Microsoft Defender for Endpoint
Endpoint protectionControlled Folder Access Overview
In brief
The article now points to an updated Windows Security Protection History URL and removes the Microsoft Volume Licensing Reference Guide link.
What Defender admins need to know
No administrator action is required; use the updated links when consulting the article.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
When an app with an unknown reputation triggers CFA, the following events happen:
- A pop-up notification appears on the device. For example,
Controlled folder access blocked C:\...\ApplicationName... from making changes to memory.You can customize the information in the notification. For more information, seeCustomize contact information in Windows SecurityCustomize contact information in Windows Security. - A
Protected memory access blockedentry appears on theProtection History page of the Windows Security appProtection History page of the Windows Security app on the device. - The block or audit is recorded as an event that you can monitor.
CFA works best with Microsoft Defender for Endpoint, which provides detailed reporting on events and blocks as part of the usual alert investigation scenarios.
Advanced management capabilities aren't available with other licenses (for example, Windows Professional or Microsoft 365 E3). However, you can develop your own monitoring and reporting tools based on the CFA events generated in Windows Event Viewer on each device (for example, Windows Event Forwarding).
To learn more about Windows licensing, see Windows Licensing and get the Microsoft Volume Licensing Reference Guide.
Supported operating systems for CFA
@@ -39,8 +39,8 @@ CFA is based on the following elements: When an app with an unknown reputation triggers CFA, the following events happen: -- A pop-up notification appears on the device. For example, `Controlled folder access blocked C:\...\ApplicationName... from making changes to memory.` You can customize the information in the notification. For more information, see [Customize contact information in Windows Security](/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information).-- A `Protected memory access blocked` entry appears on the [Protection History page of the Windows Security app](https://support.microsoft.com/windows/protection-history-f1e5fd95-09b4-46d1-b8c7-1059a1e09708) on the device.+- A pop-up notification appears on the device. For example, `Controlled folder access blocked C:\...\ApplicationName... from making changes to memory.` You can customize the information in the notification. For more information, see [Customize contact information in Windows Security](/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information).+- A `Protected memory access blocked` entry appears on the [Protection History page of the Windows Security app](https://support.microsoft.com/Windows/Security/Windows-Security/protection-history-in-the-windows-security-app) on the device. - The block or audit is recorded as an event that you can [monitor](controlled-folder-access-monitor.md). CFA works best with [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md), which provides detailed reporting on events and blocks as part of the usual [alert investigation scenarios](investigate-alerts.md).@@ -65,7 +65,7 @@ CFA requires Microsoft Defender Antivirus as the primary antivirus app on Window Advanced management capabilities aren't available with other licenses (for example, Windows Professional or Microsoft 365 E3). However, you can develop your own monitoring and reporting tools based on the CFA events generated in Windows Event Viewer on each device (for example, [Windows Event Forwarding](/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection)). - To learn more about Windows licensing, see [Windows Licensing](https://www.microsoft.com/licensing/product-licensing/windows) and get the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/download/details.aspx?id=11091).+ To learn more about Windows licensing, see [Windows Licensing](https://www.microsoft.com/licensing/product-licensing/windows). ## Supported operating systems for CFA