Windows 10, version 1703 or 1709 with [KB4493441](https://support.microsoft.com/help/4493441) installed |`C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`
|
-|Windows Server 2025
[Windows Server 2022](/windows/release-health/status-windows-server-2022)
[Windows Server 2019](/windows/release-health/status-windows-10-1809-and-windows-server-2019)
[Windows Server 2016](/windows/release-health/status-windows-10-1607-and-windows-server-2016)
[Windows Server 2012 R2](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2)
[Windows Server, version 1803](/windows-server/get-started/whats-new-in-windows-server-1803)
Azure Stack HCI OS, version 23H2 and later | On Windows Server 2012 R2 and Windows Server 2016 running the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2), the following exclusions are required after updating the Sense EDR component using [KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac):
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`|
+|[Windows 11](/windows/whats-new/windows-11-overview)
Windows 10, [version 1803](/lifecycle/announcements/windows-server-1803-end-of-servicing) or later (See [Windows 10 release information](/windows/release-health/release-information))
Windows 10, version 1703 or 1709 with [KB4493441](https://support.microsoft.com/servicing/os/windows-10/2019/04/april-9-2019-kb4493441-os-build-16299-1087) installed |`C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe`
`C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`
|
+|Windows Server 2025
[Windows Server 2022](/windows/release-health/status-windows-server-2022)
[Windows Server 2019](/windows/release-health/status-windows-10-1809-and-windows-server-2019)
[Windows Server 2016](/windows/release-health/status-windows-10-1607-and-windows-server-2016)
[Windows Server 2012 R2](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2)
[Windows Server, version 1803](/windows-server/get-started/whats-new-in-windows-server-1803)
Azure Stack HCI OS, version 23H2 and later | On Windows Server 2012 R2 and Windows Server 2016 running the [modern unified solution](onboard-server.md#functionality-in-the-modern-unified-solution-for-windows-server-2016-and-windows-server-2012-r2), the following exclusions are required after updating the Sense EDR component using [KB5005292](https://support.microsoft.com/servicing/Management-Tools/microsoft-defender/update/microsoft-defender-for-endpoint-update-for-edr-sensor):
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe`
`C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection`|
|[Windows 8.1](/windows/release-health/status-windows-8.1-and-windows-server-2012-r2)
[Windows 7](/windows/release-health/status-windows-7-and-windows-server-2008-r2-sp1)
[Windows Server 2008 R2 SP1](/windows/release-health/status-windows-7-and-windows-server-2008-r2-sp1) |`C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 6\45\MsSenseS.exe`
**NOTE**: Monitoring Host Temporary Files 6\45 can be different numbered subfolders.
`C:\Program Files\Microsoft Monitoring Agent\Agent\AgentControlPanel.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\HSLockdown.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\MOMPerfSnapshotHelper.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe`
`C:\Program Files\Microsoft Monitoring Agent\Agent\TestCloudConnection.exe` |
> [!IMPORTANT]
@@ -110,7 +110,7 @@ If you're using a non-Microsoft antivirus/antimalware solution on Windows Server
```
> [!TIP]
- > You can also use [Server Manager or PowerShell to install the Microsoft Defender Antivirus feature](microsoft-defender-antivirus-on-windows-server.md#install-microsoft-defender-antivirus-on-windows-server).
+ > You can also use [Server Manager or PowerShell to install the Microsoft Defender Antivirus feature](microsoft-defender-antivirus-windows-server-configure.md#install-microsoft-defender-antivirus-on-windows-server).
1. Reboot the system.
diff --git a/defender-endpoint/tamper-resiliency.md b/defender-endpoint/tamper-resiliency.md
index 0f708f24d8b..6d379cd4161 100644
--- a/defender-endpoint/tamper-resiliency.md
+++ b/defender-endpoint/tamper-resiliency.md
@@ -25,7 +25,7 @@ Tampering is the general term used to describe attackers attempts to impair the
## Organization wide tamper resiliency is built on Zero Trust
-The foundation for defending against tampering is following a [Zero Trust](/windows/security/zero-trust-windows-device-health) model.
+The foundation for defending against tampering is following a [Zero Trust](/windows/security/book/security-foundation) model.
- Follow the best practice of least privilege. See [Access control overview for Windows](/windows/security/identity-protection/access-control/access-control).
