Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Turn on cloud protection in Microsoft Defender Antivirus

4 September 2026Doc update+63 / −41 lines

In brief

The article now provides clearer GPMC navigation, separates MAPS configuration steps, adds local Group Policy guidance, and updates the MAPS/cloud-delivered protection note and links.

What Defender admins need to know

Administrators have more precise instructions for configuring cloud protection through centralized or local Group Policy; no configuration change is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Turn on cloud protection in Microsoft Defender Antivirus

Diagram of Defender for Endpoint features that depend on cloud protection, such as tamper protection, block at first sight, and ASR rules.

The following table summarizes the features and capabilities that depend on cloud protection:

Feature/Capability Subscription requirement Description
Checking against metadata in the cloud. The Microsoft Defender Antivirus cloud service uses machine learning models as an extra layer of defense. These machine learning models include metadata, so when a suspicious or malicious file is detected, its metadata is checked.

To learn more, see Blog: Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection		 Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5)
Cloud protection and sample submission. Files and executables can be sent to the Microsoft Defender Antivirus cloud service for detonation and analysis. Automatic sample submission relies on cloud protection, although it can also be configured as a standalone setting.

To learn more, see Cloud protection and sample submission in Microsoft Defender Antivirus.		 Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5)
Tamper protection. Tamper protection helps protect against unwanted changes to your organization's security settings.

To learn more, see Protect security settings with tamper protection.		 Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5)
Block at first sight
Block at first sight detects new malware and blocks it within seconds. When a suspicious or malicious file is detected, block at first sight capabilities queries the cloud protection backend and applies heuristics, machine learning, and automated analysis of the file to determine whether it's a threat.

To learn more, see What is "block at first sight"?What is "block at first sight"?		 Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5)
Emergency signature updates. When malicious content is detected, emergency signature updates and fixes are deployed. Rather than wait for the next regular update, you can receive these fixes and updates within minutes.

To learn more about updates, see Microsoft Defender Antivirus security intelligence and product updates.		 Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5)
Endpoint detection and response (EDR) in block mode. EDR in block mode provides extra protection when Microsoft Defender Antivirus isn't the primary antivirus product on a device. EDR in block mode remediates artifacts found during EDR-generated scans that the non-Microsoft, primary antivirus solution might have missed. When enabled for devices with Microsoft Defender Antivirus as the primary antivirus solution, EDR in block mode provides the added benefit of automatically remediating artifacts identified during EDR-generated scans.

To learn more, see EDR in block mode.		 Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5)
Attack surface reduction (ASR) rules. ASR rules block risky behavior from apps. Some ASR rules require cloud protection. For m9ore information, see Requirements for ASR rules. Microsoft Defender for Endpoint Plan 1 or Plan 2 (Standalone or included in a plan like Microsoft 365 E3 or E5)
Indicators of compromise (IoCs). In Defender for Endpoint, IoCs can be configured to define the detection, prevention, and exclusion of entities. Examples:
"Allow" indicators can be used to define exceptions to antivirus scans and remediation actions.
"Alert and block" indicators can be used to prevent files or processes from executing.

To learn more, see Create indicators.		 Microsoft Defender for Endpoint Plan 2 (Standalone or included in a plan like Microsoft 365 E5)

Methods to configure cloud protection

You can turn Microsoft Defender Antivirus cloud protection on or off by using one of the following methods:

Use Group Policy to turn on cloud protection

To enable cloud protection by using Group Policy, perform the following steps:

  1. On

    To enable cloud protection by using Group Policy, perform the following steps:

    1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management device, opencomputer.

    2. In the Group Policy Management Console, right-click theGPMC console tree, expand Group Policy ObjectObjects in the forest and domain containing the GPO you want to configureedit.

    3. Right-click the GPO, and then select Edit.

    4. In the Group Policy Management Editor, go to Computer configuration.

    5. Select > Administrative templates.

    6. Expand the tree to > Windows components > Microsoft Defender Antivirus > MAPS.

    1. In the details pane of MAPS, the available settings are:

      To open and configure a cloud protection setting, use any of Microsoft Defender for Endpoint won't work.the following methods:

    • SelectDouble-click the setting.
    • Right-click the setting, and then select OKEdit.
    • Select the setting, and then select Action > Edit.

Enable and configure Join Microsoft Maps

  1. In the details pane of MAPS, open the Join Microsoft MAPS setting.

  2. In the setting window that opens, configure the following options:

    1. Select Enabled.
    2. Join Microsoft MAPS in the Options section: Select one of the following values:
      • Basic MAPS: Basic membership sends basic information to Microsoft about malware and potentially unwanted software that has been detected on your device. Information includes where the software came from (like URLs and partial paths), the actions taken to resolve the threat, and whether the actions were successful.
      • Advanced MAPS: In addition to basic information, advanced membership sends detailed information about malware and potentially unwanted software, including the full path to the software, and detailed information about how the software has affected your device.

    When you're finished, select OK.

Enable and configure Send file samples when further analysis is required

  1. In the details pane of MAPS, open the Send file samples when further analysis is required setting.

  2. In the setting window that opens, configure the following options:

    1. Select Enabled.
    2. Send file samples when further analysis is required in the Options section: Select one of the following values:
      • Send safe samples: Most samples are sent automatically. Files that are likely to contain personal information prompt the user for more confirmation.
      • Send all samples

    When you're finished, select OK.

Use PowerShell cmdlets to turn on cloud protection

The following cmdlets enablecommand in an elevated PowerShell prompt (a PowerShell window you opened by selecting Run as administrator) enables advanced cloud-delivered protection (Microsoft Active Protection Service (MAPS)) reporting and configureconfigures automatic sample submission for all file types: 

Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent SendAllSamples

SubmitSamplesConsent supports the following values:

  • SendSafeSamples: The default, recommended setting. Most samples are sent automatically. Files that are likely to contain personal information result in a prompt for the user to continue, and require confirmation.
  • AlwaysPrompt: Lowers the protection state of the device.
  • NeverSend: Lowers the protection state of the device and disables Block at First Sight.

For more information on how to use PowerShell with Microsoft Defender Antivirus, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Microsoft Defender Antivirus cmdlets. Policy CSP - Defender also has more information specifically on -SubmitSamplesConsent.

See also