Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Endpoint protection

Review or Edit Your Next-Generation Protection Policies in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

1 October 2026Doc update+16 / −16 lines

In brief

The article now clarifies when to use the Defender portal or Intune admin center, adds links to both portals, and improves wording, formatting, and policy-setting descriptions.

What Defender admins need to know

No administrator action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Review or edit your next-generation protection policiesEdit Your Next-Generation Protection Policies in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

In Defender for Business, next-generation protection includes robust antivirus and anti-malware protection for computers and mobile devices. Default policies with recommended settings are included in Defender for Business. The default policies are designed to protect your devices and users without hindering productivity. However, you can customize your policies to suit your business needs.

You can choose from several options for managing your next-generation protection policies:

  • Use the Microsoft Defender portal at https://security.microsoft.com (recommended, which we recommend if you're using the standalone version of Defender for Business without Intune); orIntune.
  • Use the Microsoft Intune admin center at https://intune.microsoft.com (available. Use this admin center if your subscription includes Intune)Intune.

Microsoft Defender portal

  1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.

  2. In the navigation pane, go to Endpoints > Configuration management > Device configuration. Policies are organized by operating system and policy type.

  3. Select an operating system tab (suchtab, such as Windows).

  4. Under Next-generation protection, view your list of policies. At a minimum, it lists a default policy usingthat uses recommended settings is listed.settings. This default policy is assigned to all onboarded devices running the operating system you selected in the previous step (suchstep, such as Windows). You can:

    • Keep your default policy as currently configured.
    • Edit your default policy to make any needed adjustments.
    • Create a new policy.

  5. Use one of the procedures in the following table:procedures:

    Task Procedure
    Edit your default policy 1. In the Next-generation protection section, select your default policy, and then choose Edit.2. On the General information step, review the information. If necessary, edit the description, and then select Next.3. On the Device groups step, either use an existing group, or set up a new group. Then choose Next.4. On the Configuration settings step, review and if necessary, edit your security settings, and then choose Next. For more information about the settings, see Next-generation protection settings and options (in this article).5. On the Review your policy step, review your current settings. Select Edit to make any needed changes. Then select Update policy.
    Create a new policy 1. In the Next-generation protection section, select Add.2. On the General information step, specify a name and description for your policy. You can also keep or change a policy order (seeorder. See Understand policy order in Microsoft Defender for Business). Then select Next.3. On the Device groups step, you can either use an existing group, or create up a new group (seegroup. See Device groups in Microsoft Defender for Business). Then choose Next.4. On the Configuration settings step, review and edit your security settings, and then choose Next. For more information about the settings, see Next-generation protection settings and options (in this article).options.5. On the Review your policy step, review your current settings. Select Edit to make any needed changes. Then select Create policy.

Intune admin center

  1. Go to the Microsoft Intune admin center (Microsoft Intune admin center) and sign in.
  2. Select Endpoint security.
  3. Select Antivirus to view your policies in that category.
  4. Select an individual policy to edit. | Block at first sight | Enabled by default. Blocks malware within seconds of detection, increases the time (in seconds) allowed to submit sample files for analysis, and sets your detection level to High. We recommend keeping block at first sight turned on. When block at first sight is turned on, it configures the following settings for Microsoft Defender Antivirus:
    - Blocking and scanning of suspicious files is set to the High blocking level (CloudBlockLevel).
    - The number of seconds for a file to be blocked and checked is set to 50 seconds (CloudExtendedTimeout).

    Important If block at first sight is turned off, it affects CloudBlockLevel and CloudExtendedTimeout for Microsoft Defender Antivirus. | | Turn on network protection | Enabled in Block mode by default. Protects against phishing scams, exploit-hosting sites, and malicious content on the internet. It also prevents users from turning network protection off. Network protection can be set to the following modes:
    - Block mode is the default setting. It prevents users from visiting sites considered unsafe. We recommend keeping network protection set to Block mode.
    - Audit mode allows users to visit sites that might be unsafe and tracks network activity to/from such sites.
    - Disabled mode doesn't block users from visiting sites that might be unsafe and doesn't track network activity to or from such sites. | | Remediation | | | Action to take on potentially unwanted apps (PUA) | Enabled by default. Blocks items detected as PUA. PUA can include advertising software;software, bundling software that offers to install other, unsigned software;software, and evasion software that attempts to evade security features. Although PUA isn't necessarily a virus, malware, or other type of threat, it can affect device performance. You can set PUA protection to the following modes:
    - Enabled is the default setting. It blocks items detected as PUA on devices. We recommend keeping PUA protection enabled.
    - Audit mode takes no action on items detected as PUA.
    - Disabled doesn't detect or take action on items that might be PUA. | | Scan | | | Scheduled scan type | Enabled in Quickscan mode by default. Specify a day and time to run weekly antivirus scans. The following scan type options are available:
    - Quickscan checks locations, such as registry keys and startup folders, where malware could be registered to start along with a device. We recommend using the quickscan option.
    - Fullscan checks all files and folders on a device.
    - Disabled means no scheduled scans take place. Users can still run scans on their own devices. (InIn general, we don't recommend disabling scheduled scans.)

    Learn more about scan types. | | Day of week to run a scheduled scan | Select a day for your regular, weekly antivirus scans to run. | | Time of day to run a scheduled scan | Select a time to run your regularly scheduled antivirus scans to run. | | Use low performance | This setting is turned off by default. We recommend keeping this setting turned off. However, you can turn on this setting to limit the device memory and resources used during scheduled scans. Important: If you turn on Use low performance, it configures the following settings for Microsoft Defender Antivirus:
    - >AllowArchiveScanning: Archive files aren't scanned.
    - EnableLowCPUPriority: Scans are assigned a low CPU priority.
    - DisableCatchupFullScan: No catch-ups scans if a full antivirus scan is missed.
    - DisableCatchupQuickScan: No catch-ups scans if a quick antivirus scan is missed.
    - AvgCPULoadFactor: Reduce the average CPU load factor during an antivirus scan from 50 percent to 20 percent. | | User experience | | | Allow users to access the Windows Security app | Enable users to open the Windows Security app on their devices. Users can't override settings that you configure in Defender for Business, but they can run a quick scan or view any detected threats. | | Antivirus exclusions | Exclusions are processes, files, or folders skipped by Microsoft Defender Antivirus scans. In general, you shouldn't need to define exclusions. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behavior and typical management files. Every exclusion reduces your level of protection, so it's important to consider carefully what exclusions to define. Before you add any exclusions, see Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus. | | Process exclusions | Prevent Microsoft Defender Antivirus from scanning files opened by specific processes. When you add a process to the process exclusion list, Microsoft Defender Antivirus doesn't scan files opened by that process. The process itself is scanned unless it's in the file exclusion list. For more information, see Process exclusions. | | File and folder exclusions | Prevent Microsoft Defender Antivirus from scanning files by name, location, or extension. For more information, see File and folder exclusions. | | Contextual exclusions | Prevent Microsoft Defender Antivirus from scanning the file or folder only in a specific context (forcontext, for example, a specific process accesses the file or only during a specific type of scan).scan. For more information, see Contextual exclusions. |

Other preconfigured settings in Defender for Business

TheDefender for Business preconfigures the following security settings are preconfigured in Defender for Business:settings:

How default settings in Defender for Business correspond to settings in Microsoft Intune

The following table describes preconfigured settings for Defender for Business and how those settings correspond to what you might see in Intune. If you're using use the simplified configuration process in Defender for Business, you don't need to edit these settings.

Setting Description