Turn on cloud protection in Microsoft Defender Antivirus
- Microsoft Defender Antivirus
- Microsoft Defender for Endpoint Plan 2
Cloud protection in Microsoft Defender Antivirus delivers accurate, real-time, and intelligent protection. Cloud protection should be enabled by default; however, you can configure cloud protection to suit your organization's needs.
Methods to configure cloud protection
You can turn Microsoft Defender Antivirus cloud protection on or off by using one of several methods, such as:
For more information about the specific network-connectivity requirements to ensure your endpoints can connect to the cloud protection service, see Configure and validate network connections.
In Windows 10 and Windows 11, there is no difference between the Basic and Advanced reporting options described in this article. This is a legacy distinction and choosing either setting will result in the same level of cloud protection. There is no difference in the type or amount of information that is shared. For more information on what we collect, see the Microsoft Privacy Statement.
Use Microsoft Intune to turn on cloud protection
Go to the Intune admin center (https://intune.microsoft.com) and sign in.
Choose Endpoint security > Antivirus.
In the AV policies section, either select an existing policy, or choose + Create Policy.
Task Steps Create a new policy 1. For Platform, select Windows 10, Windows 11, and Windows Server.
2. For Profile, select Microsoft Defender Antivirus.
3. On the Basics page, specify a name and description for the policy, and then choose Next.
4. In the Defender section, find Allow Cloud Protection, and set it to Allowed. Then choose Next.
5. On the Scope tags step, if your organization is using scope tags, select the tags you want to use, and then choose Next.
6. On the Assignments step, select the groups, users, or devices that you want to apply this policy to, and then choose Next.
7. On the Review + create step, review the settings for your policy, and then choose Create.
Edit an existing policy 1. Select the policy that you want to edit.
2. Under Configuration settings, choose Edit.
3. In the Defender section, find Allow Cloud Protection, and set it to Allowed.
4. Select Review + save.
To learn more about Microsoft Defender Antivirus settings in Intune, see Antivirus policy for endpoint security in Intune.
Use Group Policy to turn on cloud protection
On your Group Policy management device, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and select Edit.
In the Group Policy Management Editor, go to Computer configuration.
Select Administrative templates.
Expand the tree to Windows components > Microsoft Defender Antivirus > MAPS
MAPS settings are equal to cloud-delivered protection.
Double-click Join Microsoft MAPS. Ensure the option is turned on and set to Basic MAPS or Advanced MAPS. Select OK.
You can choose to send basic or additional information about detected software:
Basic MAPS: Basic membership will send basic information to Microsoft about malware and potentially unwanted software that has been detected on your device. Information includes where the software came from (like URLs and partial paths), the actions taken to resolve the threat, and whether the actions were successful.
Advanced MAPS: In addition to basic information, advanced membership will send detailed information about malware and potentially unwanted software, including the full path to the software, and detailed information about how the software has affected your device.
Double-click Send file samples when further analysis is required. Ensure that the first option is set to Enabled and that the other options are set to either:
- Send safe samples (1)
- Send all samples (3)
The Send safe samples (1) option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. Setting the option to Always Prompt (0) will lower the protection state of the device. Setting it to Never send (2) means that the Block at First Sight feature of Microsoft Defender for Endpoint won't work.
Use PowerShell cmdlets to turn on cloud protection
The following cmdlets can turn on cloud protection:
Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent SendAllSamples
For more information on how to use PowerShell with Microsoft Defender Antivirus, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Microsoft Defender Antivirus cmdlets. Policy CSP - Defender also has more information specifically on -SubmitSamplesConsent.
You can set -SubmitSamplesConsent to
SendSafeSamples (the default, recommended setting),
SendSafeSamples setting means that most samples will be sent automatically. Files that are likely to contain personal information will result in a prompt to continue and will require confirmation.
AlwaysPrompt settings lower the protection level of the device. Furthermore, the
NeverSend setting means that the Block at First Sight feature of Microsoft Defender for Endpoint won't work.
Use Windows Management Instruction (WMI) to turn on cloud protection
Use the Set method of the MSFT_MpPreference class for the following properties:
For more information about allowed parameters, see Windows Defender WMIv2 APIs
Turn on cloud protection on individual clients with the Windows Security app
If the Configure local setting override for reporting Microsoft MAPS Group Policy setting is set to Disabled, then the Cloud-based protection setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings.
Open the Windows Security app by selecting the shield icon in the task bar, or by searching the start menu for Windows Security.
Select the Virus & threat protection tile (or the shield icon on the left menu bar), and then, under Virus & threat protection settings, select Manage settings.
Confirm that Cloud-based Protection and Automatic sample submission are switched to On.
If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable.
If you're looking for Antivirus related information for other platforms, see:
- Set preferences for Microsoft Defender for Endpoint on macOS
- Microsoft Defender for Endpoint on Mac
- macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune
- Set preferences for Microsoft Defender for Endpoint on Linux
- Microsoft Defender for Endpoint on Linux
- Configure Defender for Endpoint on Android features
- Configure Microsoft Defender for Endpoint on iOS features