Edit

Share via

Configure behavioral, heuristic, and real-time protection

  • Article
  • 04/04/2025

Applies to:

Platforms

  • Windows

Microsoft Defender Antivirus uses several methods to provide threat protection:

  • Cloud protection for near-instant detection and blocking of new and emerging threats
  • Always-on scanning, using file and process behavior monitoring and other heuristics (also known as "real-time protection")
  • Dedicated protection updates based on machine learning, human and automated big-data analysis, and in-depth threat resistance research

You can configure how Microsoft Defender Antivirus uses these methods with Microsoft Defender for Endpoint Security Configuration Management, Microsoft Intune, Microsoft Configuration Manager, Group Policy, PowerShell cmdlets, and Windows Management Instrumentation (WMI).

This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but might not be detected as malware.

See Use next-gen Microsoft Defender Antivirus technologies through cloud protection for how to enable and configure Microsoft Defender Antivirus cloud protection.

In this section

Article Description
Detect and block potentially unwanted applications Detect and block apps that mighty be unwanted in your network, such as adware, browser modifiers and toolbars, and rogue or fake antivirus apps
Enable and configure Microsoft Defender Antivirus protection capabilities Enable and configure real-time protection, heuristics, and other always-on Microsoft Defender Antivirus monitoring features

Tip

If you're looking for Antivirus related information for other platforms, see:

See also

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.

Additional resources

Training

Module

Configure and manage threat protection by using Microsoft Defender for Cloud - Training

This module focuses on the essential techniques for configuring and managing threat protection exclusively with Microsoft Defender for Cloud, empowering cybersecurity specialists to strengthen the security posture of their cloud environments.

Certification

Microsoft Certified: Security Operations Analyst Associate - Certifications

Investigate, search for, and mitigate threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender.