Microsoft Defender for Endpoint Field Guide

What this guide covers

Microsoft Defender for Endpoint is sold as an enterprise endpoint security platform, and the Learn overview will tell you exactly that in one sentence. What it does not tell you is that a good share of what you pay for stays dark until you know it exists, that the line between Plan 1 and Plan 2 decides whether you get endpoint detection and response at all, and that onboarding is a genuinely different job on Windows, macOS, Linux, and mobile, each with its own way to go wrong.

This book is what I wanted the first time I stood up MDE in a real tenant. It walks the product from the architecture, the three-layer detection engine, where it sits inside Defender XDR, and what the sensor will and will not capture, through licensing and the Plan 1 versus Plan 2 line, through onboarding every platform, into next-generation protection, EDR in block mode, tamper protection, live response, and attack surface reduction. It ends with the operational reality most write-ups skip: which settings have to be on before other settings do anything, and the failure modes you only meet after a quarter in production.

Every limit, license boundary, and portal path is grounded against current Microsoft Learn, and where a number tends to move the text tells you to verify it rather than trust a figure that may have drifted. You do not need a production fleet to follow along; a trial tenant and a single test device are enough.

Chapter map

1. What Is Microsoft Defender for Endpoint
2. Licensing, Plans, and Prerequisites
3. Onboarding Windows Devices
4. Onboarding macOS, Linux, and Mobile
5. Next-Generation Protection and Antivirus Policy
6. Advanced Features and Tenant-Wide Settings
7. Attack Surface Reduction
8. Security Settings Management
9. Device Groups, Roles, and Automation Levels
10. Microsoft Defender Vulnerability Management
11. Investigating a Device, Timeline, Response Actions, and Live Response
12. MDE Alerts, Advanced Hunting, and Custom Detection Rules
13. Before You Go to Production, Deployment Checklist and Operational Readiness

Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.

Who it is for

This book is for the security engineers and administrators who run Defender for Endpoint and want its moving parts connected rather than met one Learn page at a time, the SOC analysts who triage its alerts and need the machinery behind them, and anyone preparing for SC-200 who wants the operational depth the exam objectives assume.

See where you are

6 questions from this guide's territory (2 easy, 4 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of Microsoft Defender Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

• 
  Field guide

  Microsoft Defender XDR Field Guide

  A thin, low-priority incident is far more often a coverage gap than a clever adversary, and the portal warns you about neither. This is not a product you turn on.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Microsoft Sentinel Field Guide

  Onboarding Microsoft Sentinel to the Defender portal can silently disable Fusion, rewrite the scope of your automation rules, and strip the incident-provider condition out of detections you already shipped.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  KQL Threat Hunting Field Guide

  A hunting query returns zero rows and nobody in the room can say whether the environment is genuinely clean or the table was never populated because the connector behind it was never turned on.

  Kindle$12.99Get it on AmazonCompanion page

The hard set (4 questions)

The hardest SC-200 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

A company onboards its Windows Server 2022 fleet, which runs a non-Microsoft antivirus product that must remain primary, to Microsoft Defender for Endpoint. Soon after onboarding, server admins report severe performance degradation, and both antivirus engines are actively scanning. The Windows 11 workstations onboarded the same week with the same third-party AV show no conflict. What did the deployment team miss on the servers?

Correct answer: B. They should have set the ForceDefenderPassiveMode registry value (REG_DWORD = 1) under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection before onboarding, because Windows Server does not enter passive mode automatically

On Windows 10 and 11, Microsoft Defender Antivirus automatically enters passive mode when a non-Microsoft antivirus registers with Windows Security Center - which is why the workstations were fine. On Windows Server (2012 R2 and later, including Server 2022), that automatic switch does not happen: you must set ForceDefenderPassiveMode (REG_DWORD, value 1) under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection, and Learn specifically says to set it before onboarding the device. Without it, both products attempt active protection simultaneously, causing exactly this performance conflict. A further trap: beginning with platform 4.18.2208.0, on an onboarded server with tamper protection enabled, tamper protection allows a switch to active mode but blocks the switch back to passive - so setting the key after the fact may not take effect.

Why the other options are wrong:

• A. EDR in block mode does not set the antivirus mode; it requires Defender Antivirus to already be in passive or active mode and adds a remediation path for EDR detections. It is a complement to passive mode, not the mechanism that creates it.
• C. Manually disabling or uninstalling Microsoft Defender Antivirus is the guidance for servers that are NOT onboarded to Defender for Endpoint. On onboarded servers, keeping Defender Antivirus in passive mode is beneficial - it preserves security intelligence updates and enables EDR in block mode.
• D. Cloud block level (High, High Plus, Zero Tolerance) tunes how aggressively cloud-delivered protection blocks unknown files. It plays no role in active/passive arbitration between antivirus products.

Memory hook: Clients go passive on their own; servers need the ForceDefenderPassiveMode key set BEFORE onboarding - or two AVs fight it out in production.