- Configure [Conditional Access policies](/azure/active-directory/conditional-access/overview) to keep untrusted users and devices isolated.
@@ -38,7 +38,7 @@ In order to provide an effective defense against tampering, devices must be heal
> [!NOTE]
> On Windows devices, Microsoft Defender Antivirus can be managed by using Group Policy, Windows Management Instrumentation (WMI), and PowerShell cmdlets. However, those methods are more susceptible to tampering than by using Microsoft Intune, Configuration Manager, or Microsoft Defender for Endpoint Security Configuration Management.
-> If you're using Group Policy, we recommend [disabling local overrides for Microsoft Defender Antivirus settings](configure-local-policy-overrides-microsoft-defender-antivirus.md#configure-local-overrides-for-microsoft-defender-antivirus-settings) and [disabling local list merging](configure-local-policy-overrides-microsoft-defender-antivirus.md#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
+> If you're using Group Policy, we recommend [disabling local overrides for Microsoft Defender Antivirus settings](configure-local-policy-overrides-microsoft-defender-antivirus.md#configure-local-overrides-for-microsoft-defender-antivirus-settings-using-group-policy) and [disabling local list merging](configure-local-policy-overrides-microsoft-defender-antivirus.md#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
You can view health status for [Microsoft Defender Antivirus](device-health-microsoft-defender-antivirus-health.md) health and [sensors](device-health-sensor-health-os.md) in the [device health reports in Microsoft Defender for Endpoint](device-health-reports.md).
@@ -51,7 +51,7 @@ Attackers use various tampering techniques to disable Microsoft Defender for End
| [Tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) | Windows | - Terminating/suspending processes
- Stopping/pausing/suspending services
- Modifying registry settings including exclusions
- Manipulating/hijacking DLLs
- Manipulation/modification of the file system
- Agent integrity |
| [Tamper protection](tamperprotection-macos.md) | Mac | - Terminating/suspending processes
- Manipulation/modification of the file system
- Agent integrity|
| [Attack surface reduction (ASR) rules](attack-surface-reduction-rules-overview.md) | Windows | Kernel drivers (see [Block abuse of exploited vulnerable signed drivers (Device)](attack-surface-reduction-rules-reference.md#block-abuse-of-exploited-vulnerable-signed-drivers-device))|
-| [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide) (WDAC) | Windows | Kernel drivers (see [Microsoft vulnerable driver block list](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules))|
+| [Windows Defender Application Control](/windows/security/application-security/application-control/app-control-for-business/operations/appcontrol-operational-guide) (WDAC) | Windows | Kernel drivers (see [Microsoft vulnerable driver block list](/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules))|
## Understanding the different ways to prevent driver based tampering on Windows
@@ -66,11 +66,11 @@ Microsoft provides several ways to keep devices well protected and up to date ag
The block list is updated with each new major release of Windows, typically 1-2 times per year. Microsoft will occasionally publish future updates through regular Windows servicing. With Windows 11 2022 update, the vulnerable driver block list is enabled by default for all devices, but requires either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode to be active.
-See [Microsoft vulnerable driver block list](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist).
+See [Microsoft vulnerable driver block list](/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist).
For devices that don't meet those requirements, this list of drivers can be blocked by using Windows Defender Application Control policy.
-See [Vulnerable Driver block list XML](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist).
+See [Vulnerable Driver block list XML](/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist).
### Faster updates - Block exploited vulnerable and signed drivers ASR rule
@@ -80,7 +80,7 @@ For more information, see [Block abuse of exploited vulnerable signed drivers (D
### Block other drivers - Windows Defender Application Control (WDAC)
-Attackers might attempt to use drivers that aren't blocked by either the recommended driver block list or an ASR rule. In this case, customers can protect themselves by using [WDAC to create a policy to block](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide)
+Attackers might attempt to use drivers that aren't blocked by either the recommended driver block list or an ASR rule. In this case, customers can protect themselves by using [WDAC to create a policy to block](/windows/security/application-security/application-control/app-control-for-business/operations/appcontrol-operational-guide)
WDAC also provides an audit mode to help understand the impact of applying the policy in block mode to avoid accidentally impacting legitimate use.
