@@ -7,10 +7,10 @@ ms.topic: how-to author: chrisda ms.author: chrisda ms.reviewer: yongrhee-ms.date: 07/02/2026-ms.custom: nextgen, msecd-doc-authoring-1016+ms.date: 08/12/2026+ms.custom: nextgen, msecd-doc-authoring-1015 ms.subservice: ngp-ms.collection: +ms.collection: - m365-security - tier2 - mde-ngp@@ -20,15 +20,16 @@ appliesto: - Microsoft Defender Antivirus ai-usage: ai-assisted+#customer intent: As a security administrator, I want to select a cloud protection level so that Microsoft Defender Antivirus applies the appropriate cloud blocking sensitivity. ----# Specify the cloud protection level +# Specify the cloud protection level Cloud protection works together with Microsoft Defender Antivirus to deliver protection to your devices faster than through traditional security intelligence updates. You can configure your level of cloud protection by using Microsoft Intune (recommended) or Group Policy. ## Prerequisites -### Supported operating systems +### Supported operating systems Cloud protection level configuration is supported on the following operating systems: @@ -55,32 +56,40 @@ To specify the level of cloud protection for an existing policy in Microsoft Int Perform the following steps to specify the level of cloud protection by using Group Policy: -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).+1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer. -1. Right-click the Group Policy Object you want to configure, and then select **Edit**.+1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit. -1. In the **Group Policy Management Editor**, go to **Computer Configuration** \> **Administrative templates**.+1. Right-click the GPO, and then select **Edit**. -1. Expand the tree to **Windows Components** \> **Microsoft Defender Antivirus** \> **MpEngine**.+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **MpEngine**. -1. Double-click the **Select cloud protection level** setting, and set it to **Enabled**. + > [!NOTE]+ > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Antivirus instead of _Microsoft_ Defender Antivirus. Both names refer to the same policy location. -1. Under **Select cloud blocking level**, set the level of protection:+1. In the details pane of **MpEngine**, open the **Select cloud protection level** setting. To open the setting, use any of the following methods:+ - Double-click the setting.+ - Right-click the setting, and then select **Edit**.+ - Select the setting, and then select **Action** \> **Edit**. - - **Default blocking level** provides strong detection without increasing the risk of detecting legitimate files.- - **Moderate blocking level** provides moderate only for high confidence detections- - **High blocking level** applies a strong level of detection while optimizing client performance (but can also give you a greater chance of false positives).- - **High + blocking level** applies extra protection measures (might affect client performance and increase your chance of false positives).- - **Zero tolerance blocking level** blocks all unknown executables.+1. In the setting window that opens, configure the following options:+ 1. Select **Enabled**.+ 1. Under **Select cloud blocking level**, select one of the following protection levels:+ - **Default blocking level** provides strong detection without increasing the risk of detecting legitimate files. - > [!CAUTION]- > If you're using [Resultant Set of Policy with Group Policy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn789183(v=ws.11)) (RSOP), and **Default blocking level** is selected, it can produce misleading results, as a setting with a `0` value is read as disabled by RSOP. You can instead confirm the registry key is present in `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine` or use [GPresult](/windows-server/administration/windows-commands/gpresult).+ > [!CAUTION]+ > If you're using [Resultant Set of Policy with Group Policy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn789183(v=ws.11)) (RSOP), selecting **Default blocking level** can produce misleading results, as a setting with a `0` value is read as disabled by RSOP. Instead, you can confirm the registry key is present in `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine` or use [GPresult](/windows-server/administration/windows-commands/gpresult). -1. Select **OK**.+ - **Moderate blocking level** provides moderate protection only for high-confidence detections.+ - **High blocking level** applies a strong level of detection while optimizing client performance, but can also increase the chance of false positives.+ - **High + blocking level** applies more protection measures, which might affect client performance and increase the chance of false positives.+ - **Zero tolerance blocking level** blocks all unknown executables. -1. Deploy your updated Group Policy Object. For deployment steps, see [Group Policy Management Console](/windows/win32/srvnodes/group-policy).+ When you're finished, select **OK**. > [!TIP]+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus** \> **MpEngine**.+> > Are you using Group Policy Objects on premises? See how they translate in the cloud. [Analyze your on-premises group policy objects using Group Policy analytics in Microsoft Intune](/intune/intune-service/configuration/group-policy-analytics). ## Related content@@ -88,6 +97,3 @@ Perform the following steps to specify the level of cloud protection by using Gr For more information about cloud protection, see the following resource: - [Turn on cloud protection in Microsoft Defender Antivirus](enable-cloud-protection-microsoft-defender-antivirus.md)---
Microsoft Defender for Endpoint
Endpoint protection
View on Microsoft Learn