Hello!
My Secure Score recommendations have been advising me to set PUA Protection to block mode. Seems easy enough.
This applies to all 9 enrolled machines (9/9 exposed).

However, upon checking I've had a policy setup to enable it in Endpoint Protection > Antivirus for several months.

If I ask Powershell (Get-MpPreference | Select PUAProtection) I am told '2' (audit mode)

If I check the registry I was getting PUAProtection=0, then I ran a PlatformUpdate and got PUAProtection=1

I've checked all the 5007 events and there has been nothing related to PUA for at least the last 2 months.

I guess my issues are twofold:
1. What's the correct way to get this enabled?
2. Is there something obvious I should be doing to make sure the rest of the policy is actually being applied?

Apparently Microsoft Defender SmartScreen considers the default navigation page set up for Microsoft Edge to be unsafe. Can someone tell me why is it doing this?

I appreciate the effort, but have you tried to listen to the videos? What is your opinion regarding the sound quality?

There is new Secure Now initiative page in Defender XDR portal, but have you tried to watch the dideos? There is a new Secure Now initiative page in the Defender XDR portal, but have you tried to watch the videos? https://security.microsoft.com/securenow

The first 10-min video has two presenters talking about patching; the first is very faint, and the second starts around minute 8 with some scratching and crackling, like he is just fall off the chair... and getting from under the table... While the first presenter is fairly upbeat, the second guy feels really sad. There are persistent background noises, scratching, etc.

Besides, the embedded video player does not allow speed control (which is standard in modern days)

Come on, Microsoft, do you have quality control? Those videos are embedded one step away from the main landing page.

When you make frequent use of custom detection rules, you often end up making small changes to fine-tune them, reduce noise, or otherwise optimize them.

As a simple way to keep track of those changes, I usually add a comment at the top of the query in the format // date - initials - change (for example: 2026-07-21 JB - Added filter on line 6). This provides a basic change log and allows me to add comments directly in the KQL. It's not perfect, but it's better than nothing.

In the past, I've considered using Content as Code or the Graph API, but I found both approaches too cumbersome to implement. I'm also not particularly happy with the workflow, as I prefer to test queries directly in production to see if they work. With source control, you have to copy and paste the query into your repository and then deploy it again instead of saving it directly after editing it (especially in advanced hunting).

Source control feels like a perfectly valid option when you're working in a large team or for an MSP delivering SOC-as-a-Service, but it seems less practical for smaller in-house teams.

I'm curious to hear what others have implemented and what your experiences have been.

I have few devices on my network, ~300 and wont to do a ring updates kinda policy . I want all devices to get the latest update as soon as possible.

Does this need an AV Intune policy where i specify update intervals?

As the title suggests, how are you all using those tables?

Hello,

Since earlier Sunday, in the Advanced Hunting query section of MS Security portal, I can see Defender anti-virus detections for malware literally named "Unknown"

However, checksums (SHA-1) are never provided for these entries, so one can't be sure what is actually being detected - or if it's just the query acting funny because MS changed something in the background?

The phenomenon affects apparently benign software like 7-Zip and SAP, mostly in the folders C:\Windows\IMEcache and C:\Program files (x86).

The bog-standard query looks like this:

DeviceEvents

| where ActionType == "AntivirusDetection"

| extend ParsedFields=parse_json(AdditionalFields)

| project ThreatName=tostring(ParsedFields.ThreatName),

WasRemediated=tobool(ParsedFields.WasRemediated),

WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected),

FileName, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine,

DeviceName, Timestamp

| limit 1000

Landed in it a bit. We migrated from M365 Business Premium to E5 recently, and I'm the sole IT person tasked with getting Defender for Endpoint properly configured before our Cyber Essentials Plus assessment next month.

Company is small, roughly 300 Windows and 50 Mac devices. But the Defender console is showing over 1,000 devices enrolled, so my first job is working out what's stale, duplicated, or genuinely orphaned before I can trust any of the reporting.

Looking for advice on:

A sane order of operations for standing up Defender for Endpoint properly (attack surface reduction rules, EDR in block mode, automated investigation and response, etc.) when coming from a much lighter Business Premium setup

How you handle device inventory cleanup, specifically separating real endpoints from stale/duplicate records

Any gotchas specific to CE Plus around Defender configuration (update policies, MFA scope, EOL builds) that assessors tend to flag

Good reference articles, Microsoft Learn docs, or blog writeups you'd actually recommend, rather than the generic marketing pages

Any war stories or checklists appreciated. Trying to avoid learning this the hard way with an assessor watching.

So I have set up FULL REMEDIATION for all devices on Settings-Endpoints-Device Groups.

