Daily Defender News
Aboutmerill.net
Microsoft Defender Vulnerability Management
General

Block vulnerable applications with Microsoft Defender Vulnerability Management

4 September 2026Doc update+16 / −14 lines

In brief

The article now describes block and warn actions, prerequisites, file-hash-based indicators, and the updated Advanced features link. Wording was also refined around vulnerable application versions and indicator limits.

What Defender admins need to know

Administrators can use the clarified guidance when configuring or troubleshooting vulnerable application mitigation.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This article explains how to use block and warn mitigation actions in Microsoft Defender Vulnerability Management to temporarily reduce risk from vulnerable application versions while remediation is in progress.

Fixing vulnerabilities takes time. It often depends on the IT team's resources and workload. To reduce risk quickly, security admins can block all known vulnerable versions of an app until the fix is complete. Blocking vulnerable versions gives IT teams time to patch the app without leaving gaps in security.

From a security recommendation, admins can block vulnerable versions of an app as a mitigation step. The system creates file indicators of compromise (IOCs)—file-hash-based detection rules—for each executable in those versions. Microsoft Defender Antivirus then blocks those files on devices in the defined scope.

Choose between block and warn mitigation actions

The block action is intended to block all installed vulnerable versions of thean application identified in a security recommendation from running in your organization from running.organization. For example, if there's an active zero-day vulnerability you can block your users from running the affected software while you determine work-around options.

The warn action is intended to send a warning to your users when they open vulnerable versions of the application. Users can choose to bypass the warning and access the application for subsequent launches.

For both actions, you can customize the message the users see. For example, you can encourage them to install the latest version. Additionally, you can provide a custom URL the users navigate to when they select the notification. The user must select the body of the toast notification in order to navigate to the custom URL. The toast notification can be used to provide more details specific to the application management in your organization.

Version requirements for application blocking

Based on the available data, the block actions take effect on endpoints that have Microsoft Defender Antivirus. Microsoft Defender for Endpoint makes a best-attempt effort of blocking applicable vulnerable applications or versions from running.

If more vulnerabilities are found on a different version of an application, you get a new security recommendation asking you to update thethat application. You can also choose to block the newly identified vulnerable version.

When blocking isn't supported

  • Apps where Microsoft doesn't have enough information to block with high confidence
  • Microsoft Store apps, which can't be blocked because Microsoft signed them

If you try to block an app and the block action isn't enforced, you might have reached the maximum indicator limit. If you've reached the maximum indicator limit, delete old indicators to free up space. Manage indicators.

View remediation activities

A pane opens with details such as the number of vulnerabilities, available exploits, blocked versions, and remediation activities.
  1. Select View details of blocked versions in the Indicator page to go to the Indicators page. ThereOn the Indicators page, you can view file hashes and response actions.

User experience for blocked applications

When users try to access a blocked application, they receive a message informing them that the application was blocked by their organization. The blocked-application message is customizable.

For applications where the warn mitigation option was applied, users receive a message informing them that the application was blocked by their organization. The user can bypass the block for subsequent launches, by choosing "Allow". The "Allow" bypass is only temporary, and the application is blocked again after a while.

End-user updating blocked applications

A common question is, "How does an end user update a blocked app?" The block works by blocking the executable file. Some apps, such as Firefox, use a separate update executable. The block action doesn't block the separate update executable. In other cases, the app might need the main executable to update. If so, you can either set the block to warn mode so the user can bypass it, or, if no vital data is stored on the client, ask the user to delete the app and reinstall it.

Related content