@@ -126,4 +126,4 @@ When tampering is detected, an alert is raised. Some of the alert titles for tam
If the [Block abuse of exploited vulnerable signed drivers (Device)](attack-surface-reduction-rules-reference.md#block-abuse-of-exploited-vulnerable-signed-drivers) attack surface reduction rule is triggered, the event is viewable in the [ASR Report](attack-surface-reduction-rules-report.md) and in [Advanced Hunting](attack-surface-reduction-rules-monitor.md#asr-rule-events-in-advanced-hunting).
-If [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) (WDAC) is enabled, the [block and audit activity can be seen in Advanced Hunting](/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting).
+If [Windows Defender Application Control](/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide) (WDAC) is enabled, the [block and audit activity can be seen in Advanced Hunting](/windows/security/application-security/application-control/app-control-for-business/operations/querying-application-control-events-centrally-using-advanced-hunting).
diff --git a/defender-endpoint/troubleshoot-asr.md b/defender-endpoint/troubleshoot-asr.md
index 7bceadda749..80a0ce90e45 100644
--- a/defender-endpoint/troubleshoot-asr.md
+++ b/defender-endpoint/troubleshoot-asr.md
@@ -1,14 +1,14 @@
---
title: Troubleshoot ASR rules
-description: Resources and sample code to troubleshoot issues with attack surface reduction (ASR) rules in Microsoft Defender Antivirus.
+description: Troubleshoot false positives, false negatives, and other issues with attack surface reduction (ASR) rules in Microsoft Defender Antivirus. Includes self-service diagnostic steps and guidance for collecting data before opening a support case.
ms.service: defender-endpoint
ms.localizationpriority: medium
audience: ITPro
author: chrisda
ms.author: chrisda
-ms.date: 06/16/2026
+ms.date: 07/17/2026
ms.reviewer:
-ms.custom: asr, msecd-doc-authoring-1014
+ms.custom: asr, msecd-doc-authoring-1016
ms.subservice: asr
ms.topic: how-to
ms.collection:
@@ -43,13 +43,13 @@ For ASR rule requirements, see [Requirements for ASR rules](attack-surface-reduc
## Verify the active ASR rules and actions on devices
-Run the following command in PowerShell on the device to see the state of all configured ASR rules:
+Run the following command in PowerShell on the device to list the configured ASR rule IDs and their current action values. The output helps you identify which rules are active and whether they're set to **Block**, **Audit**, or another mode:
```powershell
$p = Get-MpPreference;0..([math]::Min($p.AttackSurfaceReductionRules_Ids.Count,$p.AttackSurfaceReductionRules_Actions.Count)-1) | % {[pscustomobject]@{Id=$p.AttackSurfaceReductionRules_Ids[$_];Action=$p.AttackSurfaceReductionRules_Actions[$_]}} | Format-Table -AutoSize
```
-Example output from this command might look like this:
+The following sample output shows ASR rule GUIDs in the **Id** column and their configured action values in the **Action** column. Use this output to confirm which rules are set to **Block** mode (action value 1) or **Audit** mode (action value 2):
```powershell
Id Action
@@ -71,11 +71,14 @@ d4f940ab-401b-4efc-aadc-ad5f3c50688a 2
e6db77e5-3df2-4cf1-b95a-636979351e5b 1
```
-In this example, the [ASR rules](attack-surface-reduction-rules-overview.md#asr-rules) are active in [different modes](attack-surface-reduction-rules-overview.md#modes-for-asr-rules) on the device (2 = **Audit** mode, 1 = **Block** mode).
+In this example, the [ASR rules listed in the overview](attack-surface-reduction-rules-overview.md#asr-rules) are active in [different ASR rule modes](attack-surface-reduction-rules-overview.md#modes-for-asr-rules) on the device (2 = **Audit** mode, 1 = **Block** mode).
> [!NOTE]
> If you used [Group Policy to configure ASR rules](attack-surface-reduction-rules-configure.md#configure-asr-rules-and-exclusions-in-group-policy), verify there are no extra characters like quotation marks or spaces in the ASR rule GUID value.
+> [!TIP]
+> To see the actual value of each ASR rule setting on a device and the source that configured it, use the **Effective settings** tab on the device page. For more information, see [Configuration management - Effective settings](investigate-machines.md#configuration-management---effective-settings).
+
@@ -84,7 +87,7 @@ In this example, the [ASR rules](attack-surface-reduction-rules-overview.md#asr-
ASR rules in **Audit mode** don't block files or processes, but the actions that the rule would have taken in **Block** or **Warn** mode are recorded.
