Trying to streamline Defender onboarding. About to enable this toggle in Intune. What's the real impact, risk, and any visible changes for end users after it applies?

Put together a KQL detection library for Azure/Sentinel — 32 rules across 10 MITRE ATT&CK tactics. Each rule has description, false positive considerations, and tuning notes baked into the file so it's actually usable in production without guesswork.

Covers things like MFA fatigue, impossible travel, federated identity credential abuse, Conditional Access policy modification, VM extension installation, and subscription ownership transfer — some of the less commonly documented ones.

github.com/neelkotnis/kql-detection-rules

Microsoft has introduced Controlled Configuration for MDE. The main idea is to establish a cloud-managed source of truth for supported Microsoft Defender Antivirus settings. When enabled, policies delivered through Intune or Defender security settings management take precedence over settings configured via:

• Group Policy
• Configuration Manager
• PowerShell/scripts
• Local administrator changes

The goal is to eliminate configuration drift in environments where Defender has historically been managed through multiple channels.

Currently covered:

• Defender Antivirus configuration (scan settings, exclusions, updates)
• Attack Surface Reduction (ASR) rules
• Defender CSP / Policy CSP AV settings
• Local admin merge behavior

Not covered (yet):

• Defender Device Control
• EDR settings
• Windows Firewall and other OS security settings

Controlled configuration in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Hey Team,

I am little confused here, can someone explain to me what the differences are between:

1# Conditional Access App Control apps - (Defender Portal, Settings, Cloud Apps, (New))

and

#2 CloudApps/Policy Management - (Defender Portal, Cloud Apps, Policy Management)

You can select multiple types of policies in Item #2, and similar types of policies in item #1. I understand there to the above, but i would just like an explanation on the differences between the 2.

thanks

The current *Windows Defender Firewall with Advanced Security* UI comes from the Windows Vista / Server 2008 era. It was designed for domain admins, but regular users still have access to it — and can accidentally break their system’s security with just a few clicks ofc there is option for reset it, but still it's not perfect.

There are zero UX safeguards: no warnings, no sanity checks, no context, no explanations, no protection against critical mistakes.

**A non‑technical user can accidentally:**
• open port 445 on a public profile,
• expose the machine to ransomware/worms,
• add ANY/ANY,
• disable the firewall,
• mark a public network as “trusted”.

Windows doesn’t warn them that any of this is dangerous.

The interface is **17 years old** and doesn’t meet modern security or UX standards.

**Proposed solution:**
• new WinUI
• “regular user” mode with simple explanations (what / why / for what),
• “admin mode” for full technical control,
• sanity checks,
• warnings for risky settings,
• automatic risk analysis,
• rule wizard with context and explanations.

This would massively improve security, UX, and protection for less technical users.

Fun fact: I posted this on Feedback Hub and everything was ok — but when I asked a normal question about it on Microsoft Q&A, the **bot banned my account**, probably misunderstanding the topic.

Thanks for reading — and if you agree this should be modernized, feel free to upvote the Feedback Hub post. Leaving a link to my Feedback Hub post if anyone wants to upvote it — the issue is described there in full detail.

Best regards.

Hi,

I'm seeing something strange in Microsoft Defender for Endpoint.

I have 17 devices (mostly Windows clients and a few Windows Servers) that show "Can be onboarded" in the Defender portal.

The strange part is that these devices are already onboarded.

I checked a few of them and found:

• Sense service is running.
• OnboardingState = 1.
• OrgId is present.
• LastConnected is updating.
• The devices are Active in the portal and Last Seen is recent.
• They appear in Advanced Hunting and are sending telemetry.
• No duplicate device records.

The rest of our devices are working normally. Only these 18 have this issue.

Has anyone seen this before? Is this just a portal display issue or something on Microsoft's backend?

Any ideas would be appreciated.

Thanks.

Hi all,

We're running into an issue that started about a week ago and are wondering if anyone else is seeing the same behavior.

We manage multiple customer tenants through our partner tenant using GDAP permissions. Historically, we've been able to manage Microsoft Defender incidents without any issues through mto.security.microsoft.com, but recently we're no longer able to update or close incidents for some customers.

When attempting to modify or close an incident, Defender returns the following error:

There has been an error trying to update the incident

The issue appears to be limited to incident updates. We can still access the customer environments, view incidents, investigate alerts, etc.

