Microsoft Defender API - File Block indicator feature is not available for this tenant

Jose Garcia 1 Reputation point
2022-03-28T16:32:37.687+00:00

While trying to automate the ingestion of Threat Intel into Microsoft Defender I ran across this while using the API.
"error":{"code":"DisabledFeature","message":"File Block indicator feature is not available for this tenant"...

Haven't had any issues with other indicator types. I have made sure that "Allow or Block file", "Microsoft Defender for Cloud Apps" and "Custom network indicators" are both enabled in the settings.

What am I missing here?

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,339 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.