-Whatever method you used to distribute ASR rules to devices, use that same method to set the problematic rules to **Audit** mode. For instructions, see [Configure attack surface reduction rules](attack-surface-reduction-rules-configure.md).
+Use the same method you originally used to distribute ASR rules to devices (for example, Group Policy, Intune, or PowerShell) to set the problematic rules to **Audit** mode. For instructions, see [Configure attack surface reduction rules](attack-surface-reduction-rules-configure.md).
> [!TIP]
> If the ASR rule was already in **Audit** mode, that explains why it wasn't blocking the files or processes you expected it to block (false negative). ASR rules can accidentally get into **Audit** mode in the following scenarios:
@@ -114,12 +117,14 @@ If the ASR rule still isn't working as expected, do one of the following steps:
- For false positives, add the file or path as an exclusion to the ASR rule. For more information, see [File and folder exclusions for ASR rules](attack-surface-reduction-rules-overview.md#file-and-folder-exclusions-for-asr-rules).
- Use the [Microsoft Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/support/report-exploit-guard) to report a false negative or false positive for ASR rules. With a Windows E5 subscription, you can also provide a link to any associated alert from the [Alerts queue](alerts-queue.md).
-- When you report a problem involving ASR rules to Microsoft, you need to collect and submit diagnostic data to help troubleshoot the issue as described in [Collect diagnostic data for Microsoft support](#collect-diagnostic-data-for-microsoft-support).
+- When you report a problem involving ASR rules to Microsoft, you need to collect and submit diagnostic data to help troubleshoot the issue. See the following diagnostic data collection sections for instructions on using the MDE Client Analyzer or MpCmdRun.
## Collect diagnostic data for Microsoft support
+When you open a support case with Microsoft for an ASR rule issue, you need to collect diagnostic data from the affected device. You can use either the MDE Client Analyzer or the MpCmdRun command-line tool to generate the required diagnostic files.
+
### Collect diagnostic data with the MDE Client Analyzer
@@ -130,7 +135,7 @@ Follow these steps to collect diagnostic data with the MDE Client Analyzer:
1. Close any apps on the device that aren't essential to reproducing the issue.
-1. To collect verbose Defender for Endpoint diagnostics for ASR troubleshooting, run the MDE Client Analyzer with the `-v` switch [locally or using Live Response](run-analyzer-windows.md):
+1. Run MDE Client Analyzer in verbose mode to collect detailed diagnostic data for troubleshooting ASR-related behavior. The `-v` switch enables verbose logging, which captures the additional detail that Microsoft Support needs to diagnose ASR rule issues. You can run the analyzer [locally or using Live Response](run-analyzer-windows.md):
```dos
C:\Work\tools\MDEClientAnalyzer\MDEClientAnalyzer.cmd -v
diff --git a/defender-endpoint/troubleshoot-av-performance-issues-with-wprui.md b/defender-endpoint/troubleshoot-av-performance-issues-with-wprui.md
index c5c813075bf..f18495a1882 100644
--- a/defender-endpoint/troubleshoot-av-performance-issues-with-wprui.md
+++ b/defender-endpoint/troubleshoot-av-performance-issues-with-wprui.md
@@ -186,7 +186,7 @@ To collect a WPR trace using the command-line tool wpr.exe:
- [Troubleshoot Microsoft Defender Antivirus settings](troubleshoot-settings.md)
-- [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
+- [Configure and validate exclusions for Microsoft Defender Antivirus scans](microsoft-defender-antivirus-exclusions-configure.md)
- [Troubleshoot performance issues related to Microsoft Defender Antivirus](troubleshoot-performance-issues.md)
diff --git a/defender-endpoint/troubleshoot-device-discovery-network-scans.md b/defender-endpoint/troubleshoot-device-discovery-network-scans.md
index 3177a53bfe3..e5c453db6b5 100644
--- a/defender-endpoint/troubleshoot-device-discovery-network-scans.md
+++ b/defender-endpoint/troubleshoot-device-discovery-network-scans.md
@@ -9,9 +9,9 @@ ms.localizationpriority: medium
ms.collection:
- m365-security
- tier1
-ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1014
+ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1016
ms.topic: how-to
-ms.date: 06/16/2026
+ms.date: 07/03/2026
appliesto:
- Microsoft Defender for Endpoint Plan 2
@@ -53,7 +53,7 @@ Validate that the scanner is running properly. Then go to the scan definition (t
## My scanner is configured but scans aren't running
-As the authenticated scanner currently uses an encryption algorithm that isn't compliant with [Federal Information Processing Standards (FIPS)](/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing/), the scanner can't operate when an organization enforces the use of FIPS compliant algorithms.
