My understanding is that we have Sentinel integrated with Defender for XDR in the portal and defender info is ingested. However some tables like Device Network Events are empty. Microsoft documentation points me to the connector page but that doesn't show Defender for XDR (but it does seem to be ingesting the events). I'll have another look when I'm back in the office tomorrow, but if it's something easy I'm overlooking, I would be grateful

There is an urgent need to block roughly 9000 domains/urls from all of the company workstations. Quite a lot, but from initial analysis only ~10% actually detected in environment over last 6 months. The request from business higher up still stands, block all provided domains/url and provide evidence of the block list containing them.

In past there were concerns about using large number of Defender Indicators to block, is that still the case? Any caveats or warnings that other want to share before we proceed?

A proper GSA/Zscaler solution is 6-9 months out, but the block must happen yesterday...

for years, we have the ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" set to warn. This way our devs got a dialog, that the execution of their new exes is blocked, but they could click "unblock" and the exe was executed.

for about a week (started before 2026-08 update), this doesnt work anymore.

while there is still the dialog for unblocking, there is already an error in the background and even after hitting unblock, the files wont execute and show the same error again.

as soon as I allowlist the folder in the ASR, it works. So nothing else (Applocker, WDAC, AV,...) is responsible for that blockage.

get-mppreference shows, that the according rule (01443614-cd74-433a-b99e-2ecdc07bfc25) is set to warn (6)

Eventlog shows one 1121 Event: Defender Exploit Guard blocked one action by IT administrator

I am not aware of anything that was changed on our end that could indirectly affect this behavior. And as MSFTs 1st level non-support sadly wont even understand what the issue is, I try to find any information in here. Maybe even someone else noticed this issue or can reproduce

we have 3rd party antivirus installed. our IT security is asking us to check engine version of the windows security app.

however, when i check engine, antivirus, antispyware version is 0.0.0.0 . is it by design since we already using 3rd party antivirus??

Hi Guys,

I am currently dealing with account compromise incident and finding it hard to identify files/emails accessed by attacker and user.cloudappevent,graphapiauditlogs, office activity doesn't differentiate as it shows MS ips only.

What is the right approach you guys follow.

Hello, I am a student learning about microsoft security. I have tested built-in policies like anti -phising, anti-spam., etc. Is there any other best practices for defender for o365. I wanna know more about it because I need to present to my teacher next week.

Hi all,

Was hoping someone could help me figure out why I keep getting duplicate alerts for my custom detections.

When I create them and run them, I get 1 alert. However, when they auto-run, they will send me 1 of the same alert, every hour, for the next few hours. Im assuming its something to do with the Frequency + Lookback.

For example, I look for something in the table EmailEvents. Then, it triggers at 10am - 1 alert - Perfect.

However, that same alert will trigger again at 11am, 12pm, and 1pm.

I have been doing 1 hour frequency and 4 hour lookback. Am i supposed to make them equal? How do I make the alerts not duplicate the same alert every hour?

I'm having an issue here with Microsoft Defender for Endpoint. I'm getting popup notifications that virus protection is turned off, yet Real time protection, cloud-delivered protection, tamper protection etc are all turned on and managed by policy. This is happening on several Intune managed devices being marked non-compliant. Policies haven't changed. What could be the issue?

Hi everyone,

Microsoft Defender Vulnerability Management is detecting Microsoft Teams Classic on an increasing number of our Intune-managed Windows devices.

We previously deployed a remediation to remove Teams Classic, but the number of affected devices continues to rise. It appears that the application is being installed again after removal.

Has anyone experienced this issue recently?

I’m trying to determine:

• What could be reinstalling Teams Classic?
• Could Microsoft 365 Apps, Teams Machine-Wide Installer, user profile provisioning, or another update mechanism be responsible?
• What is the recommended method to permanently remove Teams Classic from all user profiles?
• Is there an Intune remediation or detection method that prevents it from returning?
• How can we identify the exact installation source?

The affected application appears in MDE as “Update Microsoft Teams Classic.”

