---
title: Defender - Antivirus
slug: defender-antivirus
docTags: 
createdAt: 2026-10-09T19:57:34.301Z
---

# Enterprise

***

## ESM Security Setting - Archive Scanning Policy

**Description**: Allows or disallows scanning of archives.

**Why It's Important**: Archive files can hide malware inside compressed folders. This setting makes sure Defender opens those folders and checks what’s inside—like looking inside a box instead of just scanning the label. SHIELD enables this policy to ensure threats aren’t missed just because they’re zipped up. It’s a simple but important way to catch hidden dangers and keep systems secure.

**Learn More**

- [Defender Policy CSP | 
  Allow Archive Scanning](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowarchivescanning)

***

## ESM Security Setting - Behavior Monitoring Policy

**Description**: Allow Behavior Monitoring: Allowed. Turns on real-time behavior monitoring.

**Why It's Important**: This setting helps Defender catch threats by watching how programs behave—not just by checking if they match known viruses. It’s like having a security guard who doesn’t just check IDs but also watches for suspicious actions. SHIELD enables this policy to strengthen real-time protection and detect threats that traditional scans might miss. It’s a proactive defense that helps stop attacks before they cause damage.

**Learn More**

- [Defender Policy CSP | Allow Behavior Monitoring](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowbehaviormonitoring)

***

## ESM Security Setting - Cloud Protection Policy

**Description**: To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.

**Why It's Important**: This policy turns on cloud protection, allowing Defender to use Microsoft’s cloud intelligence to quickly identify and block new or emerging threats in real time.

**Learn More**

- [Defender Policy CSP | Allow Cloud Protection](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowcloudprotection)

***

## ESM Security Setting - Datagram Processing on Server Policy

**Description**: This setting controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of `DisableDatagramProcessing` will be ignored and default to disabling.

**Why It's Important**: Some servers handle a lot of network traffic, especially using UDP, which is fast but less secure. This setting decides whether Defender should inspect that traffic. Turning it on adds more protection, but it might slow things down. SHIELD enables this policy only when needed to balance security and performance. It’s like choosing whether to scan every package in a busy mailroom—more security, but it could slow things down if not managed carefully.

**Learn More**

- [Defender CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Email Scanning Policy

**Description**: Allows or disallows scanning of email.

**Why It's Important**: Emails are a common way for viruses and malware to sneak into a system—especially through attachments or suspicious links. This setting makes sure Defender checks emails for anything dangerous before it can cause harm. SHIELD enables this policy to block threats at one of the most common entry points. It’s like having a security guard inspect every package that arrives in your inbox—keeping your system safe from hidden dangers.

**Learn More**

- [Defender Policy CSP | Allow Email Scanning](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowemailscanning)

***

## ESM Security Setting - Full Scan on Mapped Network Policy

**Description**: Allows or disallows a full scan of mapped network drives.

**Why It's Important**: Mapped network drives can contain files from other computers or servers, and those files might carry threats. This setting makes sure Defender checks those shared locations during a full scan—like inspecting every room in a building, not just your own office. SHIELD enables this policy to ensure that threats hiding in shared folders don’t go unnoticed. It’s a thorough approach to keeping the entire network environment secure.

**Learn More**

- [Defender Policy CSP | Allow Full Scan on Mapped Network Drives](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowfullscanonmappednetworkdrives)

***

## ESM Security Setting - Full Scan on Removable Drives Policy

**Description**: \[coming soon]

**Why It's Important**: \[coming soon]

**Learn More**

- [Defender Policy CSP | Allow Full Scan Removable Drive Scanning](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx#allowfullscanremovabledrivescanning)

***

## ESM Security Setting - Network Protection Policy

**Description**: This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the Block option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. If you enable this policy with the Audit option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center. If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center. If you do not configure this policy, network blocking will be disabled by default.

**Why It's Important**: This setting helps stop users from accidentally visiting dangerous websites that could steal information or install malware. It works across all apps, not just Edge, and blocks risky connections before they can do harm. SHIELD enables this policy in block mode to actively prevent threats from reaching users. It’s like having a firewall that knows which doors are dangerous and automatically keeps them shut.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Access Protection Policy

**Description**: Allows or disallows Windows Defender On Access Protection functionality. When enabled, Defender actively monitors and scans files in real time as they are opened, saved, or executed. This helps detect and block threats immediately as they interact with the system.