+As the authenticated scanner currently uses an encryption algorithm that isn't compliant with [Federal Information Processing Standards (FIPS)](/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing), the scanner can't operate when an organization enforces the use of FIPS compliant algorithms.
To allow algorithms that aren't compliant with FIPS, set the following value in the registry for the devices where the scanner runs:
@@ -64,14 +64,12 @@ FIPS compliant algorithms are only used in relation to departments and agencies
## Registration error: insufficient permissions to add a new agent
-Registration finished with an error: "It looks like you don't have sufficient permissions for adding a new agent. The required permission is 'Manage security settings in Defender'."
+Registration finished with an error: "It looks like you don't have sufficient permissions for adding a new agent. The required permission is 'Manage security settings in Defender'." Press any key to exit.
-Press any key to exit.
-
-To resolve this issue:
+To resolve this issue, take one of the following actions:
- Ask your system administrator to assign you the required permissions.
-- Alternately, ask another relevant member to help you with the sign-in process by providing them with the sign-in code and link.
+- Ask another relevant member to help you with the sign-in process by providing them with the sign-in code and link.
## Registration process fails using provided link in the command line in registration process
diff --git a/defender-endpoint/troubleshoot-live-response.md b/defender-endpoint/troubleshoot-live-response.md
index d3a2df159d4..d263d006acd 100644
--- a/defender-endpoint/troubleshoot-live-response.md
+++ b/defender-endpoint/troubleshoot-live-response.md
@@ -58,8 +58,5 @@ Live response uses Defender for Endpoint sensor registration with WNS service in
Refer to the following articles to fully understand the WpnService service behavior and requirements:
-- [Windows Push Notification Services (WNS) overview](/windows/uwp/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview)
-- [Enterprise Firewall and Proxy Configurations to Support WNS Traffic](/windows/uwp/design/shell/tiles-and-notifications/firewall-allowlist-config)
-- [Microsoft Push Notifications Service (MPNS) Public IP ranges](https://www.microsoft.com/download/details.aspx?id=44535)
-
-
+- [Windows Push Notification Services (WNS) overview](/windows/apps/develop/notifications/push-notifications/wns-overview)
+- [Enterprise firewall configurations to support WNS traffic](/windows/apps/develop/notifications/push-notifications/firewall-allowlist-config)
diff --git a/defender-endpoint/troubleshoot-mdav-scan-issues.md b/defender-endpoint/troubleshoot-mdav-scan-issues.md
index 2d27b5b5346..a8509aa2c46 100644
--- a/defender-endpoint/troubleshoot-mdav-scan-issues.md
+++ b/defender-endpoint/troubleshoot-mdav-scan-issues.md
@@ -10,7 +10,10 @@ ms.collection:
- tier3
ms.topic: troubleshooting
ms.subservice: ngp
-ms.date: 03/20/2026
+ms.date: 08/20/2026
+ms.custom: msecd-doc-authoring-1015
+ai-usage: ai-assisted
+#customer intent: As a security administrator, I want to troubleshoot Microsoft Defender Antivirus scans so that I can identify and resolve scan configuration and performance issues.
---
# Troubleshoot Microsoft Defender Antivirus scan issues
@@ -61,7 +64,7 @@ The following table summarizes antivirus settings in Microsoft Intune for Window
|Scan|Archive Max Depth||
|Scan|Archive Max Size||
|Scan|Check For Signatures Before Running Scan|This policy setting allows you to manage whether a check for new virus and spyware security intelligence occurs before running a scan. It applies to scheduled scans, but has no effect on scans initiated manually from the user interface or scans from the [Command Prompt](command-line-arguments-microsoft-defender-antivirus.md): `MpCmdrun.exe -Scan [Options]`.|
-|Scan|Disable Catchup Full Scan|This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually, these scheduled scans are missed because the computer was turned off at the scheduled time.
If you disable or don't configure this setting, catch-up scans for scheduled full scans occur. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone signs into the computer. If there's no scheduled scan configured, no catch-up scan runs.
