Microsoft Defender XDR
GeneralExclude assets from automated response in attack disruption
In brief
The article now explains exclusion policies, adds permission requirements for device and identity exclusions, clarifies policy application and IP exclusion steps, and recommends excluding specific assets rather than opting out entirely.
What Defender admins need to know
Administrators can more easily identify required permissions and configure exclusions while limiting the security risk of broad opt-outs.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
[!INCLUDE Microsoft Defender XDR rebranding]
This article provides information on howUse exclusion policies to exclude assets from being automatically contained byprevent automatic attack disruption in Microsoft Defender XDR.XDR from applying selected responses to specific assets.
Automatic attack disruption and exclusion policies work together to help contain and control active cyber threats. AttackAutomatic attack disruption is a built-in extendedin, AI-powered capability that automatically contains ongoing attacks by isolatinganalyzes attacker intent and identifies compromised assets (likeassets. It can isolate devices or disable user accounts) in real time, thereby haltingaccounts to stop an attacker’s progress.ongoing attack. Exclusion policies allowlet security teams to designate certainexempt specific assets or actions to be exempt from these automated responses – forresponses. For example, ensuring that specificyou can prevent critical servers from being isolated or critical accounts are not automatically shut down or isolated –from being disabled to avoid unintended business disruption. You can remove exclusions at any time to allowinclude assets to be included in automated responses again.
Device exclusions
The following table lists the permissions required to manage device exclusions.
| Unified RBAC for endpoints | Required permission |
|---|---|
| Disabled | Security Administrator or Global Administrator role in Microsoft Entra ID or the Microsoft 365 admin center. |
| Enabled | Security Operator (or higher) global Microsoft Entra role, or the Core security settings (manage) permission in Unified RBAC. |
For more information,information about enabling Unified RBAC, see Activate Microsoft Defender XDR Unified RBAC.
Identity exclusions
The following table lists the permissions required to manage identity exclusions.
| Unified RBAC for identities or endpoints | Required permission |
|---|---|
| Disabled (both identities and endpoints) | Security Administrator or Global Administrator role in Microsoft Entra ID or the Microsoft 365 admin center. |
:::image type="content" source="media/automatic-attack-disruption-exclusions/attack-disrupt-devices-tab.png" alt-text="Screenshot of the Devices page in automated response settings for attack disruption" lightbox="media/automatic-attack-disruption-exclusions/attack-disrupt-devices-tab.png":::
In the
PoloicyPolicy application tab, select Exclude IP to exclude an IP address.:::image type="content" source="media/automatic-attack-disruption-exclusions/attack-disrupt-exclude-ip-add.png" alt-text="Screenshot of the IPs tab in automated response settings for attack disruption" lightbox="media/automatic-attack-disruption-exclusions/attack-disrupt-exclude-ip-add-big.png":::
When automatic attack disruption detects with high confidence that a user or device is compromised, it automatically applies containment policies to managed devices in your organization. These policies help contain the threat and stop it from spreading across your environment.
Policy application exclusions give you granular control over how the automatic Attackattack disruption enforcement policies are applied acrossin your environment. It allows customers toThey let you define devices that shouldn't receive specific disruption policies. This provides organizations with the flexibility to protectprotects sensitive, operationally critical, or exception-based systems without fully disabling Automatic Attack Disruption.automatic attack disruption.
Policy applications and exclusions allow you to:
- Keep most disruption controls active while selectively disabling specific protections
- Maintain centralized control over which disruption policy controls are enabled or excluded for each tagged group of devices
First create a tag or use an existing tag to define the device or devices. Then create a rule that applies to that tag. For example, you might create a tag for all servers in a specific department and then create a policy application that applies to that tag. By default, all policy controls are enabled. By configuring a policy application for a tagged devices, you can keep disruption enabled and exclude only specific controls for that group.
Create a tag
To create a tag go to Asset rule management in the Microsoft Defender portal and select Create tag. Provide a name and description for the tag, then define dynamic rules to automatically include devices in the tag based on device properties such as device type, operating system, or other attributes.
Create a policy application:application
Go to the Microsoft Defender portal and sign in.
Go to Settings > Microsoft Defender XDR.
To exclude IP addresses from automated responses,create a policy application rule for tagged devices, follow these steps:
Under Automated responses, select Devices.
:::image type="content" source="media/automatic-attack-disruption-exclusions/create-new-exclusion.png" alt-text="Screenshot of the policy application creation page in automated response settings" lightbox="media/automatic-attack-disruption-exclusions/create-new-exclusion.png":::
Select a tag to apply the policy
toto, and then select Next.Configure the
exclusion policydisruption controls you want to disable for the taggeddevice.devices, and then select Next.:::image type="content" source="media/automatic-attack-disruption-exclusions/policy-application-select-controls.png" alt-text="Screenshot of selecting controls to disable for a policy application rule" lightbox="media/automatic-attack-disruption-exclusions/policy-application-select-controls.png":::
Opting out of automatic attack disruption
Opting out of attack disruption can greatly increase security risk. ConsiderInstead of opting out entirely, consider excluding specific entities instead.to limit automated responses only for selected assets.
If you must opt out of attack disruption, open a support case in the Microsoft Defender portal with the subject Attack disruption opt-out. In your request, specify that you wish to opt out of attack disruption and include a brief explanation about your decision. This feedback helps us improve the feature and better understand customer needs. By opting out, you still receive alerts related to attack disruption but no automated actions are taken.
@@ -1,6 +1,6 @@ --- title: Exclude assets from automated response in attack disruption-description: Learn more about how to exclude identities and devices from being automatically contained from automatic attack disruption.+description: Exclude identities and devices from automatic attack disruption responses in Microsoft Defender XDR to prevent automated containment of selected assets. ms.service: defender-xdr ms.author: guywild author: guywi-ms@@ -11,11 +11,11 @@ ms.collection: - usx-security - usx-security ms.topic: how-to-ms.date: 06/25/2026+ms.date: 08/07/2026 appliesto: - Microsoft Defender XDR ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1015 #customer intent: As a security administrator, I want to learn how to exclude specific assets from being automatically contained by automatic attack disruption in Microsoft Defender XDR, so that I can prevent disruptions to critical assets while still maintaining security. ---@@ -24,9 +24,9 @@ ms.custom: msecd-doc-authoring-1014 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] -This article provides information on how to exclude assets from being automatically contained by [automatic attack disruption](automatic-attack-disruption.md) in Microsoft Defender XDR.+Use exclusion policies to prevent [automatic attack disruption](automatic-attack-disruption.md) in Microsoft Defender XDR from applying selected responses to specific assets. -Automatic attack disruption and exclusion policies work together to help contain and control active cyber threats. Attack disruption is a built-in extended capability that automatically contains ongoing attacks by isolating compromised assets (like devices or user accounts) in real time, thereby halting an attacker’s progress. Exclusion policies allow security teams to designate certain assets or actions to be exempt from these automated responses – for example, ensuring that specific critical servers or accounts are not automatically shut down or isolated – to avoid unintended business disruption. You can [remove exclusions](#remove-exclusions) at any time to allow assets to be included in automated responses again.+Automatic attack disruption and exclusion policies work together to contain active cyber threats. Automatic attack disruption is a built-in, AI-powered capability that analyzes attacker intent and identifies compromised assets. It can isolate devices or disable user accounts to stop an ongoing attack. Exclusion policies let security teams exempt specific assets or actions from these responses. For example, you can prevent critical servers from being isolated or critical accounts from being disabled to avoid unintended business disruption. You can [remove exclusions](#remove-exclusions) at any time to include assets in automated responses again. > [!CAUTION] > Excluding assets from automated responses isn't recommended. It can reduce the effectiveness of automatic attack disruption in protecting your environment from sophisticated, high-impact attacks.@@ -37,15 +37,19 @@ The permissions required to manage attack disruption exclusions depend on whethe ### Device exclusions +The following table lists the permissions required to manage device exclusions.+ | Unified RBAC for endpoints | Required permission | | --- | --- | | **Disabled** | Security Administrator or Global Administrator role in [Microsoft Entra ID](https://entra.microsoft.com) or the [Microsoft 365 admin center](https://admin.microsoft.com). | | **Enabled** | Security Operator (or higher) global Microsoft Entra role, **or** the [Core security settings (manage)](custom-permissions-details.md) permission in Unified RBAC. | -For more information, see [Activate Microsoft Defender XDR Unified RBAC](activate-defender-rbac.md).+For information about enabling Unified RBAC, see [Activate Microsoft Defender XDR Unified RBAC](activate-defender-rbac.md). ### Identity exclusions +The following table lists the permissions required to manage identity exclusions.+ | Unified RBAC for identities or endpoints | Required permission | | --- | --- | | **Disabled** (both identities and endpoints) | Security Administrator or Global Administrator role in [Microsoft Entra ID](https://entra.microsoft.com) or the [Microsoft 365 admin center](https://admin.microsoft.com). |@@ -134,7 +138,7 @@ To exclude an IP address from automated responses: :::image type="content" source="media/automatic-attack-disruption-exclusions/attack-disrupt-devices-tab.png" alt-text="Screenshot of the Devices page in automated response settings for attack disruption" lightbox="media/automatic-attack-disruption-exclusions/attack-disrupt-devices-tab.png"::: -1. In the **Poloicy application** tab, select **Exclude IP** to exclude an IP address.