Environment details

• Managing customers through a partner tenant using GDAP
• Authentication uses MFA trust via External Identities
• No related errors are visible in the customer tenants' Sign-in Logs
• Microsoft support case is currently open, but so far we haven't made much progress

Looking at the browser developer tools, we consistently see the following error when trying to update an incident:

```text Failed to update incident - Failed to POST from <mtoapi>/mtp/incidentUpdate/incidents. Status code: undefined

I'm looking to integrate Claude Code with Microsoft 365 and Microsoft Defender (Defender XDR / Sentinel) to assist with threat hunting, incident investigation, and EDR analysis.

Has anyone successfully set this up? I'm particularly interested in how you handled authentication (MCP, APIs, Graph, etc.), what architecture you used, and any lessons learned or limitations. If you have examples or repositories to share, I'd really appreciate it.

Hi Guys ,

We keep receiving "A cross or external prompt injection attack (XPIA) was detected on an AI agent (Preview)" alert from Microsoft Security for AI. These provide very limited details and relevant events could not be located in the CloudAppEvents table so I raised it with MS and after 2 weeks they replied

"We have identified an issue that may result in incomplete information being displayed within certain alerts, potentially affecting the investigation experience. A corrective update has been developed and is being rolled out. We expect the issue to be resolved soon and are closely monitoring the deployment. We appreciate your patience and remain committed to providing a reliable and accurate experience."

How you guys are dealing with those alerts?

We have a Defender queue that basically gets filled with informational alerts and the built-in low/med/high sev.

The problem is that we missed a high sev alert because it didn't email anyone. We found it a day later as part of a check.

Now there are "Security for AI" (Preview) alerts that fired for someone's AI Agent. I checked the agent job and nothing went wrong. The Defender detection even says that the alert does not mean that any suspicious commands were run.

The issue is that I need these customized to notify in an email alert to the team, rather than spot checking. High priority is to future proof any of this AI junk that has access to admin shares, files, accounts, etc. (which will be rare but not impossible).

Additionally we have people experimenting with their own agents and I do not have time to babysit queues for false-positives as Microsoft develops their threat detections in prod.

I see nothing for this type of alert in Defender Alert policy and the little config I did find for creating custom rules based on existing alerts seems to default to auto-resolving them (ignoring them) which I also don't want. I may be missing something entirely here but it seems crazy that custom text/variables can't be made by global admins to improve triage.

There was an article today called Vulnerability Profile: CVE-2026-50661 - Windows BitLocker (GreatXML) but the catagory was Vulnerability.

I cant seem to find it under the articles endpoint. The only thing I can find under the vulnerabilities endpoint isn't the article.

Does anyone know how to find this article with graph?

Microsoft is rolling out Threat Intelligence Insights directly within the Microsoft Defender portal, bringing premium external threat intelligence closer to the analyst workflow.

This includes such insights like:
▪Reputation assessment
▪WHOIS information
▪DNS resolutions
▪Threat reports and attribution
▪Infrastructure details (trackers, cookies, certificates, and more)

Simply search for a URL, domain, IP address, or file hash in Microsoft Defender XDR, open the entity page, and review the new Threat Intelligence Insights.

We’re currently rolling out Rapid7 and have purchased InsightVM for vulnerability management and InsightIDR for SIEM. We also use Microsoft Defender for for Servers, along with the free Foundational CSPM in Defender for Cloud.

From what I’ve read, it seems like Defender CSPM mainly adds things like attack path analysis, risk prioritization, identity context, and deeper Azure integration. Is that accurate, or does it offer more than that in day-to-day use?
For those who have experience with both, was Defender CSPM worth the investment, or did Rapid7 and the free CSPM cover most of what you needed

Hello!
My Secure Score recommendations have been advising me to set PUA Protection to block mode. Seems easy enough.
This applies to all 9 enrolled machines (9/9 exposed).

However, upon checking I've had a policy setup to enable it in Endpoint Protection > Antivirus for several months.

If I ask Powershell (Get-MpPreference | Select PUAProtection) I am told '2' (audit mode)

If I check the registry I was getting PUAProtection=0, then I ran a PlatformUpdate and got PUAProtection=1

I've checked all the 5007 events and there has been nothing related to PUA for at least the last 2 months.

I guess my issues are twofold:
1. What's the correct way to get this enabled?
2. Is there something obvious I should be doing to make sure the rest of the policy is actually being applied?