If you enable this setting, catch-up scans for scheduled full scans are disabled.|
+|Scan|Disable Catchup Full Scan|This policy setting controls whether catch-up scans run after scheduled full scans are missed. Because the setting name begins with _Disable_, **Enabled** disables catch-up full scans, and **Disabled** enables them.
If you disable this setting and a device misses two consecutive scheduled full scans, a catch-up scan starts the next time someone signs in. Catch-up scans require a configured scheduled scan.
If you don't configure this setting, the client default applies, and catch-up full scans are disabled.|
|Scan|Enable Low CPU Priority|This policy setting allows you to enable or disable low CPU priority for scheduled scans.
- If you enable this setting, low CPU priority is used during scheduled scans.
- If you disable or don't configure this setting, no changes are made to CPU priority for scheduled scans.|
|General|Excluded Extensions||
|General|Excluded Paths||
@@ -187,8 +190,8 @@ For more information, see [Performance analyzer for Microsoft Defender Antivirus
One outcome of this process might be identifying files or paths that you want to exclude from antivirus scans to improve performance. Make sure to review the following articles:
-- [Exclusions overview](navigate-defender-endpoint-antivirus-exclusions.md)
-- [Contextual file and folder exclusions](configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md)
+- [Exclusions overview](defender-endpoint-exclusions-overview.md)
+- [Contextual file and folder exclusions](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions)
## Reviewing Event logs
@@ -225,4 +228,4 @@ Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | where i
## See also
- [About scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md)
-- [Exclusions overview](navigate-defender-endpoint-antivirus-exclusions.md)
+- [Exclusions overview](defender-endpoint-exclusions-overview.md)
diff --git a/defender-endpoint/troubleshoot-np.md b/defender-endpoint/troubleshoot-np.md
index 738c3289867..8e4e63f16f8 100644
--- a/defender-endpoint/troubleshoot-np.md
+++ b/defender-endpoint/troubleshoot-np.md
@@ -12,13 +12,13 @@ ms.collection:
- m365-security
- tier3
- mde-asr
-ms.date: 06/16/2026
+ms.date: 07/02/2026
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender for Business
ai-usage: ai-assisted
-ms.custom: msecd-doc-authoring-1014
+ms.custom: msecd-doc-authoring-1016
---
# Troubleshoot network protection
@@ -28,7 +28,7 @@ This article provides troubleshooting information for [network protection](netwo
- Network protection blocks a website that is safe (false positive)
- Network protection fails to block a suspicious or known malicious website (false negative)
-There are four steps to troubleshooting these problems:
+There are four steps to troubleshoot false positives and false negatives in network protection:
1. Confirm prerequisites
1. Use audit mode to test the rule
@@ -42,10 +42,10 @@ Network protection works on devices with the following conditions:
> [!div class="checklist"]
>
> - Endpoints are running Windows 10 Pro or Enterprise edition, version 1709 or higher.
-> - Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [See what happens when you're using a non-Microsoft antivirus solution](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).
-> - [Real-time protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) is enabled.
+> - Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [See what happens when you're using a non-Microsoft antivirus solution](microsoft-defender-antivirus-compatibility.md).
+> - [Real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
> - [Behavior Monitoring](behavior-monitor.md) is enabled.
-> - [Cloud-delivered protection](/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) is enabled.
+> - [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) is enabled.
> - [Cloud Protection network connectivity](configure-network-connections-microsoft-defender-antivirus.md) is functional.
> - Audit mode isn't enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
@@ -53,7 +53,7 @@ Network protection works on devices with the following conditions:
You can enable network protection in audit mode and then visit the [network protection demo site](https://smartscreentestratings2.net) to test the feature. All website connections are allowed by network protection but an event is logged to indicate any connection that would be blocked if network protection were enabled.
-1. Set network protection to **Audit mode**.
+1. Set network protection to **Audit mode**. Audit mode allows all connections but logs any connection that would be blocked, so you can test whether blocking is causing the issue.
```PowerShell
Set-MpPreference -EnableNetworkProtection AuditMode
@@ -63,7 +63,7 @@ You can enable network protection in audit mode and then visit the [network prot
1. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would block the connection if it were set to **Enabled**.