Microsoft Learn: Microsoft Defender antivirus compatibility

During an incident, a SOC analyst creates a 'Block and remediate' file indicator for the SHA-256 hash of a malicious utility found on several servers. The utility sits in D:\Tools\, a folder a server administrator added to the Microsoft Defender Antivirus folder exclusion list years ago. The servers are in the indicator's scope, Defender Antivirus is in active mode, and more than a day has passed, yet the utility still executes. According to Microsoft's documented policy conflict handling for file indicators, why?

Correct answer: D. In the file indicator conflict handling order, a file allowed by a Microsoft Defender Antivirus exclusion is evaluated before block or warn file indicators, so the exclusion wins and the file is allowed

The 'Create indicators for files' documentation defines an explicit conflict handling order: after Windows Defender Application Control/AppLocker enforcement, the next check is 'if the file is allowed by the Microsoft Defender Antivirus exclusions, then Allow', which comes before 'if the file is blocked or warned by a block or warn file IoCs, then Block/Warn'. Microsoft's example table confirms this: antivirus exclusion Allow plus file indicator Block results in Allow. The pre-existing folder exclusion therefore neutralizes the block indicator, and the remediation is to remove or narrow the stale exclusion.

Why the other options are wrong:

• A. The precedence rule is the opposite: when conflicting file IoC policies target the same file, the more secure (longer) hash wins, so SHA-256 beats SHA-1, which beats MD5. That rule also only arbitrates between conflicting indicators, which is not the issue here.
• B. File indicator blocks are typically enforced within 15 minutes, average around 30 minutes, and can take upwards of two hours, not 14 days. After more than a day, propagation delay is not a plausible cause.
• C. Blocking a file via indicator prevents it from being read, written, or executed on devices in the organization, including files already present. There is no restriction limiting enforcement to newly introduced copies.

Memory hook: In the file conflict chain, an AV exclusion outranks your block indicator: exclusion Allow + IoC Block = Allow. Audit old exclusions before trusting a block.

Microsoft Learn: Indicator file

A security engineer is rolling out attack surface reduction rules through an Intune endpoint security policy and plans to use Warn mode across the board, so users can temporarily bypass blocks with the Unblock option during the transition period. For which rule will this plan fail, because the rule does not support Warn mode?

Correct answer: C. Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Per the ASR rules overview on Microsoft Learn, two rules do not support Warn mode: 'Block credential stealing from the Windows local security authority subsystem' and 'Block Office applications from injecting code into other processes.' For every other rule, Warn (code 6) behaves like Block but presents a notification with an Unblock option that grants a 24-hour bypass, generating event ID 1129 when a user overrides. Warn mode requires Windows 10 version 1809 or later, antivirus platform 4.18.2008.9+ and engine 1.1.17400.5+, and is not available at all in Microsoft Configuration Manager. The LSASS rule is also one of the three standard protection rules recommended for Block mode from day one.

Why the other options are wrong:

• A. 'Block execution of potentially obfuscated scripts' supports Warn mode. Its false-positive risk with legitimate packed or minified scripts is why Warn is a useful transition state for it.
• B. 'Block all Office applications from creating child processes' supports Warn mode. It is commonly deployed in Warn during transition periods precisely because line-of-business Office add-ins can trigger it.
• D. 'Block executable content from email client and webmail' supports Audit, Block, and Warn modes. It is one of the 'other' ASR rules that should be tested in Audit before promotion, but Warn is a valid mode for it.

Memory hook: No Warn for the crown jewels: the LSASS credential-stealing rule and the Office code-injection rule go straight from Audit to Block - there is no click-through middle option.

Microsoft Learn: Attack surface reduction rules overview

Custom file-hash block indicators created in Microsoft Defender for Endpoint are not being enforced on execution. Microsoft Defender Antivirus is running in passive mode (a third-party AV is primary), cloud-delivered protection is enabled, and the Allow or block file advanced feature is on. Why aren't the files being blocked?

Correct answer: C. File-execution blocking requires Microsoft Defender Antivirus to be in active mode; passive mode and EDR in block mode cannot detect and block based on file execution.

Blocking on file execution requires Microsoft Defender Antivirus in active mode. By design, passive mode and EDR in block mode can't detect and block based on file execution, so even with cloud-delivered protection and Allow or block file enabled, indicators are not enforced while Defender Antivirus is passive.

Why the other options are wrong:

• A. Manage security settings is not the blocker here; the requirement is Defender Antivirus in active mode.
• B. File-hash indicators support portable executables (.exe and .dll); the problem is the antivirus mode, not the file type.
• D. Cloud-delivered protection is a required prerequisite for the block/allow feature, not something to disable.

Memory hook: Block-file indicators need Defender AV in ACTIVE mode; passive and EDR block mode won't stop execution.

Microsoft Learn: Advanced features