Make sure Defender Antivirus is active with cloud protection and block at first sight¶
Licence and role
Microsoft Defender Antivirus (Windows); management through Intune or another tool. Defender for Endpoint Plan 1/2 or Defender for Business for central reporting.
Why it matters¶
ASR rules, network protection and indicators only work when Defender Antivirus runs in active mode. Block at first sight, which Microsoft says can cut the response time for new malware from hours to seconds, needs cloud protection on and samples sent automatically.
Steps¶
- Intune > Endpoint security > Antivirus > Create policy > Windows > Microsoft Defender Antivirus: Allow cloud protection = Allowed; Submit samples consent = Send safe samples automatically (or all samples).
- Keep real-time protection on and don't disable block at first sight.
- Assign to all Windows devices.
- Run the read-only check on sample devices: AMRunningMode should be Normal (active), MAPSReporting 2, SubmitSamplesConsent 1 or 3, DisableBlockAtFirstSeen False.
Impact on users¶
Files new to Microsoft can be held for a cloud check before they run. Microsoft says 'Never send' for samples stops block at first sight from working.
Rollback¶
Change the Antivirus policy settings back in Intune.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Windows with Microsoft Defender Antivirus (Defender PowerShell module is built in). No tenant connection.
Run on 3-5 sample devices per device type (laptops, kiosks, servers) as administrator.
Tenant-wide views are in the Microsoft Defender portal (Reports > Device health; Advanced hunting) as described in each control.
Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled, AMProductVersion, AntivirusSignatureLastUpdated | Format-List | Out-String
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, DisableBlockAtFirstSeen | Format-List | Out-String
How to verify¶
Sample devices report active mode, real-time protection on, MAPSReporting 2, automatic sample submission and block at first sight not disabled.
Sources¶
- Configure block at first sight Microsoft Defender antivirus (Microsoft Learn)
- EDR in block mode (Microsoft Learn)
This control is in the Defender for Endpoint and ASR Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 15 controls.