Mac Resources
Email and collaboration
The page author metadata changed from paulinbar/painbar to limwainstein. The uninstall guidance continues to direct administrators to the Offboard Mac devices documentation for cleanup requirements.
Product
Microsoft Defender for Endpoint
Track documentation and Message Center changes for Microsoft Defender for Endpoint.
Microsoft Learn documentation ↗Latest Microsoft Defender for Endpoint changes
Microsoft Defender Antivirus Windows
Endpoint protection
The Windows Defender Antivirus documentation now lists `DefenderSessionHelper.exe` in the Details tab for Microsoft Defender Clipboard Protection, with Processes and Services marked N/A. The page date and reviewer metadata were also updated.
Microsoft Defender Endpoint Releases
Endpoint protection
The macOS 101.26082.0012 release adds EDR support for configuring AI agent runtime protection, plus Bluetooth permission and antivirus health reporting improvements, accessibility updates, reliability fixes, and performance fixes.
Offboard Machines
Endpoint protection
The documentation now covers Windows, Linux client and server, macOS, Android, and iOS offboarding. It also distinguishes subscription-wide Azure server offboarding from manual individual-server offboarding and clarifies that offboarding does not uninstall software.
Onboard Server
Architecture and deployment
The server onboarding page now links to `offboard-machines` instead of the `#offboard-servers` fragment.
Whats New In Microsoft Defender Endpoint
Endpoint protection
The Defender for Endpoint What's New page now lists macOS release version 20.126082.12.0 as GA and links to its enhancements and features.
Azure Server Integration
Endpoint protection
The page now links new deployments to server onboarding guidance and on-premises server connections to Defender for Servers, including automatic or manual deployment options and onboarding verification.
Microsoft Defender Endpoint Releases
Endpoint protection
The documentation now lists Linux release 101.26091.0003, including updated release, engine, and signature versions. It also documents a libcurl 8.22.0 upgrade addressing CVE-2026-9546 and stronger quarantine authorization and path protections.
Offboard Machines
Endpoint protection
The article now distinguishes automatic Azure offboarding, Defender for Servers coverage changes, manual endpoint offboarding, and endpoint software removal. It adds preparation steps, verification guidance, package-handling details, and method-specific procedures for Linux and Windows.
Onboard servers to Microsoft Defender - Microsoft Defender for Endpoint | Microsoft Learn
Architecture and deployment
The guide now distinguishes automatic onboarding, manual deployment, and servers already reporting to Defender for Endpoint. It adds prerequisites, rollout preparation guidance, antivirus coexistence considerations, and a warning that Direct onboarding has tenant-wide scope.
Android Mobile Threat Defense Role
Endpoint protection
The documentation now clarifies that the mobile threat defense connector is the Defender for Endpoint–Intune integration, separates assignment steps, and refers to the automatic-launch control as a switch.
Configure Microsoft Defender for Endpoint on Android - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page now lists supported Defender configuration areas, clarifies the onboarding and Managed Google Play prerequisites, and updates the Intune policy creation link and wording.
Microsoft Defender for Endpoint on Android - Privacy Information - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page revises privacy wording, terminology, punctuation, and descriptions of collected data. The required-data list no longer includes basic browser information.
Troubleshoot Issues on Microsoft Defender for Endpoint on Android - Microsoft Defender for Endpoint | Microsoft Learn
Troubleshooting
The page now more clearly highlights Android onboarding and Xiaomi Permanent Protection issues, and refines instructions for updating Microsoft Authenticator. Wording, screenshots, links, and formatting were also refreshed.
User Experiences in Microsoft Defender for Endpoint on Android - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page now describes the refreshed Android interface, including dashboards, feature tiles, alert cards, and the Device Protection feature card. It also clarifies the separate feedback and log-submission flows and updates screenshot descriptions, wording, and formatting.
Microsoft Defender Endpoint Releases
Endpoint protection
The documentation adds Platform 4.18.26090.9, Engine 1.1.26090.9, and security intelligence 1.461.1.0 release details, including automatic protection-engine refresh, improved update reliability, ASR path handling, and policy-exclusion retention.
Anti-malware Scan Interface Integration with Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The article title, metadata links, and wording were updated. Examples of fileless-malware techniques were rephrased, and the PowerShell guidance paragraph was removed.
Configure Microsoft Defender for Endpoint on Android Using MAM - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page updates headings, links, portal navigation wording, and instructions for connecting Defender for Endpoint to Intune and creating Android app protection policies.