**Why It's Important**: This setting makes sure Defender is always watching for threats in real time. It checks files the moment they’re opened or used, so it can stop malware before it causes harm. SHIELD enables this policy to provide continuous protection without waiting for scheduled scans. It’s like having a guard who checks every item as it enters the building—keeping the system safe around the clock.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Real-time Monitoring Policy

**Description**: Allows or disallows Windows Defender Realtime Monitoring functionality.

**Why It's Important**: This setting keeps Defender watching your system all the time—so it can catch threats the moment they appear. It’s like having a security guard on duty 24/7, ready to stop anything suspicious before it causes harm. SHIELD enables this policy to ensure constant protection against malware, ransomware, and other threats. It’s a critical layer of defense that helps keep systems safe in real time.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Network File Scanning Policy

**Description**: Allows or disallows a scanning of network files.

**Why It's Important**: Files stored on shared network drives can be accessed by many users—and that means they can also carry hidden threats. This setting makes sure Defender checks those files for malware, even if they’re not stored directly on your computer. SHIELD enables this policy to ensure threats don’t slip through shared folders or network drives. It’s like inspecting packages not just in your office, but in the whole building—keeping the entire environment secure.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Scanning Downloaded files Policy

**Description**: Allows or disallows Windows Defender IOAVP Protection functionality.

**Why It's Important**: Downloaded files and email attachments are common ways for malware to sneak into a system. This setting makes sure Defender checks those files right away—like inspecting every package before it’s opened. SHIELD enables this policy to catch threats as soon as they arrive, helping prevent infections before they can spread. It’s a frontline defense that keeps users safe while browsing or checking email.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Script Scanning Policy

**Description**: Allows or disallows Windows Defender Script Scanning functionality.

**Why It's Important**: This policy allows Defender to scan scripts like PowerShell or JavaScript for malicious behavior, helping stop threats that try to run through scripts instead of traditional programs.

**Learn More**

- \[coming soon]

***

## ESM Security Setting - User UI Access Policy

**Description**: Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.

**Why It's Important**: This setting lets users open and interact with the Defender antivirus interface. That means they can see alerts, run scans, and check protection status. If it’s turned off, they won’t get notifications or be able to use the app. SHIELD enables this policy to give users visibility into their device’s protection and allow them to take action when needed. It’s like giving someone access to their dashboard so they can see how secure their system is and respond if something goes wrong.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Signature Check Policy

**Description**: This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. This setting applies to scheduled scans as well as the command line mpcmdrun -SigUpdate, but it has no effect on scans initiated manually from the user interface. If you enable this setting, a check for new definitions will occur before running a scan. If you disable this setting or do not configure this setting, the scan will start using the existing definitions. Supported values:0 (default) - Disabled1 - EnabledOMA-URI Path: . /Vendor/MSFT/Policy/Config/Defender/CheckForSignaturesBeforeRunningScan.

**Why It's Important**: This setting makes sure Defender is using the most up-to-date threat information before it starts scanning. That way, it can catch the newest viruses and malware instead of relying on older data. SHIELD enables this policy to improve the accuracy and effectiveness of every scan. It’s like checking the latest security alerts before inspecting a building—ensuring nothing gets missed.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Cloud Block Level Policy

**Description**: This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see the Windows Defender Antivirus documentation site. Note this feature requires the Join Microsoft MAPS setting enabled in order to function.

**Why It's Important**: This setting decides how strict Defender should be when checking files against Microsoft’s cloud threat intelligence. A higher level means it’s quicker to block anything suspicious, while a lower level is more cautious to avoid false alarms. SHIELD uses the default level to balance strong protection with smooth user experience. It helps catch threats early without being overly aggressive or disruptive.

**Learn More**

- \[coming soon]

***

## ESM Security Setting - Catchup Full Scan Policy

**Description**: This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. If you enable this setting, catch-up scans for scheduled full scans will be disabled. Supported values:0 - Disabled1 - Enabled (default)OMA-URI Path: . /Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan.

**Why It's Important**: Sometimes a scheduled antivirus scan gets missed because the computer was turned off. This setting makes sure Defender runs that scan later when the device is back online—like rescheduling a missed check-up to make sure nothing was overlooked. SHIELD disables this policy so catch-up scans are allowed. It helps maintain consistent protection even when devices aren’t always online at the scheduled time.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Catchup Quick Scan Policy

**Description**: This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. If you disable or do not configure this setting, catch-up scans for scheduled quick scans will be turned off. Supported values:0 - Disabled1 - Enabled (default)OMA-URI Path: . /Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan.