- If network protection isn't blocking a connection that you're expecting it should block, re-enable the feature to restore enforcement:
+ If network protection isn't blocking a connection that you're expecting it should block, run the following command to re-enable Network Protection in block mode and restore enforcement:
```PowerShell
Set-MpPreference -EnableNetworkProtection Enabled
@@ -71,7 +71,7 @@ You can enable network protection in audit mode and then visit the [network prot
## Report a false positive or false negative
-If you've tested the feature with the demo site and with audit mode, and network protection is working on preconfigured scenarios, but isn't working as expected for a specific connection, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also provide a link to any associated alert from the [Alerts queue](alerts-queue.md).
+If you tested the feature with the demo site and audit mode, network protection might work on preset scenarios but not for a specific connection. To report this issue, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to submit a false negative or false positive. With an E5 subscription, you can also link to any related alert from the [Alerts queue](alerts-queue.md).
See [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md).
@@ -83,16 +83,16 @@ The current exclusion options are:
1. Using IP exclusions: `Add-MpPreference -ExclusionIpAddress 192.168.1.1`.
-1. Excluding an entire process. For more information, see [Microsoft Defender Antivirus exclusions](configure-exclusions-microsoft-defender-antivirus.md).
+1. Excluding an entire process. For more information, see [Microsoft Defender Antivirus exclusions](microsoft-defender-antivirus-exclusions-configure.md).
## Troubleshoot network performance issues
-In certain circumstances, a network protections component might contribute to slow network connections to Domain Controllers and/or Exchange servers. You might also notice Event ID 5783 NETLOGON errors, which indicate authentication-related connectivity failures between the device and a Domain Controller.
+A network protection component might slow down connections to Domain Controllers or Exchange servers. You might also see Event ID 5783 NETLOGON errors. These errors mean the device can't connect to a Domain Controller.
-To attempt to solve these issues, change Network Protection from 'block mode' to either '[audit mode](troubleshoot-np.md)' or 'disabled'. If your network issues are fixed, use the following component-isolation procedure to find out which component in Network Protection is contributing to the behavior.
+To fix slow network connections or Event ID 5783 NETLOGON errors, switch Network Protection from 'block mode' to '[audit mode](troubleshoot-np.md)' or 'disabled'. If that resolves the problem, disable Network Protection components one at a time to isolate which component causes the issue.
-Disable the following components in order and test your network connectivity performance after disabling each one:
+Disable the following components one at a time and test your network speed after each change:
1. [Disable Datagram Processing on Windows Server](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true)
1. [Disable Network Protection Perf Telemetry](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true)
@@ -106,19 +106,19 @@ Disable the following components in order and test your network connectivity per
1. [Disable inbound connection filtering](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true)
1. [Disable TLS parsing](/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&preserve-view=true)
-If your network performance issues persist after following these troubleshooting steps, then they're probably not related to network protection and you should look for other causes of your network performance issues.
+If your network performance issues persist after disabling each Network Protection component listed earlier, then the issues are probably not related to network protection. Look for other causes of your network performance issues.
## Collect diagnostic data for file submissions
-When you report a problem with network protection, you're asked to collect and submit diagnostic data for Microsoft support and engineering teams to help troubleshoot issues. You complete this step by running `MpCmdrun.exe -GetFiles`, which saves the diagnostic data at `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`.
+When you report a problem with network protection, you're asked to collect and submit diagnostic data for Microsoft support and engineering teams to help troubleshoot issues. You collect and submit the diagnostic data by running `MpCmdrun.exe -GetFiles`, which saves the data at `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`.
For detailed instructions, see [Collect Microsoft Defender Antivirus diagnostic data](collect-diagnostic-data.md).
## Resolve connectivity issues with network protection (for E5 customers)
-Because network protection can't see your operating system proxy settings, network protection clients might be unable to reach the cloud service in some environments. To resolve these connectivity issues, configure one of the following registry keys so that network protection becomes aware of the proxy configuration:
+Because network protection can't see your operating system proxy settings, network protection clients might be unable to reach the cloud service in some environments. To resolve these connectivity issues, configure one of the following registry keys so that network protection becomes aware of the proxy configuration. You can configure the registry key by using PowerShell, Microsoft Configuration Manager, or Group Policy.