Provide Feedback on the Microsoft Defender for Endpoint Client Analyzer Tool - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The Client Analyzer feedback page now uses direct links to the Microsoft Defender portal and centralized feedback platform, with minor title and wording updates.
Understand the Client Analyzer HTML Report - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page title and description were refined, screenshot captions now describe each image, and wording and punctuation were clarified throughout the report guidance.
View and Organize the Microsoft Defender for Endpoint Alerts Queue - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page received wording, formatting, and accessibility edits. It clarifies when automated investigation and remediation can start, links to its overview, refines alert-severity descriptions, and updates the screenshot text.
Whats New In Microsoft Defender Endpoint
Endpoint protection
The October 2026 entry replaces the previous Preview listing for vulnerability assessment of applications installed via the Microsoft Store, including Microsoft Teams.
Access the Microsoft Defender XDR MSSP Customer Portal - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page updates capitalization, expands MSSP to “Managed Security Service Provider,” refines wording, and adds metadata links. The tenant-specific portal URL and access instructions remain documented.
Address Unwanted Behaviors in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The article received clearer wording, standardized terminology and formatting, revised examples, and updated link text.
Advanced Technologies at the Core of Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page title and description were refined, and explanations of real-time protection, hybrid detection, cloud protection, and detection engines were reworded for clarity. The description now highlights client and cloud engines, machine learning, and behavior monitoring.
Aggregated Reporting in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page updates heading capitalization, formats navigation paths and code blocks, and restructures the supported operating systems section for clearer presentation.
AI Agent Runtime Protection with Microsoft Defender for Endpoint (Preview) - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page title was capitalized consistently, explanatory text was split for readability, and the two inspection approaches—Agent-native event inspection and Network inspection—are now named explicitly.
Alerts Queue in Microsoft Defender - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page title capitalization changed, its description now covers viewing, organizing, and managing alerts and investigating threats involving devices, files, and users, and its metadata links were updated.
Configure Advanced Features in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page was updated with revised metadata, clearer On/Off selection steps, an endpoint screenshot, and added guidance explaining that scoped device group correlation can produce separate incidents for Global SOC users.
Submit Files in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The article refreshes terminology, links, permission formatting, navigation instructions, and screenshots for submitting files and file hashes through the Defender portal.
Machine Tags
Endpoint protection
The documentation now clarifies that the DeviceTagging registry key supports only one tag in the Group value. Tags assigned through other methods aren't written there, so the registry value may not show all tags on a device.
Mobile Resources Defender Endpoint
Endpoint protection
The documentation now lists onboarding, security reporting, and iOS TVM as Mobile TVM service uses. It also warns that restrictive Conditional Access policies can disrupt these flows and recommends excluding the service from those policies.
Mtd
Endpoint protection
The article now lists firewall and proxy URLs needed to onboard and maintain Microsoft Defender for Endpoint devices on Android and iOS, covering commercial and US Government cloud environments.
Ai Agent Runtime Protection Overview
Endpoint protection
The article now uses broader descriptions of inspection points, streamlines explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.
Discover local AI agents with Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The documentation states that Defender surfaces supported AI agents and MCP servers after observing activity on onboarded devices. An installed agent may not appear until it becomes active; the guidance also adds comparing query results with the discovery support matrix.
Local Agent Discovery Overview
Endpoint protection
The documentation now states that Defender lists a local AI agent after observing activity on an onboarded device; installation alone does not guarantee discovery. It also clarifies that the inventory is not a complete software inventory and references the support matrix for coverage details.
Microsoft Defender for Endpoint AI agent support matrix - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
A new Learn article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.
Microsoft Defender Endpoint Releases
Endpoint protection
The release page now lists Android version 1.0.9330.0101, released September 30, 2026, with performance improvements and general bug fixes.
Offboard Machines
Endpoint protection
The documentation explains that disabling Defender for Servers automatically offboards eligible servers. It also describes exclusions, processing times, verification, retry behavior, and what happens when the plan is re-enabled.
The new Defender server security experience - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers. It covers server asset views, investigations, hunting, RBAC, and device groups.
Troubleshoot Collect Support Log
Troubleshooting
The guidance replaces manual analyzer download steps with self-contained binary or Python Live Response action pairs. It adds package validation, workspace-ID handoff, explicit prerequisites, HTTPS requirements, and a local-workflow alternative for devices without Microsoft endpoint access.
Wait for cloud-init to finish provisioning, including setting the hostname.
