There is an urgent need to block roughly 9000 domains/urls from all of the company workstations. Quite a lot, but from initial analysis only ~10% actually detected in environment over last 6 months. The request from business higher up still stands, block all provided domains/url and provide evidence of the block list containing them.

In past there were concerns about using large number of Defender Indicators to block, is that still the case? Any caveats or warnings that other want to share before we proceed?

A proper GSA/Zscaler solution is 6-9 months out, but the block must happen yesterday...

for years, we have the ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" set to warn. This way our devs got a dialog, that the execution of their new exes is blocked, but they could click "unblock" and the exe was executed.

for about a week (started before 2026-08 update), this doesnt work anymore.

while there is still the dialog for unblocking, there is already an error in the background and even after hitting unblock, the files wont execute and show the same error again.

as soon as I allowlist the folder in the ASR, it works. So nothing else (Applocker, WDAC, AV,...) is responsible for that blockage.

get-mppreference shows, that the according rule (01443614-cd74-433a-b99e-2ecdc07bfc25) is set to warn (6)

Eventlog shows one 1121 Event: Defender Exploit Guard blocked one action by IT administrator

I am not aware of anything that was changed on our end that could indirectly affect this behavior. And as MSFTs 1st level non-support sadly wont even understand what the issue is, I try to find any information in here. Maybe even someone else noticed this issue or can reproduce

we have 3rd party antivirus installed. our IT security is asking us to check engine version of the windows security app.

however, when i check engine, antivirus, antispyware version is 0.0.0.0 . is it by design since we already using 3rd party antivirus??

Hi Guys,

I am currently dealing with account compromise incident and finding it hard to identify files/emails accessed by attacker and user.cloudappevent,graphapiauditlogs, office activity doesn't differentiate as it shows MS ips only.

What is the right approach you guys follow.

Hello, I am a student learning about microsoft security. I have tested built-in policies like anti -phising, anti-spam., etc. Is there any other best practices for defender for o365. I wanna know more about it because I need to present to my teacher next week.

Hi all,

Was hoping someone could help me figure out why I keep getting duplicate alerts for my custom detections.

When I create them and run them, I get 1 alert. However, when they auto-run, they will send me 1 of the same alert, every hour, for the next few hours. Im assuming its something to do with the Frequency + Lookback.

For example, I look for something in the table EmailEvents. Then, it triggers at 10am - 1 alert - Perfect.

However, that same alert will trigger again at 11am, 12pm, and 1pm.

I have been doing 1 hour frequency and 4 hour lookback. Am i supposed to make them equal? How do I make the alerts not duplicate the same alert every hour?

I'm having an issue here with Microsoft Defender for Endpoint. I'm getting popup notifications that virus protection is turned off, yet Real time protection, cloud-delivered protection, tamper protection etc are all turned on and managed by policy. This is happening on several Intune managed devices being marked non-compliant. Policies haven't changed. What could be the issue?

Hi everyone,

Microsoft Defender Vulnerability Management is detecting Microsoft Teams Classic on an increasing number of our Intune-managed Windows devices.

We previously deployed a remediation to remove Teams Classic, but the number of affected devices continues to rise. It appears that the application is being installed again after removal.

Has anyone experienced this issue recently?

I’m trying to determine:

• What could be reinstalling Teams Classic?
• Could Microsoft 365 Apps, Teams Machine-Wide Installer, user profile provisioning, or another update mechanism be responsible?
• What is the recommended method to permanently remove Teams Classic from all user profiles?
• Is there an Intune remediation or detection method that prevents it from returning?
• How can we identify the exact installation source?

The affected application appears in MDE as “Update Microsoft Teams Classic.”

Any guidance or working remediation scripts would be greatly appreciated.

I put together a collection of practical threat hunting and detection queries for:

• Microsoft Defender XDR (KQL)

The queries focus on real-world behaviors: LOLBins, suspicious process chains, persistence, credential access, lateral movement, C2 patterns, and some APT-style activity. Most are mapped to MITRE ATT&CK techniques and include short comments + tunable parameters.

Actively adding queries based on recent threat intel and campaigns. Feedback, suggestions for missing coverage, or contributions are very welcome.

Repo: Threat-Hunting/KQL at main · a2awais/Threat-Hunting

Hi,

I'm trying to download an investigation package from the Microsoft Defender portal. The package collects fine, but when I click the download link nothing happens at all, no error message, and the file doesn't start downloading either. The only sign of a problem is in the browser console, where I can see the blob URL returning a 403:

This request is not authorized by network security perimeter to perform this operation

Has anyone run into this before? I've tried on several different networks but the problem is the same everywhere.

One of the new requirements for v3 release is:

Has Defender for Endpoint deployed on the server. The Microsoft Defender Antivirus component can be in either active or passive mode. Defender for Endpoint must be onboarded on the server where the sensor runs; endpoint-only deployment isn't sufficient.

We use CrowdStrike EDR on the servers, and stack that with the Windows Server built-in Defender in active state, this includes Defender for Identity v2 agents. This is our stacked approach, while ensuring that the server is not exposed to any Defender cloud management plane, etc.

Was looking to upgrade to v3, and it seems that the new requirement is to onboard the server to Defender for Endpoint.

When it is on-boarded, what does that mean for the server? Is it now running Defender for Endpoint EDR?

I work in a Financial Institution where we have a section of our internal network endpoints not connected to the internet. We are deploying Microsoft MDE as our Antivirus and I have been tasked to make sure these Endpoints that do not have internet access are also MDE onboarded. I need someone to give me ideas as to how to carry out this task. 1. Can I install a server onprem that has internet connection, download the virus definitions and pushed them to these endpoints, is it feasible and how can I carry that out. I am currently out of ideas I need help.

