Microsoft Defender for Endpoint
Vulnerabilities and exposureAttack Surface Reduction Overview
In brief
The Attack Surface Reduction overview now uses revised links for Microsoft Defender Application Guard, WDAC, and Windows Firewall documentation.
What Defender admins need to know
Administrators reviewing the overview will be directed to the updated related documentation; no action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The following Windows security features complement attack surface reduction in Defender for Endpoint, but are configured and managed separately:
- Microsoft Defender Application Guard provides hardware-based isolation for Microsoft Edge, opening untrusted sites in a container to protect your organization. For more information, see
Microsoft Defender Application Guard overviewMicrosoft Defender Application Guard overview. - Windows Defender Application Control (WDAC) ensures that only trusted applications run on your devices. For more information, see
Application control for WindowsApplication control for Windows. - Windows Firewall controls inbound and outbound network traffic on devices. For more information, see
Windows Firewall with advanced securityWindows Firewall with advanced security.
How attack surface reduction fits into Defender for Endpoint
@@ -67,9 +67,9 @@ The availability of these features is summarized in the following table: The following Windows security features complement attack surface reduction in Defender for Endpoint, but are configured and managed separately: -- **Microsoft Defender Application Guard** provides hardware-based isolation for Microsoft Edge, opening untrusted sites in a container to protect your organization. For more information, see [Microsoft Defender Application Guard overview](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview).-- **Windows Defender Application Control (WDAC)** ensures that only trusted applications run on your devices. For more information, see [Application control for Windows](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control).-- **Windows Firewall** controls inbound and outbound network traffic on devices. For more information, see [Windows Firewall with advanced security](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security).+- **Microsoft Defender Application Guard** provides hardware-based isolation for Microsoft Edge, opening untrusted sites in a container to protect your organization. For more information, see [Microsoft Defender Application Guard overview](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview).+- **Windows Defender Application Control (WDAC)** ensures that only trusted applications run on your devices. For more information, see [Application control for Windows](/windows/security/application-security/application-control/app-control-for-business/appcontrol).+- **Windows Firewall** controls inbound and outbound network traffic on devices. For more information, see [Windows Firewall with advanced security](/windows/security/operating-system-security/network-security/windows-firewall). ## How attack surface reduction fits into Defender for Endpoint