Endpoint protection
The Linux deployment article now explains how to embed the tenant-specific onboarding file in a golden image, keep `mdatp` stopped during image creation, and start Defender on clones only after their final hostname is set. It also adds onboarding and health verification steps.
Whats New In Microsoft Defender Endpoint
Endpoint protection
The Defender Endpoint What's New entry now links to the preview-specific Microsoft Store applications section.
Microsoft Defender Endpoint Releases
Endpoint protection
The documentation now covers centrally scheduled Linux antivirus scans through managed JSON and Defender Portal policies, expanded detection of critical Node.js, Python, and Java libraries, a libcurl 8.20.0 security update, and Windows Antivirus August 2026-2 details and fixes.
Secure Controlled Configuration
Endpoint protection
The documented device requirement now includes Windows Server 2022 and Windows Server 2025. The local exclusion guidance also clarifies that local administrator-defined antivirus exclusions are not honored by default and can be enabled through Defender or Intune policy.
Configuration protection in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Endpoint protection
The page title, description, headings, tables, and references now use “Configuration protection” instead of “Controlled configuration.” The documented enforcement behavior and rules were correspondingly renamed.
Mde Plugin Wsl
Endpoint protection
The documented installer changes to version 2.26.921.1. The page also expands guidance for identifying Windows hosts, classic WSL devices, and WSL container devices in the Defender portal, and updates the screenshot and setup instructions.
Whats New In Microsoft Defender Endpoint
Endpoint protection
The documentation now lists support for WSL containers (WSLc), extending Defender for Endpoint protection to WSLc workloads and providing visibility into their activity.
Microsoft Defender Endpoint Releases
Endpoint protection
Cloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices. SIGILL crashes on processors without SSE4.1 support were fixed, along with general reliability improvements.
Linux Preferences
Endpoint protection
The superscript asterisk was removed from the `nfs4` entry in the Linux preferences documentation.
Mde Linux Prerequisites
Endpoint protection
The filesystem entries on the Linux prerequisites page were redistributed between the two table columns; the listed entries remain unchanged.
Address false positives/negatives in Microsoft Defender for Endpoint
Endpoint protection
The article now provides workflows for identifying detection sources, classifying and suppressing alerts, reviewing remediation, configuring exclusions, submitting files, and investigating suspected false negatives. Definitions, response guidance, links, and metadata were also updated.
Address Unwanted Behaviors Mde
Endpoint protection
The page now emphasizes identifying the capability causing unwanted behavior and uses clearer links for viewing ASR detections and configuring exclusions. Documentation metadata was also updated.
Adv Tech Of Mdav
Endpoint protection
The documentation now links the “industry-best” detection and blocking statement to the Defender XDR top-scoring industry tests page.
Amsi On Mdav
Endpoint protection
The AMSI on Microsoft Defender Antivirus article now points to the updated App Control for Business and AppLocker overview path.
Android Mobile Threat Defense (MTD) Role for Microsoft Defender for Endpoint
Endpoint protection
The new documentation explains how Intune can assign Microsoft Defender for Endpoint as the Android Enterprise Mobile Threat Defense application. The role helps block force-stop and app-data clearing, and automatically exempts Defender from battery optimization on Android 14 and later. It lists prerequisites and supports COBO and COPE enrollment scenarios.
Android New Ux
Endpoint protection
The Android documentation now links to the specific Network protection configuration section when explaining where related events can be viewed.
Android Privacy
Endpoint protection
The Android privacy documentation now links to a revised Microsoft Defender for Endpoint privacy article for Android and iOS.
Assess Devices
Endpoint protection
The page now lists licensing, onboarding, and portal-permission prerequisites. It also updates queries for identifying unmanaged devices, their discovering onboarded devices, and recent network connections.
Assign Microsoft Defender for Endpoint basic permissions
Endpoint protection
The article now states that basic permissions are for existing Defender for Endpoint customers, with full access assigned through Security Administrator and read-only access through Security Reader. It also adds Microsoft Graph PowerShell role and delegated-permission prerequisites and notes that new customers use unified RBAC.
Attack Surface Reduction Overview
Vulnerabilities and exposure
The Attack Surface Reduction overview now uses revised links for Microsoft Defender Application Guard, WDAC, and Windows Firewall documentation.
Attack Surface Reduction Rules Configure
Vulnerabilities and exposure
The page now details precedence among local settings, Group Policy, MDM, and Configuration Manager, including the MDMWinsOverGP setting and OMA-URI. It also updates Intune navigation and explains per-rule exclusions.
