Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configure Advanced Features in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

13 October 2026Doc update+27 / −24 lines

In brief

The page was updated with revised metadata, clearer On/Off selection steps, an endpoint screenshot, and added guidance explaining that scoped device group correlation can produce separate incidents for Global SOC users.

What Defender admins need to know

No action is required. Administrators configuring these settings should review the clarified correlation guidance and updated steps.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure advanced featuresAdvanced Features in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

You can configure the following Defender for Endpoint advanced features depending on the Microsoft security products in your environment.

  1. Go to the Microsoft Defender portal and sign in.
  2. In the navigation pane, select Settings > Endpoints > Advanced features.
  3. Select the advanced feature you want to configure and toggle the setting betweenselect On andor Off.
  4. Select Save preferences.

Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations.

Restrict correlation to within scoped device groups

The scoped device group correlation setting can be used for scenarios where local SOC operations would like to limit alert correlations only to device groups that they can access. When the scoped device group correlation setting is turned on, an incident composed of alerts that cross-device groups is no longer considered a single incident. The local SOC can then take action on the incident because they have access to one of the device groups involved. However, global

Global SOC sees several different incidents by device group instead of one incident. We don't recommend turning on this setting unless doing so outweighs the benefits of incident correlation across the entire organization.

Note

Automatically resolve alerts

Turn on the auto-resolve alerts setting to automatically resolve alerts where no threats were found or where detected threats were remediated. If you don't want to have alerts auto resolved, you'll need to manually turn off the feature.

Note

  • The result of the auto-resolve action may influence the Device risk level calculation which is based on the active alerts found on a device.
  • If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved", the auto-resolve capability will notdoesn't overwrite it.

Configure allow or block file settings

To turn on Allow or block files:

  1. In the Microsoft Defender portal, select Settings > Endpoints > General > Advanced features > Allow or block file.

  2. Toggle theSelect a setting betweenof On andor Off.

    a. Screenshot shows the Endpoints screen.

  3. Select Save preferences at the bottom of the page..

After you turn on this feature, you can block files from the Add Indicator tab on a file's profile page.

Hide potential duplicate device records

Configure custom network indicators

Turning on custom network indicators allows you to create indicators for IP addresses, domains, or URLs, which determine whether they'll bere allowed or blocked based on your custom indicator list.

To use this feature, devices must be running Windows 10 version 1709 or later, or Windows 11.

Note

Network protection leverages reputation services that process requests in locations that might be outside of the location you've selected for your Defender for Endpoint data.

Enable tamper protection

Enable user details display

Turn on the show user details feature so that you can see user details stored in Microsoft Entra ID.ID, when investigating user account entities. Details include a user's picture, name, title, and department information when investigating user account entities.information. You can find user account information in the following views:

  • Alert queue
  • Device details page

Configure web content filtering

Block access to websites containingthat contain unwanted content and track web activity across all domains. Before you deploy the Microsoft Defender for Endpoint security baseline, ensure network protection is in block mode. To specify the web content categories you want to block, create a web content filtering policy.

Enable the unified audit log

Search in Microsoft Purview enables your security and compliance team to view critical audit log event data to gain insight and investigate user activities. Whenever an audited activity is performed by a user or an admin,administrator, an audit record is generated and stored in the Microsoft 365 audit log for your organization. For more information, see the Search the audit log.

Enable device discovery

Helps you find unmanaged devices connected to your corporate network without the need for extra appliances or cumbersome process changes. Using onboarded devices, you can find unmanaged devices in your network and assess vulnerabilities and risks. For more information, see Device discovery.

Note

Download quarantined files

BackupBack up quarantined files in a secure and compliant location so they can be downloaded directly from quarantine. The Download file button is always available in the file page. The download quarantined files setting is turned on by default. For more information, see Download quarantined files.

Default to streamlined connectivity when onboarding devices in the Defender portal

This setting makes streamlined connectivity the default onboarding package for supported operating systems. You can still use the standard package, but you need to select it from the drop-down on the onboarding page.

Enable live response

You can integrate Defender for Endpoint with Microsoft Intune to enable device risk-based conditional access. When you configure Conditional Access, Defender for Endpoint shares device data with Intune to help enforce policies.

This integration requires Microsoft Intune. Intune is a separate product that isn't part of Microsoft Defender for Endpoint, and itEndpoint. It isn't included in all subscriptions. You need licenses that support Defender for Endpoint, Intune, and Microsoft Entra Conditional Access. For more information, see Microsoft Intune licensing and Conditional Access policy license requirements.

Important

Learn about new features in the Defender for Endpoint preview release.

Try upcoming features by turning on the preview experience. You'll can have access to upcoming features, which you can provide feedback on to help improve the overall experience before features are generally available.

If you already have preview features turned on, manage your settings from the main Defender XDR settings.

For more information, see Microsoft Defender XDR preview features.

Configure Endpoint Attack Notifications