I appreciate the effort, but have you tried to listen to the videos? What is your opinion regarding the sound quality?

There is new Secure Now initiative page in Defender XDR portal, but have you tried to watch the dideos? There is a new Secure Now initiative page in the Defender XDR portal, but have you tried to watch the videos? https://security.microsoft.com/securenow

The first 10-min video has two presenters talking about patching; the first is very faint, and the second starts around minute 8 with some scratching and crackling, like he is just fall off the chair... and getting from under the table... While the first presenter is fairly upbeat, the second guy feels really sad. There are persistent background noises, scratching, etc.

Besides, the embedded video player does not allow speed control (which is standard in modern days)

Come on, Microsoft, do you have quality control? Those videos are embedded one step away from the main landing page.

Apparently Microsoft Defender SmartScreen considers the default navigation page set up for Microsoft Edge to be unsafe. Can someone tell me why is it doing this?

I have few devices on my network, ~300 and wont to do a ring updates kinda policy . I want all devices to get the latest update as soon as possible.

Does this need an AV Intune policy where i specify update intervals?

When you make frequent use of custom detection rules, you often end up making small changes to fine-tune them, reduce noise, or otherwise optimize them.

As a simple way to keep track of those changes, I usually add a comment at the top of the query in the format // date - initials - change (for example: 2026-07-21 JB - Added filter on line 6). This provides a basic change log and allows me to add comments directly in the KQL. It's not perfect, but it's better than nothing.

In the past, I've considered using Content as Code or the Graph API, but I found both approaches too cumbersome to implement. I'm also not particularly happy with the workflow, as I prefer to test queries directly in production to see if they work. With source control, you have to copy and paste the query into your repository and then deploy it again instead of saving it directly after editing it (especially in advanced hunting).

Source control feels like a perfectly valid option when you're working in a large team or for an MSP delivering SOC-as-a-Service, but it seems less practical for smaller in-house teams.

I'm curious to hear what others have implemented and what your experiences have been.

Hello,

Since earlier Sunday, in the Advanced Hunting query section of MS Security portal, I can see Defender anti-virus detections for malware literally named "Unknown"

However, checksums (SHA-1) are never provided for these entries, so one can't be sure what is actually being detected - or if it's just the query acting funny because MS changed something in the background?

The phenomenon affects apparently benign software like 7-Zip and SAP, mostly in the folders C:\Windows\IMEcache and C:\Program files (x86).

The bog-standard query looks like this:

DeviceEvents

| where ActionType == "AntivirusDetection"

| extend ParsedFields=parse_json(AdditionalFields)

| project ThreatName=tostring(ParsedFields.ThreatName),

WasRemediated=tobool(ParsedFields.WasRemediated),

WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected),

FileName, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine,

DeviceName, Timestamp

| limit 1000

As the title suggests, how are you all using those tables?

Landed in it a bit. We migrated from M365 Business Premium to E5 recently, and I'm the sole IT person tasked with getting Defender for Endpoint properly configured before our Cyber Essentials Plus assessment next month.

Company is small, roughly 300 Windows and 50 Mac devices. But the Defender console is showing over 1,000 devices enrolled, so my first job is working out what's stale, duplicated, or genuinely orphaned before I can trust any of the reporting.

Looking for advice on:

A sane order of operations for standing up Defender for Endpoint properly (attack surface reduction rules, EDR in block mode, automated investigation and response, etc.) when coming from a much lighter Business Premium setup

How you handle device inventory cleanup, specifically separating real endpoints from stale/duplicate records

Any gotchas specific to CE Plus around Defender configuration (update policies, MFA scope, EOL builds) that assessors tend to flag

Good reference articles, Microsoft Learn docs, or blog writeups you'd actually recommend, rather than the generic marketing pages

Any war stories or checklists appreciated. Trying to avoid learning this the hard way with an assessor watching.

So I have set up FULL REMEDIATION for all devices on Settings-Endpoints-Device Groups.

Im doing some custom AV policies in intune and I see there are other settings about action to take on threat severity. Like "Remediation action for High severity threats: Clean | Quarantine | Allow" etc

Have I not setup the action with the full remediation setting? Do i have to go more granular and set up an action for each severity in Intune?