**Why It's Important**: Sometimes a scheduled scan doesn’t happen because the computer was turned off. This setting makes sure Defender runs that scan later, so it doesn’t get skipped entirely. It’s like rescheduling a missed checkup to make sure nothing gets overlooked. SHIELD disables this policy to ensure that scheduled scans are always completed, even if they’re delayed. It helps maintain consistent protection without relying on users to notice or take action.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Core Service ECS Integration Policy

**Description**: Turn off ECS integration for Defender core service.

**Why It's Important**: ECS helps Defender stay up to date with the latest fixes and features, especially ones tailored to your organization. Turning off this connection means Defender might miss out on important updates that could improve security or fix bugs. SHIELD keeps this integration enabled to ensure Defender can receive rapid updates and critical fixes. It’s like staying connected to a central command that sends out emergency instructions when something goes wrong—fast, reliable, and specific to your needs.

**Learn More**

- [Defender CSP | Configuration/Disable Core Service ECS Integration](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisablecoreserviceecsintegration)

***

## ESM Security Setting - Core Service Telemetry Policy

**Description**: Turn off OneDsCollector telemetry for Defender core service.

**Why It's Important**: Telemetry helps Microsoft understand how Defender is working and where improvements are needed. It sends anonymous data about performance and issues so problems can be fixed faster. SHIELD keeps this feature enabled to help ensure Defender runs smoothly and stays up to date. It’s like giving feedback to a mechanic while driving—so they can tune things before a breakdown happens.

**Learn More**

- [Defender CSP | Configuration/Disable Core Service Telemetry](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisablecoreservicetelemetry)

***

## ESM Security Setting - DNS over TCP Parsing Policy

**Description**: This setting disables DNS over TCP Parsing for Network Protection.

**Why It's Important**: DNS traffic usually travels over UDP, but sometimes it uses TCP—especially for larger queries. This setting decides whether Defender should inspect that TCP-based DNS traffic. Leaving it enabled means Defender can catch threats hiding in those requests. SHIELD enables this policy to ensure full visibility into DNS traffic, helping detect and block threats that might use less common paths to sneak in. It’s like checking every hallway in a building, not just the main ones.

**Learn More**

- [Defender CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx)

***

## ESM Security Setting - HTTP Parsing Policy

**Description**: This setting disables HTTP Parsing for Network Protection.

**Why It's Important**: Web traffic often carries threats like phishing links or malware downloads. This setting makes sure Defender checks that traffic for anything suspicious. Leaving it enabled helps catch threats before they reach the system. SHIELD enables this policy to strengthen protection against web-based attacks. It’s like scanning every message that comes through the front door—keeping harmful content out before it can cause trouble.

**Learn More**

- [Defender CSP | 
  Configuration/Disable HTTP Parsing](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisablehttpparsing)

***

## ESM Security Setting - Local Admin Merge Policy

**Description**: When this value is set to false, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings.

**Why It's Important**: This setting prevents local administrators from changing Defender’s security settings on their own. It ensures that only the organization’s approved configurations are used, without any personal tweaks or overrides. SHIELD enables this policy to maintain strict control over antivirus settings and prevent accidental or intentional weakening of protection. It’s like locking down the security system so only central IT can make changes—keeping everything consistent and secure.

**Learn More**

- [Defender CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx)

***

## ESM Security Setting - SSH Parsing Policy

**Description**: This setting disables SSH Parsing for Network Protection.

**Why It's Important**: SSH is often used for secure remote access, but it can also be used to hide malicious activity. This setting makes sure Defender checks SSH traffic for anything suspicious. Leaving it enabled helps catch threats that might try to sneak in through secure channels. SHIELD enables this policy to strengthen protection across all types of network traffic. It’s like inspecting even the secure mailroom—because threats can hide anywhere.

**Learn More**

- [Defender CSP | Configuration/Disable SSH Parsing](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisablesshparsing)

***

## ESM Security Setting - TLS Parsing Policy

**Description**: This setting disables TLS Parsing for Network Protection.

**Why It's Important**: TLS is used to encrypt data sent over the internet, like when visiting secure websites. This setting tells Defender whether to inspect that encrypted traffic for threats. Leaving it enabled helps catch malware hiding in secure connections. SHIELD enables this policy to improve visibility into encrypted traffic and block threats that try to sneak in through secure channels. It’s like scanning sealed packages to make sure nothing dangerous is inside.

