Microsoft Defender for Endpoint

Manage the sources for Microsoft Defender Antivirus protection updates

4 September 2026Doc update+40 / −20 lines

In brief

The article refreshes links and updates the Group Policy procedure to use current GPMC navigation and the Microsoft Defender Antivirus > Security Intelligence Updates path. It also documents older policy naming and paths.

What Defender admins need to know

Administrators configuring update source order can follow the revised navigation and links.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Manage the sources for Microsoft Defender Antivirus protection updates

This article describes how to specify from where updates should be downloaded (specifying the update download source order is also known as the fallback order). See Manage Microsoft Defender Antivirus updates and apply baselines article for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).

Important
Microsoft Defender Antivirus Security intelligence updates and platform updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates are SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS
Important
Microsoft Defender Antivirus Security intelligence updates and platform updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates are SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.

There are five locations where you can specify where an endpoint should obtain updates:

~~Microsoft Update~~Microsoft Update

Windows Server Update Service. If you use a Software Update Point (SUP) in Microsoft Configuration Manager, you can transition to co-management and use the Intune internal definition update server option with on-premises WSUS as the update source.

Microsoft Configuration Manager

Network file share Platform updates and engine updates are released on a monthly cadence. Security intelligence updates are delivered multiple times a day, but this delta package doesn't contain an engine update. See Microsoft Defender Antivirus security intelligence and product updates.

Important
If you have set Microsoft Security intelligence page
Important
If you have set Microsoft Security intelligence page updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates and platform updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services). You can, however, set the number of days before protection is reported as out-of-date.
Starting Monday, October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates and platform updates. To learn more, see ~~2019 SHA-2 Code Signing Support requirement for Windows and WSUS~~2019 SHA-2 Code Signing Support requirement for Windows and WSUS.

Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates. The following update source locations and sample scenarios describe when to use each source:

|Microsoft Update|You want your endpoints to connect directly to Microsoft Update. This option is useful for endpoints that irregularly connect to your enterprise network, or if you don't use Windows Server Update Service to manage your updates.| |UNC Share|You have devices that aren't connected to the Internet (such as virtual machines, or VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the VDI deployment guide for how file shares are used in virtual desktop infrastructure (VDI) environments. Platform updates can also be deployed using this method. | |Microsoft Configuration Manager|You're using Microsoft Configuration Manager to update your endpoints.| |Security intelligence updates and platform updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|~~Make sure devices are updated to support SHA-2~~Make sure devices are updated to support SHA-2. Microsoft Defender Antivirus Security intelligence and platform updates are delivered through Windows Update. As of October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively.
Download the latest protection updates because of a recent infection or to help provision a strong, base image for VDI deployment. The security intelligence updates source should be used only as a final fallback source, and not the primary source. It's only to be used if updates can't be downloaded from Windows Server Update Service or Microsoft Update for the configured number of days before protection is reported as out-of-date.|

You can manage the order in which update sources are used with Group Policy, Microsoft Configuration Manager, PowerShell cmdlets, and WMI.

Perform the following steps to configure the update location by using Group Policy:

OnIn Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management ~~machine, open~~computer.
In the ~~Group Policy Management Console. Right-click the~~GPMC console tree, expand Group Policy ~~Object~~Objects in the forest and domain containing the GPO you want to ~~configure~~edit.
Right-click the GPO, and then select Edit.

In the Group Policy Management Editor, go to Computer configuration.
~~Select~~ ~~Policies~~ ~~then~~ > Administrative templates.
~~Expand the tree to~~ > Windows components > ~~Windows~~Microsoft Defender Antivirus > ~~Signature updates~~Security Intelligence Updates.

Note
Group Policy paths before Windows 10, version 2004 (May 2020) might use Windows Defender Antivirus instead of Microsoft Defender Antivirus. Group Policy paths before Windows 10, version 1909 (November 2019) might use Signature Updates instead of Security Intelligence Updates. The older and newer names refer to the same policy locations.

In the details pane of Security Intelligence Updates, the available settings are:

Define the order of sources for downloading security intelligence updates
Define file shares for downloading security intelligence updates
To open and configure a security intelligence update source setting, use any of the following methods:
Double-click the setting.
Right-click the setting, and then select Edit.
Select the setting, and then select Action > Edit.

Tip
You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (gpedit.msc). Navigate to the same path: Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Security Intelligence Updates.

Enable and configure the security intelligence update source order

In the details pane of Security Intelligence Updates, open the Define the order of sources for downloading security intelligence updates setting.

In the setting window that opens, configure the following options:

Select Enabled.

Define the order of sources for downloading security intelligence updates in the Options section: Enter the update sources in the order in which they should be contacted, separated by a single pipe (|). The available values are InternalDefinitionUpdateServer, MicrosoftUpdateServer, MMPC, and FileShares. For example, InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC.

:::image type="content" source="/defender/media/wdav-order-update-sources.png" alt-text="Screenshot of the Group Policy setting that defines the order of security intelligence update sources." lightbox="/defender/media/wdav-order-update-sources.png":::
When you're finished, select OK.

Enable and configure security intelligence update file shares

In the details pane of Security Intelligence Updates, open the Define file shares for downloading security intelligence updates setting.

In the setting window that opens, configure the following options:

Select Enabled.

Define file shares for downloading security intelligence updates in the Options section: Enter the file share sources in the order in which they should be contacted, separated by a single pipe (|). Use standard UNC notation for ~~denoting the~~each path. For ~~example:~~example, \\WindowsFileServer\share-name\object-name|\\host-name2\share-name\object-name.

If you don't enter any paths, the file share source is skipped when the VM downloads updates.

~~Select~~When you're finished, select OK. ~~Selecting~~ OK ~~saves the file share order, which is used when the file share source is referenced in the~~ ~~Define the order of sources...~~ ~~group policy setting.~~