Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Endpoint protection

Manage Devices in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

1 October 2026Doc update+22 / −19 lines

In brief

The page updates portal links, changes “details flyout” to “details pane,” improves punctuation and phrasing, and revises antivirus mode descriptions and terminology.

What Defender admins need to know

Administrators get more direct links and clearer instructions when managing devices; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Manage devicesDevices in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

In Defender for Business, you can manage devices as follows:

Screenshot of device inventory

  1. In the Microsoft Defender portal at Microsoft Defender portal, go to Assets > Devices. Or, to go directly to the Device inventory page, use page.
  2. On the Device inventory page, you can see the list of devices and view some information about them.
  3. Select a device from the list to open the details flyoutpane for the device, where you can learn more about the status of the device and take actions.

If no devices are listed, see Onboard devices to Defender for Business.

Take action on a device that has threat detections

Screenshot of a selected device with details and actions available.

  1. In the Microsoft Defender portal at Microsoft Defender portal, go to Assets > Devices. Or, to go directly to the Device inventory page, use page.
  2. On the Device inventory page, select a device from the list.
  3. In the details flyoutpane that opens, select More, and then select an available action (foraction, for example, Run antivirus scan or Initiate Automated Investigation).

View the state of Microsoft Defender Antivirus

Microsoft Defender Antivirus has one of the following states on devices:

  • Active mode (recommended): Microsoft Defender Antivirus is the exclusive antivirus app on a device onboarded to Defender for Business. Files are scannedIt scans files and threats are remediated. Detectionremediates threats. You can view detection information is reported in the Microsoft Defender portal and in the Windows Security app on Windows devices.

    We recommend active mode so devices onboarded to Defender for Business get all of the following types of protection:

    • Real-time protection: Locates and stops malware from running on devices.

    • Cloud protection: Works with Microsoft Defender Antivirus and the Microsoft cloudCloud to identify new threats, sometimes even before a single device is affected.

    • Network protection: Helps protect against phishing scams, exploit-hosting sites, and malicious content on the internet.

    • Web content filtering: Regulates access to websites based on content categories (suchcategories, such as adult content, high bandwidth, and legal liability)liability, across all browsers.

    • Protection from potentially unwanted applications: For example:

      • Advertising software.
      • Bundled software that offers to install other, unsigned software.
      • Evasion software that attempts to evade security features.

  • Passive mode: A non-Microsoft antivirus/antivirus or antimalware product is installed on a device onboarded to Defender for Business. Microsoft Defender Antivirus can detect threats and can receive security intelligence and platform updates. But Microsoft Defender Antivirus doesn't remediate threats.

    You can automatically switch to active mode by uninstalling the non-Microsoft antivirus/antivirus or antimalware product.

  • Disabled mode: Also known as uninstalled mode. A non-Microsoft antivirus/antivirus or antimalware product is installed on a device that isn't onboarded to Defender for Business. Microsoft Defender Antivirus isn't currently running on the device; itdevice. It might be automatically disabled or manually disabled. Microsoft Defender Antivirus can't detect or remediate threats on the device.

    You can switch to active mode by doingcompleting the following steps:

    1. Uninstall the non-Microsoft antivirus/antivirus or antimalware solution.
    2. Onboard the device to Defender for Business.

What to expect when Microsoft Defender Antivirus detects threats

In most cases, users don't need to take any further action. As soon as a malicious file or program is detected on a device, Microsoft Defender Antivirus blocks it and prevents it from running. Plus, newly detected threats are added to the antivirus and anti-malware engine so that other devices and users are also protected.

If a user needs to take action (foraction, for example, approve the removal of a malicious file),file, the action is shown in the notification they receive. To learn more about actions that Microsoft Defender Antivirus takes on a user's behalf, or actions users might need to take, see Protection History.

To learn more about different threats, visit thesee Microsoft Security Intelligence Threats site where you can take the following actions:

  • View current information about top threats.
  • View the latest threats for a specific region.