Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Create indicators for certificates in Microsoft Defender for Endpoint

4 September 2026Doc update+8 / −7 lines

In brief

The article now explicitly explains creating certificate-based indicators to allow or block signed applications, adds steps from the Settings page, updates the cloud protection link, identifies the Microsoft Defender for Endpoint evaluation pipeline, and expands the IoC wording.

What Defender admins need to know

Administrators have clearer setup guidance and references for certificate indicators, including their precedence over file hash allow indicators and the potential three-hour processing time.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create indicators for certificates in Microsoft Defender for Endpoint

You canThis article shows you how to create certificate-based indicators in Microsoft Defender for certificates.Endpoint to allow or block signed applications. Some common use cases include:

  • Scenarios when you need to deploy blocking technologies, such as attack surface reduction rules but need to allow behaviors from signed applications by adding the certificate in the allowlist.
  • Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Microsoft Defender Antivirus prevents file executions (block and remediate), and automated investigation and remediation behaves the same.

It's important to understand the following requirements before creating indicators for certificates:

  • This feature is available if your organization uses Microsoft Defender Antivirus (in active mode) and cloud-based protection is enabled. For more information, see Manage cloud-based protectionManage cloud-based protection.
  • The anti-malware client version must be 4.18.1901.x or later.
  • Supported on machines on Windows 10, version 1703 or later, Windows Server 2012 R2 and later, or Azure Stack HCI OS, version 23H2 and later.

Create an indicator for certificates from the settings page

Use the following steps to create a certificate indicator from the Settings page.

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).