Attack Surface Reduction Rules Overview
Vulnerabilities and exposure
Starting with platform version 4.18.26060, using the Unblock option to override an ASR rule in Warn mode requires administrator approval. Per-ASR rule exclusions should be used for persistent exceptions.
Attack Surface Reduction Rules Reference
Vulnerabilities and exposure
Three ASR rule entries now use relative links to the cloud-delivered protection documentation.
Automated Investigations
Endpoint protection
The page now uses updated Microsoft Support URLs for the Windows 10 KB4493441 and KB4493464 references and a local link for PUA protection.
Automation Levels
Endpoint protection
The table entry describing the No automated response (no automation) level was revised.
Behavior monitoring in Microsoft Defender Antivirus
Endpoint protection
The article now explains real-time detection, dynamic analysis, response and remediation, and identifies Antimalware and Network protection features that depend on behavior monitoring. It also updates configuration-tool guidance and adds verification and performance-troubleshooting context.
Client Analyzer
Identity protection
The client analyzer overview now links unexpected Endpoint Data Loss Prevention behavior to the `/purview/endpoint-dlp-learn-about` page instead of the previous `/microsoft-365/compliance/endpoint-dlp-learn-about` path.
Cloud Protection Microsoft Antivirus Sample Submission
Endpoint protection
The page was updated with synchronization and formatting changes while retaining the existing guidance on cloud analysis, sample-submission options, and data handling.
Collect Diagnostic Data
Endpoint protection
The investigation package guidance now links to the collection instructions using the relative `respond-machine-alerts.md` path and anchor.
Configure advanced features in Microsoft Defender for Endpoint
Endpoint protection
The article now lists key advanced features, adds clearer enable/disable instructions, and refines guidance for EDR in block mode, file blocking, and duplicate device records. Metadata was also updated.
Configure and run antivirus scans with Microsoft Defender for Endpoint on Linux
Endpoint protection
The documentation now says users need at least Alerts (manage) permission in the Defender portal before beginning. It also simplifies scan performance guidance and clarifies passive-mode wording.
Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
Endpoint protection
The article now includes an mdatp_managed.json example and expanded CLI examples for adding and removing extension, file, folder, and process exclusions. It also clarifies the difference between antivirus (epp) and global exclusions, including their EDR impact.
Configure and validate exclusions for Microsoft Defender for Endpoint on macOS
Endpoint protection
The page updates metadata and wording, removes the mitigation decision table and post-exclusion performance comparison guidance, and clarifies EICAR testing and threat allow-list commands.
Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint
Endpoint protection
The article now links to the current Defender for Endpoint overview, uses clearer wording for remediated threats, and introduces the steps for configuring device groups and automation levels in the Defender portal.
Configure block at first sight in Microsoft Defender Antivirus
Endpoint protection
The article now explains how block at first sight works, lists its required conditions—cloud protection, automatic sample submission, and current Defender updates—and documents coverage for downloaded executable and nonportable files. It also adds Configuration Manager to the supported management tools and includes updated links and visuals.
Configure Conditional Access
Endpoint protection
The article now explicitly describes enabling Conditional Access for Microsoft Defender for Endpoint with Microsoft Intune and Microsoft Entra ID, and refers to the Microsoft Defender for Endpoint compliance policy evaluation integration. The page date and authoring metadata were also updated.
Configure Device Discovery
Endpoint protection
The page updates wording for customizing standard discovery and monitoring networks, and adds a direct link to the Monitored networks section for the advanced hunting query.
Configure device proxy connectivity to the Defender for Endpoint service
Endpoint protection
The article now lists both required Group Policy settings by name, identifies the WinHTTP proxy command’s scope, and explains that resetting it removes the proxy and returns to direct connectivity.
Configure Dynamic Preview Rings for Microsoft Defender on mobile
Endpoint protection
Administrators can use Intune app configuration policies and the `DefenderPreview` key to enable preview functionality in the production Microsoft Defender mobile app for selected Android and iOS users.
Configure Endpoints Gp
Endpoint protection
The Central Store for Group Policy Administrative Templates link now points to the Microsoft Learn troubleshooting page.
Configure Endpoints Sccm
Endpoint protection
The network protection prerequisite now links to a different support article for obtaining the antimalware platform update.
Configure local overrides for Microsoft Defender Antivirus settings
Endpoint protection
The article now states that Group Policy is the only supported method for configuring local override policies. It clarifies the configuration steps, supported tools for users, and local-versus-global exclusion list merge behavior.
Configure Microsoft Defender Antivirus always-on protection
Endpoint protection
The page now focuses on configuring always-on protection, identifies supported management tools, adds Intune and Configuration Manager prerequisites, and updates the Intune procedure and links.
Configure Microsoft Defender Antivirus cloud block time-out
Endpoint protection
The article now clarifies the 10-second default, 50-second extension limit, required prerequisites, Windows Server notes, and the Microsoft Intune Antivirus policy configuration path.
Configure Microsoft Defender Antivirus notifications that appear on endpoints
Endpoint protection
The article now provides clearer GPMC navigation, updated links, the full policy path, guidance for older Windows policy names, and instructions for configuring the setting locally with Local Group Policy Editor.
Configure Microsoft Defender Antivirus on a remote desktop or virtual desktop infrastructure environment
Endpoint protection
The documentation now provides separate Group Policy and Intune configurations for running a quick scan after a VM misses two consecutive scheduled scans, and notes that catch-up scans use additional CPU.
Configure Microsoft Defender Antivirus scanning options
Endpoint protection
The article now links to newer Windows 10 and Windows 11 Group Policy reference spreadsheets, provides expanded GPMC navigation and setting-edit steps, and adds guidance for Local Group Policy and legacy policy names.
Configure Microsoft Defender Antivirus using Microsoft Intune
Endpoint protection
The documentation now describes creating antivirus policies in Intune, adds Windows Server devices managed through Defender for Endpoint security settings management, and notes that Windows 10 support is not guaranteed after October 14, 2025.
Configure Microsoft Defender for Cloud Apps in Microsoft Defender for Endpoint
Endpoint protection
The page metadata was updated, and the instructions now more clearly state that enabling Microsoft Defender for Cloud Apps integration allows Defender for Endpoint to use cloud app discovery signals and begin forwarding them immediately.
Configure Microsoft Defender for Endpoint on Android
Endpoint protection
The guide was retitled and restructured. It now covers protection, privacy, file scanning, device tagging, vulnerability assessment, sign-out controls, custom indicators, and web protection through Microsoft Intune, with updated licensing and platform-limit details.
Configure Microsoft Defender for Endpoint on Android risk signals using App Protection Policies (MAM)
Endpoint protection
The documentation now describes scanning documents, archives, and scripts in addition to APKs, with Intune Managed apps configuration steps. It also clarifies support for enrolled and unenrolled devices.
Configure Microsoft Defender for Endpoint on Linux for static proxy discovery
Endpoint protection
The documentation now explains proxy handling for Linux package managers, distinguishes global settings from command-only settings, and clarifies runtime proxy configuration through the mdatp CLI or managed JSON configuration.
Configure Network Connections Microsoft Defender Antivirus
Endpoint protection
The article now explicitly covers cloud-delivered protection, provides more specific ValidateMapsConnection, MAPS, certificate/TLS, timeout, and proxy/CRL troubleshooting guidance, and updates related links and headings.
Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux
Endpoint protection
Starting with release 101.26062.0005, Defender for Endpoint on Linux verifies the antivirus engine signature before loading it. The offlineDefinitionUpdateVerifySig setting is deprecated and no longer has any effect.
Configure offline security intelligence updates for Microsoft Defender for Endpoint on macOS
Endpoint protection
The article now lists key prerequisites, clarifies the mirror-server and macOS update flows, improves script descriptions and links, and explains how to verify the configured offline update source.
Configure remediation for Microsoft Defender Antivirus detections
Email and collaboration
The article adds specific steps for configuring Microsoft Defender Antivirus remediation settings through Intune and the Microsoft Defender portal, including policy type, platform, template, and configuration settings.
Configure security settings in Microsoft Defender for Endpoint on Linux
Endpoint protection
The article now documents four antivirus enforcement levels, including audit mode (Preview), states that passive is the default, and adds a command to verify the active level. Audit mode requires Defender for Endpoint version 101.26062.0007 or later.
Configure vulnerability email notifications in Microsoft Defender for Endpoint
Endpoint protection
The documentation refreshes notification and RBAC descriptions, clarifies portal links, and separates permission prerequisites for editing and deleting rules from the procedure steps.
Controlled configuration in Microsoft Defender for Endpoint
Endpoint protection
The new article describes cloud-managed Defender Antivirus policy as the authoritative configuration source, overriding Group Policy, scripts, Configuration Manager, and local changes. It lists prerequisites, supported platforms, covered settings, exclusions, and enforcement behavior.
