Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
General

Configure Attack Disruption

4 September 2026New feature+17 / −7 lines

In brief

The page now describes automatic device isolation for Microsoft Defender for Endpoint-managed end-user workstations and identifies it as in preview. It adds prerequisites, safeguards, exclusion guidance, and clearer Sense Agent and connector setup instructions.

What Defender admins need to know

Use the updated guidance to verify eligible devices and configure exclusions where needed to avoid unintended isolation.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

ms.topic: how-to ms.service: defender-xdr ms.localizationpriority: medium ms.date: 06/15/08/07/2026 ms.collection:

  • m365-security
  • tier2 ms.custom:
    • msecd-doc-authoring-10141015
    • autoir
    • admindeeplinkDEFENDER
    • sfi-ga-nochange

Microsoft Defender XDR includes powerful automated attack disruption capabilities that can protect your environment from sophisticated, high-impact attacks.

Configure automatic attack disruption capabilities in Microsoft Defender XDR. Before you begin, review the prerequisites for licensing, permissions, and product-specific setup requirements. After you're all set up, you can view and manage containment actions in Incidents and the Action center. And, if necessary, you can make changes to automatic attack disruption settings.

When Microsoft Defender for Endpoint is deployed, automatic attack disruption can contain unmanaged devices and users or automatically isolate a compromised workstation from the network. Automatic device isolation is currently in preview. For details about each response action, see Automated response actions.

Prerequisites

Requirement Details
Subscription requirements One of these subscriptions:
  • Microsoft 365 E5 or A5
  • Microsoft 365 E3 with the Microsoft Defender Suite add-on
  • Microsoft 365 E3 with the Enterprise Mobility + Security E5 add-on
  • Microsoft 365 A3 with the Microsoft 365 A5 Security add-on
  • Windows 10 Enterprise E5 or A5
  • Windows 11 Enterprise E5 or A5
  • Enterprise Mobility + Security (EMS) E5 or A5
  • Office 365 E5 or A5
  • Microsoft Defender for Endpoint (Plan 2)
  • Microsoft Defender for Identity
  • Microsoft Defender for Cloud Apps
  • Defender for Office 365 (Plan 2)
  • Microsoft Defender for Business

See Microsoft Defender XDR licensing requirements.
Deployment requirements
  • Deployment of Defender products (for example, Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps)
    • The wider the deployment, the greater the protection coverage is. For example, if a Microsoft Defender for Cloud Apps signal is used in a certain detection, then this product is required to detect the relevant specific attack scenario.
    • Similarly, each Defender product must be deployed to execute its automated response actions. For example, Microsoft Defender for Endpoint is required to automatically contain a device. an unmanaged device or isolate an onboarded workstation.
  • Microsoft Defender for Endpoint's device discovery is set to 'standardStandard discovery' (prerequisite for the automatic initiation of the "Contain Device" action)device action.
  • For attack disruption actions in external platforms such as Okta or AWS (preview): Microsoft Sentinel analytic workspace connected to the unified security operations portal with the relevant provider connector deployed.
Permissions To configure automatic attack disruption capabilities, you must have one of the following roles assigned in either Microsoft Entra ID (https://portal.azure.com) or in the Microsoft 365 admin center (https://admin.microsoft.com):
  • Global Administrator
  • Security Administrator
  • User Administrator
  • Authentication Administrator
  • Privileged Authentication Administrator
  • Directory Writers
  • Helpdesk Administrator
  • Security Operator
To work with automated investigation and response capabilities, such as by reviewing, approving, or rejecting pending actions, see Required permissions for Action center tasks.

Microsoft Defender for Endpoint prerequisites

To support automatic attack disruption, Microsoft Defender for Endpoint requires a minimum Sense client version and proper automation settings for your device groups.

Automatic device isolation prerequisites and safeguards (preview)

Automatic device isolation works only on end-user workstations that are onboarded and managed by Microsoft Defender for Endpoint. Isolation blocks most network traffic while maintaining connectivity to required Defender for Endpoint security services. The action is scoped to devices involved in the incident and is automatically undone after a defined time window. Security operators can release the device earlier.

If isolated devices need access to specific processes or destinations, configure selective isolation exclusions. To prevent automatic attack disruption from isolating selected devices, configure automatic attack disruption exclusions.

Minimum Sense Client version (MDE client)

The MinimumSense Agent is the Microsoft Defender for Endpoint sensor component that runs on each device. The minimum Sense Agent version required for the Contain User action to work is v10.8470. You can identify the Sense Agent version on a device by running the following PowerShell command: commands.

To verify that Microsoft Defender for Endpoint is installed and determine its installation path, query the registry:

Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection\' -Name "InstallLocation"

OrAlternatively, to confirm the installed sensor version by reading the MsSense DLL version from the registry, run the following command:

Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name "MsSenseDllVersion"