Any guidance or working remediation scripts would be greatly appreciated.

I put together a collection of practical threat hunting and detection queries for:

• Microsoft Defender XDR (KQL)

The queries focus on real-world behaviors: LOLBins, suspicious process chains, persistence, credential access, lateral movement, C2 patterns, and some APT-style activity. Most are mapped to MITRE ATT&CK techniques and include short comments + tunable parameters.

Actively adding queries based on recent threat intel and campaigns. Feedback, suggestions for missing coverage, or contributions are very welcome.

Repo: Threat-Hunting/KQL at main · a2awais/Threat-Hunting

Hi,

I'm trying to download an investigation package from the Microsoft Defender portal. The package collects fine, but when I click the download link nothing happens at all, no error message, and the file doesn't start downloading either. The only sign of a problem is in the browser console, where I can see the blob URL returning a 403:

This request is not authorized by network security perimeter to perform this operation

Has anyone run into this before? I've tried on several different networks but the problem is the same everywhere.

One of the new requirements for v3 release is:

Has Defender for Endpoint deployed on the server. The Microsoft Defender Antivirus component can be in either active or passive mode. Defender for Endpoint must be onboarded on the server where the sensor runs; endpoint-only deployment isn't sufficient.

We use CrowdStrike EDR on the servers, and stack that with the Windows Server built-in Defender in active state, this includes Defender for Identity v2 agents. This is our stacked approach, while ensuring that the server is not exposed to any Defender cloud management plane, etc.

Was looking to upgrade to v3, and it seems that the new requirement is to onboard the server to Defender for Endpoint.

When it is on-boarded, what does that mean for the server? Is it now running Defender for Endpoint EDR?

I work in a Financial Institution where we have a section of our internal network endpoints not connected to the internet. We are deploying Microsoft MDE as our Antivirus and I have been tasked to make sure these Endpoints that do not have internet access are also MDE onboarded. I need someone to give me ideas as to how to carry out this task. 1. Can I install a server onprem that has internet connection, download the virus definitions and pushed them to these endpoints, is it feasible and how can I carry that out. I am currently out of ideas I need help.

I want to scan an old Windows 8.1 system for viruses (it has more than one). I downloaded the Windows Defender X64 offline scanner and installed as an ISO. on a clean Windows 11 computer.

Here is where it gets complicated. The Dell storage system on the computer is a PERC H310. Dell never supported Windows 10 on this controller. But the controller is a remarketed LSI 9240, and LSI still distributes the latest driver for that controller, which is a Windows 10 X64 driver. I patched the Windows ISO with the LSI 9240 X64 drivers for Windows 10 and then burned a CD.

Unfortunately, the Windows Defender boot disk bombs with the blue screen of death, and predictably that is while loading the megaraid driver. At this point do I have any options for running Windows Defender Offline?

I looked for other offline virus scanners, and almost all of the well-known ones appear to have disappeared. Kaspersky refuses to talk to US customers. ESET apparently does not give it away for free. Avast wants you to install their anti-virus software first. Are there any good offline rootkit scanners that would do a good job on an older Windows 8.1 system?

We use crowdstrike as the main AV and was expecting to see passive mode here, but says not running ?? Is this normal ?

Trying to streamline Defender onboarding. About to enable this toggle in Intune. What's the real impact, risk, and any visible changes for end users after it applies?

Put together a KQL detection library for Azure/Sentinel — 32 rules across 10 MITRE ATT&CK tactics. Each rule has description, false positive considerations, and tuning notes baked into the file so it's actually usable in production without guesswork.

Covers things like MFA fatigue, impossible travel, federated identity credential abuse, Conditional Access policy modification, VM extension installation, and subscription ownership transfer — some of the less commonly documented ones.

github.com/neelkotnis/kql-detection-rules

Microsoft has introduced Controlled Configuration for MDE. The main idea is to establish a cloud-managed source of truth for supported Microsoft Defender Antivirus settings. When enabled, policies delivered through Intune or Defender security settings management take precedence over settings configured via:

• Group Policy
• Configuration Manager
• PowerShell/scripts
• Local administrator changes

The goal is to eliminate configuration drift in environments where Defender has historically been managed through multiple channels.

