Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Address Unwanted Behaviors in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

13 October 2026Doc update+20 / −22 lines

In brief

The article received clearer wording, standardized terminology and formatting, revised examples, and updated link text.

What Defender admins need to know

Use the revised guidance and links when troubleshooting unwanted behaviors in Defender for Endpoint.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Address unwanted behaviorsUnwanted Behaviors in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Microsoft Defender for Endpoint helps prevent and detect malicious processes and files. It protects your organization from threats while keeping productivity intact. Sometimes, unwanted behaviors can occur, such as:

Note

CreatingCreate an indicator or an exclusion should only be considered after thoroughly understanding the root cause of the unexpected behavior.

General process for addressing unwanted behaviors

At a high level, the process for addressing an unwanted behavior in Defender for Endpoint is as follows:

  1. Identify which capability is causing the unwanted behavior. To make your determination, determineDetermine if there's a misconfiguration with Microsoft Defender Antivirus, endpoint detection and response, attack surface reduction (ASR) rules, or controlled folder access (CFA). Use information in the Microsoft Defender portal or on the device.

    Location What to do
    The Microsoft Defender portal To help identify what's happening, take one or more of the following actions: - Investigate alerts- Use advanced hunting- View reports
    On the device To identify the issue, take one or more of the following steps: - Use performance analyzer tools- Review event logs and error codes- Check your protection history

  2. Depending on your findings about which capability is causing the unwanted behavior, you might take one or more of the following actions:

    Tamper protection affects whether exclusionsyou can be modifiedmodify or added.add exclusions. See What happens when tamper protection is turned on.

  3. Verify that your changes addressed the issue.

Examples of unwanted behaviors

An app is detected by Microsoft Defender Antivirus when the application runs

In this scenario, whenever a user runs a certain application, Defender Antivirus detects the application is detected by Microsoft Defender Antivirus as a potential threat.

How to address: Create an "allow" indicator for Microsoft Defender for Endpoint. For example, you can create an "allow" indicator for a file, such as an executable. See Create indicators for files.

A custom, self-signed app is detected by Microsoft Defender Antivirus when the application runs

In this scenario, Microsoft Defender Antivirus detects a custom app as a potential threat. The app is updated periodically and is self-signed.

How to address: Create "allow" indicators for certificates or files. See the following articles:

A custom app accesses a set of file types that is detected as malicious when the application runs

In this scenario, a custom app accesses a set of file types, and Defender Antivirus detects the set is detected as malicious by Microsoft Defender Antivirus whenever the application runs.

How to observe: When the application is running, behavior monitoring in Microsoft Defender Antivirus detects it.

An app is considered a potentially unwanted application (PUA)

In this scenario, an app is detected as PUA,a potentially unwanted application (PUA), and you want to allow it to run.

How to address: Define an exclusion for the app. See the following articles:

In this scenario, a legitimate app is blocked from writing to folders that are protected by controlled folder access.

How to address: Add the app to the "allowed" list for controlled folder access. See Allow apps to modify files in protected folders.

A third-party app is detected as malicious by Microsoft Defender Antivirus

In this scenario, Defender Antivirus detects a third-party app that isn't a threat is detected and identified as malicious by Microsoft Defender Antivirus.malicious.

How to address: Submit the app to Microsoft for analysis. See How do I submit a file to Microsoft for analysis?.

An app is incorrectly detected and identified as malicious by Defender for Endpoint

In this scenario, an attack surface reduction (ASR) rule in Defender Antivirus detects a legitimate app is detected and identified as malicious by an attack surface reduction (ASR) rule in Microsoft Defender Antivirus.malicious. The ASR rule Block JavaScript or VBScript from launching downloaded executable content blocks any downloaded content when the user tries to use the app.

To learn how to view ASR rule detections in Defender for Endpoint, see Monitor attack surface reduction (ASR) rule activity.

How to address:

Use the Attack surface reduction rules report to see the detections, affected devices, and affected files. In particular, youYou can download the full file and path information for the affected files to exclude from the ASR rule on the Add exclusions tab of the report.

To learn how to configure ASR rule exclusions, see File and folder exclusions for ASR rules.

To learn how to view ASR rule detections in Defender for Endpoint, see Monitor attack surface reduction (ASR) rule activity.

How to address:

Use the Attack surface reduction rules report to see the detections, affected devices, and affected files. In particular, youYou can download the full file and path information for the affected files to exclude from the ASR rule on the Add exclusions tab of the report.

To learn how to configure ASR rule exclusions, see File and folder exclusions for ASR rules. \ No newline at end of file