Edit

Configure behavioral, heuristic, and real-time protection

  • Article

Applies to:

Platforms

  • Windows

Microsoft Defender Antivirus uses several methods to provide threat protection:

  • Cloud protection for near-instant detection and blocking of new and emerging threats
  • Always-on scanning, using file and process behavior monitoring and other heuristics (also known as "real-time protection")
  • Dedicated protection updates based on machine learning, human and automated big-data analysis, and in-depth threat resistance research

You can configure how Microsoft Defender Antivirus uses these methods with Microsoft Defender for Endpoint Security Configuration Management, Microsoft Intune, Microsoft Configuration Manager, Group Policy, PowerShell cmdlets, and Windows Management Instrumentation (WMI).

This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware.

See Use next-gen Microsoft Defender Antivirus technologies through cloud protection for how to enable and configure Microsoft Defender Antivirus cloud protection.

In this section

Topic Description
Detect and block potentially unwanted applications Detect and block apps that may be unwanted in your network, such as adware, browser modifiers and toolbars, and rogue or fake antivirus apps
Enable and configure Microsoft Defender Antivirus protection capabilities Enable and configure real-time protection, heuristics, and other always-on Microsoft Defender Antivirus monitoring features

Tip

If you're looking for Antivirus related information for other platforms, see:

See also

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.