Use next-generation technologies in Microsoft Defender Antivirus through cloud-delivered protection
Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.
- Microsoft Defender Antivirus
Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models.
Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. Get to know the advanced technologies at the core of Microsoft Defender ATP next-generation protection.
To take advantage of the power and speed of these next-generation technologies, Microsoft Defender Antivirus works seamlessly with Microsoft cloud services. These cloud protection services, also referred to as Microsoft Advanced Protection Service (MAPS), enhances standard real-time protection, providing arguably the best antivirus defense.
The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates.
With cloud-delivered protection, next-generation technologies provide rapid identification of new threats, sometimes even before a single machine is infected. Watch the following video about Microsoft AI and Microsoft Defender Antivirus in action:
To understand how next-generation technologies shorten protection delivery time through the cloud, watch the following video:
Read the following blog posts for detailed protection stories involving cloud-protection and Microsoft AI:
- Why Microsoft Defender Antivirus is the most deployed in the enterprise
- Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign
- How artificial intelligence stopped an Emotet outbreak
- Detonating a bad rabbit: Microsoft Defender Antivirus and layered machine learning defenses
- Microsoft Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware
Get cloud-delivered protection
Cloud-delivered protection is enabled by default. However, you may need to re-enable it if it has been disabled as part of previous organizational policies.
Organizations running Windows 10 E5 can also take advantage of emergency dynamic intelligence updates, which provide near real-time protection from emerging threats. When you turn on cloud-delivered protection, fixes for malware issues can be delivered via the cloud within minutes, instead of waiting for the next update.
You can also visit the Windows Defender Testground website at demo.wd.microsoft.com to confirm the feature is working and see how it works.
The following table describes the differences in cloud-delivered protection between recent versions of Windows and Configuration Manager.
|OS version or service application||Cloud-protection service label||Reporting level (MAPS membership level)||Cloud block timeout period|
|Windows 8.1 (Group Policy)||Microsoft Advanced Protection Service||Basic, Advanced||No|
|Windows 10, version 1607 (Group Policy)||Microsoft Advanced Protection Service||Advanced||No|
|Windows 10, version 1703 or greater (Group Policy)||Cloud-based Protection||Advanced||Configurable|
|System Center 2012 Configuration Manager||N/A||Dependent on Windows version||Not configurable|
|Microsoft Endpoint Configuration Manager (Current Branch)||Cloud protection service||Dependent on Windows version||Configurable|
|Microsoft Intune||Microsoft Advanced Protection Service||Dependent on Windows version||Configurable|
Enable cloud-delivered protection. You can enable cloud-delivered protection with Microsoft Endpoint Configuration Manager, Group Policy, Microsoft Intune, and PowerShell cmdlets.
Specify the cloud-delivered protection level. You can specify the level of protection offered by the cloud with Group Policy and Microsoft Endpoint Configuration Manager. The protection level will affect the amount of information shared with the cloud and how aggressively new files are blocked.
Configure and validate network connections for Microsoft Defender Antivirus. There are certain Microsoft URLs that your network and endpoints must be able to connect to for cloud-delivered protection to work effectively. This article lists the URLs that should be allowed via firewall or network filtering rules, and instructions for confirming your network is properly enrolled in cloud-delivered protection.
Configure the block at first sight feature. The "block at first sight" feature can block new malware within seconds, without having to wait hours for traditional Security intelligence. You can enable and configure it with Microsoft Endpoint Configuration Manager and Group Policy.
Configure the cloud block timeout period. Microsoft Defender Antivirus can block suspicious files from running while it queries our cloud-delivered protection service. You can configure the amount of time the file will be prevented from running with Microsoft Endpoint Configuration Manager and Group Policy.