Controlled Folder Access Configure
Endpoint protection
The article now lists the Intune navigation path, policy type, platform, profile, CFA settings, and Add/Import examples for protected folders and allowed applications.
Controlled Folder Access Overview
Endpoint protection
The article now points to an updated Windows Security Protection History URL and removes the Microsoft Volume Licensing Reference Guide link.
Create a custom gradual rollout process for Microsoft Defender updates
Endpoint protection
The documentation now specifies Windows devices and Microsoft Defender Antivirus platform version 4.18.2106.6 or later, revises the rollout channel descriptions and policy paths, and warns that MDM and Group Policy settings can conflict for Defender settings.
Create an app to access Microsoft Defender for Endpoint without a user
Endpoint protection
The article now provides clearer steps for app registration, app permissions, OAuth 2.0 client credentials authentication, consent, token retrieval and validation, and authenticated API requests.
Create and manage custom data collection rules in Microsoft Defender for Endpoint
Endpoint protection
The article now explains that custom rules capture endpoint events beyond default telemetry and send them to Microsoft Sentinel. It also adds clearer guidance for querying custom event tables, monitoring performance, editing rules, and enabling or disabling them.
Create and manage device groups in Microsoft Defender for Endpoint
Endpoint protection
The guidance now specifies that assigned Microsoft Entra groups must already have RBAC roles. It also clarifies matching conditions and notes that configuration changes may take several hours to propagate.
Create file indicators in Microsoft Defender for Endpoint
Endpoint protection
The page title, Windows Server onboarding wording, scan guidance, preview section text, headings, anchors, and related-content label were updated.
Create indicators for certificates in Microsoft Defender for Endpoint
Endpoint protection
The article now explicitly explains creating certificate-based indicators to allow or block signed applications, adds steps from the Settings page, updates the cloud protection link, identifies the Microsoft Defender for Endpoint evaluation pipeline, and expands the IoC wording.
Create indicators for IPs and URLs/domains
Endpoint protection
The documentation now uses a local link, updates the URL precedence example, clarifies network protection logging, and restates that policy changes can take up to 48 hours to apply, usually under two hours.
Create Power BI reports with Microsoft Defender for Endpoint APIs
Endpoint protection
The article was retitled and its instructions now explain how to connect Power BI to the Advanced Hunting API and OData API, including what each example query retrieves.
Customize exploit protection
Endpoint protection
The article updates Windows Security and PowerShell instructions, clarifies the `-System` scope and `-Remove` behavior, and explains that audit-only ACG monitoring logs policy violations without blocking execution.
Data Collection Analyzer
Endpoint protection
The data collection analyzer table now uses updated links for MpCmdRun.exe and Endpoint DLP, and the -v entry includes additional troubleshooting examples such as Cloud Protection reporting and Platform Update failures.
Defender Deployment Tool Windows
Endpoint protection
The Windows deployment-tool page now includes the streamlined connectivity SSL inspection requirement and replaces DefenderDTconfig.txt with MdeConfig.txt/MDEConfig.txt in its instructions. Prerequisite links were also refreshed.
Defender Endpoint Demonstration App Reputation
Endpoint protection
The demonstration app reputation article now links to the updated Microsoft Defender SmartScreen documentation path.
Defender Endpoint Demonstration Attack Surface Reduction Rules
Vulnerabilities and exposure
The documentation now warns that the setup script excludes `c:\demo` from Microsoft Defender Antivirus scanning. Administrators must copy ASR test files to a folder not excluded by Defender Antivirus or ASR rules before opening or running them, then delete the copies afterward.
Defender Endpoint Demonstration Controlled Folder Access Ransomware
Endpoint protection
The instructions now explain that the setup script excludes c:\demo from Microsoft Defender Antivirus. They direct users to run the test file from a nonexcluded folder when testing for a CFA block or detection, and clarify where to run and delete copies afterward.
Defender Endpoint Demonstration Smartscreen Url Reputation
Endpoint protection
The article’s two links to Microsoft Defender SmartScreen documentation now use the updated documentation path.
Defender Endpoint Exclusions Common Mistakes
Endpoint protection
The documentation now links to a different Microsoft Support page for folders that should be excluded when using file-level antivirus protection in SharePoint.
Defender Endpoint Plan 1
Architecture and deployment
The page adds licensing details for standalone, Microsoft 365 E3, and server deployments, and updates links for Windows Firewall and Application Control documentation.
Defender Endpoint Trial User Guide
Endpoint protection
The guide’s date and custom metadata were updated, and wording for configuring capabilities and running detection tests was revised.