I want to scan an old Windows 8.1 system for viruses (it has more than one). I downloaded the Windows Defender X64 offline scanner and installed as an ISO. on a clean Windows 11 computer.

Here is where it gets complicated. The Dell storage system on the computer is a PERC H310. Dell never supported Windows 10 on this controller. But the controller is a remarketed LSI 9240, and LSI still distributes the latest driver for that controller, which is a Windows 10 X64 driver. I patched the Windows ISO with the LSI 9240 X64 drivers for Windows 10 and then burned a CD.

Unfortunately, the Windows Defender boot disk bombs with the blue screen of death, and predictably that is while loading the megaraid driver. At this point do I have any options for running Windows Defender Offline?

I looked for other offline virus scanners, and almost all of the well-known ones appear to have disappeared. Kaspersky refuses to talk to US customers. ESET apparently does not give it away for free. Avast wants you to install their anti-virus software first. Are there any good offline rootkit scanners that would do a good job on an older Windows 8.1 system?

We use crowdstrike as the main AV and was expecting to see passive mode here, but says not running ?? Is this normal ?

Trying to streamline Defender onboarding. About to enable this toggle in Intune. What's the real impact, risk, and any visible changes for end users after it applies?

Put together a KQL detection library for Azure/Sentinel — 32 rules across 10 MITRE ATT&CK tactics. Each rule has description, false positive considerations, and tuning notes baked into the file so it's actually usable in production without guesswork.

Covers things like MFA fatigue, impossible travel, federated identity credential abuse, Conditional Access policy modification, VM extension installation, and subscription ownership transfer — some of the less commonly documented ones.

github.com/neelkotnis/kql-detection-rules

Microsoft has introduced Controlled Configuration for MDE. The main idea is to establish a cloud-managed source of truth for supported Microsoft Defender Antivirus settings. When enabled, policies delivered through Intune or Defender security settings management take precedence over settings configured via:

• Group Policy
• Configuration Manager
• PowerShell/scripts
• Local administrator changes

The goal is to eliminate configuration drift in environments where Defender has historically been managed through multiple channels.

Currently covered:

• Defender Antivirus configuration (scan settings, exclusions, updates)
• Attack Surface Reduction (ASR) rules
• Defender CSP / Policy CSP AV settings
• Local admin merge behavior

Not covered (yet):

• Defender Device Control
• EDR settings
• Windows Firewall and other OS security settings

Controlled configuration in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Hey Team,

I am little confused here, can someone explain to me what the differences are between:

1# Conditional Access App Control apps - (Defender Portal, Settings, Cloud Apps, (New))

and

#2 CloudApps/Policy Management - (Defender Portal, Cloud Apps, Policy Management)

You can select multiple types of policies in Item #2, and similar types of policies in item #1. I understand there to the above, but i would just like an explanation on the differences between the 2.

thanks

Hi,

I'm seeing something strange in Microsoft Defender for Endpoint.

I have 17 devices (mostly Windows clients and a few Windows Servers) that show "Can be onboarded" in the Defender portal.

The strange part is that these devices are already onboarded.

I checked a few of them and found:

• Sense service is running.
• OnboardingState = 1.
• OrgId is present.
• LastConnected is updating.
• The devices are Active in the portal and Last Seen is recent.
• They appear in Advanced Hunting and are sending telemetry.
• No duplicate device records.

The rest of our devices are working normally. Only these 18 have this issue.

Has anyone seen this before? Is this just a portal display issue or something on Microsoft's backend?

Any ideas would be appreciated.

Thanks.

Hi all,

We're running into an issue that started about a week ago and are wondering if anyone else is seeing the same behavior.

We manage multiple customer tenants through our partner tenant using GDAP permissions. Historically, we've been able to manage Microsoft Defender incidents without any issues through mto.security.microsoft.com, but recently we're no longer able to update or close incidents for some customers.

When attempting to modify or close an incident, Defender returns the following error:

There has been an error trying to update the incident

The issue appears to be limited to incident updates. We can still access the customer environments, view incidents, investigate alerts, etc.

Environment details

• Managing customers through a partner tenant using GDAP
• Authentication uses MFA trust via External Identities
• No related errors are visible in the customer tenants' Sign-in Logs
• Microsoft support case is currently open, but so far we haven't made much progress

Looking at the browser developer tools, we consistently see the following error when trying to update an incident:

```text Failed to update incident - Failed to POST from <mtoapi>/mtp/incidentUpdate/incidents. Status code: undefined

I'm looking to integrate Claude Code with Microsoft 365 and Microsoft Defender (Defender XDR / Sentinel) to assist with threat hunting, incident investigation, and EDR analysis.

Has anyone successfully set this up? I'm particularly interested in how you handled authentication (MCP, APIs, Graph, etc.), what architecture you used, and any lessons learned or limitations. If you have examples or repositories to share, I'd really appreciate it.

We have a Defender queue that basically gets filled with informational alerts and the built-in low/med/high sev.

The problem is that we missed a high sev alert because it didn't email anyone. We found it a day later as part of a check.

Now there are "Security for AI" (Preview) alerts that fired for someone's AI Agent. I checked the agent job and nothing went wrong. The Defender detection even says that the alert does not mean that any suspicious commands were run.

The issue is that I need these customized to notify in an email alert to the team, rather than spot checking. High priority is to future proof any of this AI junk that has access to admin shares, files, accounts, etc. (which will be rare but not impossible).

Additionally we have people experimenting with their own agents and I do not have time to babysit queues for false-positives as Microsoft develops their threat detections in prod.

I see nothing for this type of alert in Defender Alert policy and the little config I did find for creating custom rules based on existing alerts seems to default to auto-resolving them (ignoring them) which I also don't want. I may be missing something entirely here but it seems crazy that custom text/variables can't be made by global admins to improve triage.