Microsoft Defender for Endpoint
Endpoint protectionEvaluate Network Protection
In brief
The article now says to use Event Viewer and filter for Event ID 1125 to review blocked apps, and specifies that the prerequisite guidance applies when malicious sites are not detected. The publication date and custom metadata were also updated.
What Defender admins need to know
Administrators have clearer guidance for reviewing blocked applications and troubleshooting malicious-site detection.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Review network protection events in Windows Event Viewer
To review apps that would have been blocked,blocked apps, open Event Viewer and filterViewer. Filter for Event ID 1125 in the Microsoft-Windows-Windows Defender/Operational log. The following table lists all network protection events.
| Event ID | Provide/Source | Description |
|---|
Troubleshooting Network Protection
If network protection fails to detect,detect malicious sites, make sure that the following prerequisites are enabled:
- Microsoft Defender Antivirus is the primary antivirus app (active mode)
@@ -12,11 +12,11 @@ ms.collection: - m365-security - tier2 - mde-asr-ms.date: 06/16/2026+ms.date: 07/03/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016 ai-usage: ai-assisted ---@@ -57,7 +57,7 @@ To verify audit mode behavior, visit a simulated malicious site and confirm that ## Review network protection events in Windows Event Viewer -To review apps that would have been blocked, open Event Viewer and filter for Event ID 1125 in the Microsoft-Windows-Windows Defender/Operational log. The following table lists all network protection events.+To review blocked apps, open Event Viewer. Filter for Event ID 1125 in the Microsoft-Windows-Windows Defender/Operational log. The following table lists all network protection events. | Event ID | Provide/Source | Description | |---|---|---|@@ -67,7 +67,7 @@ To review apps that would have been blocked, open Event Viewer and filter for Ev ### Troubleshooting Network Protection -If network protection fails to detect, make sure that the following prerequisites are enabled:+If network protection fails to detect malicious sites, make sure that the following prerequisites are enabled: 1. Microsoft Defender Antivirus is the primary antivirus app (active mode)