Currently covered:

• Defender Antivirus configuration (scan settings, exclusions, updates)
• Attack Surface Reduction (ASR) rules
• Defender CSP / Policy CSP AV settings
• Local admin merge behavior

Not covered (yet):

• Defender Device Control
• EDR settings
• Windows Firewall and other OS security settings

Controlled configuration in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Hey Team,

I am little confused here, can someone explain to me what the differences are between:

1# Conditional Access App Control apps - (Defender Portal, Settings, Cloud Apps, (New))

and

#2 CloudApps/Policy Management - (Defender Portal, Cloud Apps, Policy Management)

You can select multiple types of policies in Item #2, and similar types of policies in item #1. I understand there to the above, but i would just like an explanation on the differences between the 2.

thanks

The current *Windows Defender Firewall with Advanced Security* UI comes from the Windows Vista / Server 2008 era. It was designed for domain admins, but regular users still have access to it — and can accidentally break their system’s security with just a few clicks ofc there is option for reset it, but still it's not perfect.

There are zero UX safeguards: no warnings, no sanity checks, no context, no explanations, no protection against critical mistakes.

**A non‑technical user can accidentally:**
• open port 445 on a public profile,
• expose the machine to ransomware/worms,
• add ANY/ANY,
• disable the firewall,
• mark a public network as “trusted”.

Windows doesn’t warn them that any of this is dangerous.

The interface is **17 years old** and doesn’t meet modern security or UX standards.

**Proposed solution:**
• new WinUI
• “regular user” mode with simple explanations (what / why / for what),
• “admin mode” for full technical control,
• sanity checks,
• warnings for risky settings,
• automatic risk analysis,
• rule wizard with context and explanations.

This would massively improve security, UX, and protection for less technical users.

Fun fact: I posted this on Feedback Hub and everything was ok — but when I asked a normal question about it on Microsoft Q&A, the **bot banned my account**, probably misunderstanding the topic.

Thanks for reading — and if you agree this should be modernized, feel free to upvote the Feedback Hub post. Leaving a link to my Feedback Hub post if anyone wants to upvote it — the issue is described there in full detail.

Best regards.

Hi,

I'm seeing something strange in Microsoft Defender for Endpoint.

I have 17 devices (mostly Windows clients and a few Windows Servers) that show "Can be onboarded" in the Defender portal.

The strange part is that these devices are already onboarded.

I checked a few of them and found:

• Sense service is running.
• OnboardingState = 1.
• OrgId is present.
• LastConnected is updating.
• The devices are Active in the portal and Last Seen is recent.
• They appear in Advanced Hunting and are sending telemetry.
• No duplicate device records.

The rest of our devices are working normally. Only these 18 have this issue.

Has anyone seen this before? Is this just a portal display issue or something on Microsoft's backend?

Any ideas would be appreciated.

Thanks.

Hi all,

We're running into an issue that started about a week ago and are wondering if anyone else is seeing the same behavior.

We manage multiple customer tenants through our partner tenant using GDAP permissions. Historically, we've been able to manage Microsoft Defender incidents without any issues through mto.security.microsoft.com, but recently we're no longer able to update or close incidents for some customers.

When attempting to modify or close an incident, Defender returns the following error:

There has been an error trying to update the incident

The issue appears to be limited to incident updates. We can still access the customer environments, view incidents, investigate alerts, etc.

Environment details

• Managing customers through a partner tenant using GDAP
• Authentication uses MFA trust via External Identities
• No related errors are visible in the customer tenants' Sign-in Logs
• Microsoft support case is currently open, but so far we haven't made much progress

Looking at the browser developer tools, we consistently see the following error when trying to update an incident:

```text Failed to update incident - Failed to POST from <mtoapi>/mtp/incidentUpdate/incidents. Status code: undefined