-To configure a static proxy server, set the proxy address and port:
+If your environment uses a fixed proxy endpoint, configure Microsoft Defender to route traffic through that proxy server by setting the address and port:
```powershell
Set-MpPreference -ProxyServer
Anytime that a binary (such as `.exe`,`.dll`, and so on) is launched/started, if it's not digitally signed, Microsoft Defender Antivirus starts a real-time protection scan or when you're running a scheduled scan, and/or on-demand scan.|You should consider signing the binaries using an internal PKI. And/or reaching out to the vendor so they could sign the binary. And adding the certificate to the [Indicators – Certificate - allow ](indicator-certificates.md)
We recommend that software vendors follow the various guidelines in [Partnering with the industry to minimize false positives](https://www.microsoft.com/security/blog/2018/08/16/partnering-with-the-industry-to-minimize-false-positives/). The software vendor or software developer can submit the application, service, or script in the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi/filesubmission?persona=SoftwareDeveloper).
As a work-around, you can follow these steps:
1. (Preferred) For .exe's and dll's use [Indicators – File hash - allow](indicator-file.md)
2. (Alternative) Add [Antivirus exclusions (process+path)](configure-exclusions-microsoft-defender-antivirus.md).|
-|2. **Using HTA's, CHM's and different files as databases**.
Anytime that Microsoft Defender Antivirus must extract and/or scan complex file formats, higher CPU utilization can occur.|Consider switching to using actual databases if you need to save info and query it.
As a workaround, add [Antivirus exclusions (process+path)](configure-exclusions-microsoft-defender-antivirus.md).|
-|3. **Using obfuscations on scripts**.
If you obfuscate scripts, Microsoft Defender Antivirus in order to check if the script contains malicious payloads, it can use more CPU utilization while scanning.|Use script obfuscation only when necessary.
As a workaround, add [Antivirus exclusions (process+path)](configure-exclusions-microsoft-defender-antivirus.md).|
+|1. **Binaries not signed** (`.exe`, `.dll`, and so on)
Anytime that a binary (such as `.exe`,`.dll`, and so on) is launched/started, if it's not digitally signed, Microsoft Defender Antivirus starts a real-time protection scan or when you're running a scheduled scan, and/or on-demand scan.|You should consider signing the binaries using an internal PKI. And/or reaching out to the vendor so they could sign the binary. And adding the certificate to the [Indicators – Certificate - allow ](indicator-certificates.md)
We recommend that software vendors follow the various guidelines in [Partnering with the industry to minimize false positives](https://www.microsoft.com/security/blog/2018/08/16/partnering-with-the-industry-to-minimize-false-positives/). The software vendor or software developer can submit the application, service, or script in the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi/filesubmission?persona=SoftwareDeveloper).
As a work-around, you can follow these steps:
1. (Preferred) For .exe's and dll's use [Indicators – File hash - allow](indicator-file.md)
2. (Alternative) Add [Antivirus exclusions (process+path)](microsoft-defender-antivirus-exclusions-configure.md).|
+|2. **Using HTA's, CHM's and different files as databases**.
Anytime that Microsoft Defender Antivirus must extract and/or scan complex file formats, higher CPU utilization can occur.|Consider switching to using actual databases if you need to save info and query it.
As a workaround, add [Antivirus exclusions (process+path)](microsoft-defender-antivirus-exclusions-configure.md).|
+|3. **Using obfuscations on scripts**.
If you obfuscate scripts, Microsoft Defender Antivirus in order to check if the script contains malicious payloads, it can use more CPU utilization while scanning.|Use script obfuscation only when necessary.
As a workaround, add [Antivirus exclusions (process+path)](microsoft-defender-antivirus-exclusions-configure.md).|
|4. **Not letting the Microsoft Defender Antivirus cache finish before sealing the image**.|If you're creating a VDI image such as for a non-persistent image, make sure that cache maintenance completes before the image is sealed.
For more information, see [Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment](deployment-vdi-microsoft-defender-antivirus.md).|
-|5. **Misspelled exclusions**.
|Use `MpCmdRun.exe -CheckExclusion -Path
Behavior Monitoring (BM) and Network Real-time Inspection (NRI) can still cause performance issues.|As a workaround, take these steps:
1. (Preferred) For .exe's and dll's use [Indicators – File hash - allow](indicator-file.md) or [Indicators – Certificate - allow](indicator-certificates.md)
2. (Alternative) [Add Antivirus exclusions (process+path)](configure-exclusions-microsoft-defender-antivirus.md).|
+|5. **Misspelled exclusions**.
|Use `MpCmdRun.exe -CheckExclusion -Path