Im doing some custom AV policies in intune and I see there are other settings about action to take on threat severity. Like "Remediation action for High severity threats: Clean | Quarantine | Allow" etc

Have I not setup the action with the full remediation setting? Do i have to go more granular and set up an action for each severity in Intune?

Has anyone read this article from Proofpoint? I'm trying to think of prevention ideas that I can recommend customers to implement if they were on the receiving end of this attack.

Because the attack is using Microsoft OAuth 2.0 using the Resource Owner Password Credentials (ROPC) flow than I think setting a Conditional Access Policy (CAP) will help: https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication

Migrate to OAuth 2.1

Because the article mentions that the Application ID and Name will be empty... I think creating an App-Based CAP to block apps that are not covered under the organization's App's policy may prevent this... but I'm not sure.
https://www.cloudtekspace.com/post/create-app-based-conditional-access-policies

Anyone got any ideas or think I'm heading in the wrong direction? Let me know.

The company I work with has decided to move all in with MS with E5 licensing. We will be migrated from S1 which we currently use. Granted, we may keep S1 for those Linux devices that may not be supported.

For those who have transitioned to Defender from SentinelOne or another EDR platform, how did it go?

How Defender deals with say folder/file exclusions?

Thanks in advance.

We currently have email notification setup in Defender pointing to an old email address that we want to decommission. When I look at the Policy & Rules I see the notifications are going out to TenantAdmins, which when I check Entra's groups and users I don't have a TenatAdmins groups or user there. I looked through Defender and don't see anything, does anyone have any idea where this group or user lives?

And is there a more direct way to update it if it's not a group without having to go through all the individual policy & rules?

Thanks,

I mean laptops. They are set up to use our corporate proxy to connect to the internet. A proxy which is also used by defender.

But when users take these laptops home, how would Defender connect to the internet? the proxy is unreachable

Hello,

I am trying to identify all the related Event IDs when it comes to Device Control.

In Advanced Hunting most events are logged under the DeviceEvents table with actions like BluetoothPolicyTriggered, PnpDeviceConnected, PnPDeviceAllowed, PnPDeviceBlocked, PrintJobBlocked, RemovableStorageFileEvent, and RemovableStoragePolicyTriggered.

But it seems impossible to find such Windows Events.

Any idea?

I saw a dude on X complain that Codex deleted almost all of his files. Some people said he should have been using DCG.

That still seems risky. I think we gotta start backing up our computers unfortunately.

What have you found to be the best method of monitoring the health of defender on a large scale deployment? Pulling defender metrics via API seems to be capped at 10,000 devices. And pulling metrics via KQL search seems to have issues if there are duplicate entries for the same hostname. Looking for your advice / experience on how you maintain full and functional coverage of defender for 10,000+ devices.

We regularly run into this scenario in customer engagements: DCs mostly have MDI sensors installed and configured but the other eligible servers (ADFS, ADCS, Entra Connect) do not have them deployed.

I know Defender Suite and especially E5 are huge feature wise, but working mostly with Defender stack this behavior with MDI seems very consistent across multiple tenants. I’m hoping for V3 sensor availability for non-DCs at some point to ease the deployment.

For me, deploying MDI seems like an easy win for visibility (especially regarding ADCS ESC privescs) not to mention the security recommendations they bring.

We’ve even had customers question their importance on these servers (never questioned for DCs). Is this due to ignorance/old way of thinking as DCs being the only ones treated as tier 0 servers?

Tomo tiempo pero al fin lo soluciono, era importante hacerlo ya que estamos hablando de la suite de seguridad que la gran mayoría de usuarios de Windows usa por default. Además el mismo Microsoft es quien la promueve como la mejor solución!

We have been receiving external Teams calls from bad actors pretending to be Employees.

I can use KQL to report on Teams calls, but it only shows details of the internal person.

What I need is a full report showing all external calls with full details of internal and external person.

Seems something is broken in the Custom Detection Rule engine. A normal working Advanced Hunting query return a schema failure when ran from a Custom Detection rule. Works when ran from the Advanced Hunting screen.

Wonder if others are experiencing the same issue.

HuntingQueryException: 'summarize' operator: Failed to resolve scalar expression named 'AccountUpn'

Test CDR with simple query returns the failure.

Query:

IdentityInfo

| summarize arg_max(TimeGenerated, *) by AccountUpn

| take 1

I know the schema for the same table IdentityInfo defers between Sentinel and XDR. Would the CDR engine run on the Sentinel schema now?

All our Windows 2019 servers are using Windows Defender. When I go to the endpoints in Security it says, "we are currently using Intune to manage our security policies".

So, when it comes to the servers which are using Windows Defender how do I set the policies up? Do I just "use defender for business configuration instead" and not "go to Intune"?

Thanks,