+1. In the **Policy application** tab, select **Exclude IP** to exclude an IP address. :::image type="content" source="media/automatic-attack-disruption-exclusions/attack-disrupt-exclude-ip-add.png" alt-text="Screenshot of the IPs tab in automated response settings for attack disruption" lightbox="media/automatic-attack-disruption-exclusions/attack-disrupt-exclude-ip-add-big.png"::: @@ -148,7 +152,7 @@ To exclude an IP address from automated responses: When automatic attack disruption detects with high confidence that a user or device is compromised, it automatically applies containment policies to managed devices in your organization. These policies help contain the threat and stop it from spreading across your environment. -Policy application exclusions give you granular control over how the automatic Attack disruption enforcement policies are applied across your environment. It allows customers to define devices that shouldn't receive specific disruption policies. This provides organizations with the flexibility to protect sensitive, operationally critical, or exception-based systems without fully disabling Automatic Attack Disruption.+Policy application exclusions give you granular control over how automatic attack disruption enforcement policies are applied in your environment. They let you define devices that shouldn't receive specific disruption policies. This flexibility protects sensitive, operationally critical, or exception-based systems without fully disabling automatic attack disruption. Policy applications and exclusions allow you to: @@ -156,7 +160,7 @@ Policy applications and exclusions allow you to: - Keep most disruption controls active while selectively disabling specific protections - Maintain centralized control over which disruption policy controls are enabled or excluded for each tagged group of devices -First create a tag or use an existing tag to define the device or devices. Then create a rule that applies to that tag. For example, you might create a tag for all servers in a specific department and then create a policy application that applies to that tag. By default, all policy controls are enabled. By configuring a policy application for a tagged devices, you can keep disruption enabled and exclude only specific controls for that group.+First create a tag or use an existing tag to define the devices. Then create a rule that applies to that tag. For example, you might create a tag for all servers in a specific department and then create a policy application that applies to that tag. By default, all policy controls are enabled. By configuring a policy application for tagged devices, you can keep disruption enabled and exclude only specific controls for that group. #### Create a tag @@ -164,13 +168,13 @@ Create a tag to group devices together for a policy application. To create a tag go to Asset rule management in the Microsoft Defender portal and select **Create tag**. Provide a name and description for the tag, then define dynamic rules to automatically include devices in the tag based on device properties such as device type, operating system, or other attributes. -#### Create a policy application:+#### Create a policy application 1. Go to the [Microsoft Defender portal](https://security.microsoft.com) and sign in. 1. Go to **Settings** > **Microsoft Defender XDR**. -To exclude IP addresses from automated responses, follow these steps:+To create a policy application rule for tagged devices, follow these steps: 1. Under **Automated responses**, select **Devices**. @@ -184,9 +188,9 @@ To exclude IP addresses from automated responses, follow these steps: :::image type="content" source="media/automatic-attack-disruption-exclusions/create-new-exclusion.png" alt-text="Screenshot of the policy application creation page in automated response settings" lightbox="media/automatic-attack-disruption-exclusions/create-new-exclusion.png"::: -1. Select a tag to apply the policy to then select **Next**.+1. Select a tag to apply the policy to, and then select **Next**. -1. Configure the exclusion policy you want to disable for the tagged device. then select **Next**.+1. Configure the disruption controls you want to disable for the tagged devices, and then select **Next**. :::image type="content" source="media/automatic-attack-disruption-exclusions/policy-application-select-controls.png" alt-text="Screenshot of selecting controls to disable for a policy application rule" lightbox="media/automatic-attack-disruption-exclusions/policy-application-select-controls.png"::: @@ -222,7 +226,7 @@ To edit or remove a policy application, go to the **Policy application** tab and ## Opting out of automatic attack disruption -Opting out of attack disruption can greatly increase security risk. Consider [excluding specific entities](automatic-attack-disruption-exclusions.md#exclude-user-accounts) instead.+Opting out of attack disruption can greatly increase security risk. Instead of opting out entirely, consider [excluding specific entities](automatic-attack-disruption-exclusions.md#exclude-user-accounts) to limit automated responses only for selected assets. If you must opt out of attack disruption, open a support case in the Microsoft Defender portal with the subject *Attack disruption opt-out*. In your request, specify that you wish to opt out of attack disruption and include a brief explanation about your decision. This feedback helps us improve the feature and better understand customer needs. By opting out, you still receive alerts related to attack disruption but no automated actions are taken.