Optimize ASR rule deployment and detections

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

Attack surface reduction (ASR) rules identify and prevent typical malware exploits. They control when and how potentially malicious code can run. For example, they can prevent JavaScript or VBScript from launching a downloaded executable, block Win32 API calls from Office macros, and block processes that run from USB drives.

Attack surface management card
Attack surface management card

The Attack surface management card is an entry point to tools in Microsoft 365 Defender portal that you can use to:

  • Understand how ASR rules are currently deployed in your organization.
  • Review ASR detections and identify possible incorrect detections.
  • Analyze the impact of exclusions and generate the list of file paths to exclude.

Select Go to attack surface management > Reports > Attack surface reduction rules > Add exclusions. From there, you can navigate to other sections of Microsoft 365 Defender portal.

Add exclusions tab in the Attack surface reduction rules page in the Microsoft 365 Defender portal
The Add exclusions tab in the Attack surface reduction rules page in Microsoft 365 Defender portal


To access Microsoft 365 Defender portal, you need a Microsoft 365 E3 or E5 license and an account that has certain roles on Azure Active Directory. Read about required licenses and permissions.

For more information about ASR rule deployment in Microsoft 365 Defender portal, see Monitor and manage ASR rule deployment and detections.

Related topics