Endpoint detection and response (EDR) in block mode frequently asked questions (FAQ)

If you get a false positive, you can submit the file for analysis at the Microsoft Security Intelligence submission site.

You can also define an exclusion for Microsoft Defender Antivirus. See Configure and validate exclusions for Microsoft Defender Antivirus scans.

Yes, Microsoft recommends enabling EDR in block mode, even when primary antivirus software on the system is Microsoft Defender Antivirus. The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product. However, there are scenarios where EDR in block mode might be beneficial, such as if Microsoft Defender Antivirus is misconfigured, or if PUA protection is not enabled. In such cases, EDR in block mode can automatically remediate detections like PUA.

EDR in block mode does not affect non-Microsoft antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like Microsoft Defender Antivirus in passive mode, except that EDR in block mode also blocks and remediates malicious artifacts or behaviors that are detected.

Because Microsoft Defender Antivirus detects and remediates malicious items, it's important to keep it up to date. For EDR in block mode to be effective, it uses the latest device learning models, behavioral detections, and heuristics. The Defender for Endpoint stack of capabilities works in an integrated manner. To get best protection value, you should keep Microsoft Defender Antivirus up to date. See Manage Microsoft Defender Antivirus updates and apply baselines.

Cloud protection is needed to turn on the feature on the device. Cloud protection allows Defender for Endpoint to deliver the latest and greatest protection based on our breadth and depth of security intelligence, along with behavioral and device learning models.

For endpoints running Windows 10, Windows 11, Windows Server, version 1803 or later, Windows Server 2019, or Windows Server 2022 when Microsoft Defender Antivirus is in active mode, it is used as the primary antivirus on the device. When running in passive mode, Microsoft Defender Antivirus is not the primary antivirus product. In this case, threats are not remediated by Microsoft Defender Antivirus in real time.

For more information, see Microsoft Defender Antivirus compatibility.

To confirm whether Microsoft Defender Antivirus is running in active or passive mode, you can use Command Prompt or PowerShell on a device running Windows.

You can use PowerShell to confirm that EDR in block mode is turned on with Microsoft Defender Antivirus running in passive mode.

1. Select the Start menu, begin typing PowerShell, and then open Windows PowerShell in the results.

2. Type Get-MPComputerStatus|select AMRunningMode.

3. Confirm that the result, EDR Block Mode, is displayed.

If Microsoft Defender Antivirus is running in active mode or passive mode, EDR in block mode is supported of the following versions of Windows:

• Windows 11
• Windows 10 (all releases)
• Windows Server, version 1803 or newer
• Windows Server 2022
• Windows Server 2019
• Windows Server 2016 and Windows Server 2012 R2 (with the new unified client solution)

With the new unified client solution for Windows Server 2016 and Windows Server 2012 R2, you can run EDR in block mode in either passive mode or active mode.

If you choose to disable EDR in block mode, it can take up to 30 minutes for the system to disable this capability.

• Endpoint detection and response in block mode
• Tech Community blog: Introducing EDR in block mode: Stopping attacks in their tracks
• Behavioral blocking and containment