**Learn More**

- [Defender CSP | Configuration/Disable TLS Parsing](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisabletlsparsing)

***

## ESM Security Setting - Network Protection Policy

**Description**: This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the Block option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. If you enable this policy with the Audit option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center. If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center. If you do not configure this policy, network blocking will be disabled by default.

**Why It's Important**: This setting helps stop users from accidentally visiting dangerous websites that could steal information or install malware. It works across all apps, not just Edge, and blocks risky connections before they can do harm. SHIELD enables this policy in block mode to actively prevent threats from reaching users. It’s like having a firewall that knows which doors are dangerous and automatically keeps them shut.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Engine Update Channel Policy

**Description**: Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout.

**Why It's Important**: This setting controls when Defender gets its monthly engine updates. Choosing the broad channel means updates are delivered after they’ve been tested on a smaller group of devices—reducing the chance of bugs or disruptions. SHIELD uses this policy to keep systems secure while minimizing risk. It’s like waiting for the second batch of a new product—still fresh, but with fewer surprises.

**Learn More**

- [Defender CSP | Configuration/Engine Updates Channel](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationengineupdateschannel)

***

## ESM Security Setting - Platform Update Channel Policy

**Description**: Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout.

**Why It's Important**: This setting controls how quickly Defender updates are delivered to devices. Choosing the broad channel means updates are sent out after they’ve been tested on a smaller group first—reducing the chance of bugs or disruptions. SHIELD uses this policy to keep systems secure while minimizing risk. It’s like waiting for the second batch of a new product after the first group has tested it—safer, more stable, and still up to date.

**Learn More**

- [Defender CSP | Configuration/Platform Updates Channel](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationplatformupdateschannel)

***

## ESM Security Setting - PUA Protection Policy

**Description**: Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer.

**Why It's Important**: Some apps aren’t outright dangerous but can still slow down your computer, show annoying ads, or sneak in other software. This setting makes sure Defender blocks those kinds of apps before they cause problems. SHIELD enables this policy to keep systems clean and running smoothly by stopping unwanted software from getting installed. It’s like filtering out junk before it clutters up your workspace.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Schedule Randomization Time Policy

**Description**: In Microsoft Defender Antivirus, randomize the start time of the scan to any interval from 0 to 23 hours. This can be useful in virtual machines or VDI deployments.

**Why It's Important**: If lots of devices start scanning at the same time, it can slow everything down—especially in virtual environments. This setting spreads out the scan times so they don’t all run at once. SHIELD enables this policy to reduce system strain and improve performance during scheduled scans. It’s like scheduling appointments throughout the day instead of having everyone show up at once—more efficient and less disruptive.

**Learn More**

- [Defender CSP | Configuration/Randomize Schedule Task Times](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationrandomizescheduletasktimes)

***

## ESM Security Setting - Real Time Scan Direction Policy

**Description**: Controls which sets of files should be monitored. Note if `AllowOnAccessProtection` is not allowed, then this configuration can be used to monitor specific files.

**Why It's Important**: Sometimes a scheduled scan doesn’t happen because the computer was turned off. This setting makes sure Defender runs that scan later, so it doesn’t get skipped entirely. It’s like rescheduling a missed checkup to make sure nothing gets overlooked. SHIELD enables this policy to ensure that scheduled scans are always completed, even if they’re delayed. It helps maintain consistent protection without relying on users to notice or take action.

**Learn More**

- [Defender Policy CSP | 
  Real Time Scan Direction](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-Defender?WT.mc_id=Portal-fx#realtimescandirection)

***

## ESM Security Setting - Remediation for High Severity Threats Policy

**Description**: \[coming soon]

**Why It's Important**: \[coming soon]

**Learn More**

- \[coming soon]

***

## ESM Security Setting - Remediation Action For Low Severity Threats

**Description**: \[coming soon]

**Why It's Important**: Even low-risk threats can cause problems if left unchecked. This setting makes sure Defender isolates those files right away, keeping them from running or spreading. SHIELD enables this policy to maintain a consistent level of protection across all threat levels. It’s like locking away even minor suspicious items until someone can take a closer look—just to be safe.

**Learn More**

- [Microsoft Defender for Endpoint | Configure remediation for Microsoft Defender Antivirus detections](https://learn.microsoft.com/en-us/defender-endpoint/configure-remediation-microsoft-defender-antivirus)

***

## ESM Security Setting - Remediation Action For Moderate Severity Threats

**Description**: \[coming soon]

**Why It's Important**: Moderate threats may not be as dangerous as severe ones, but they can still cause problems or open the door to bigger risks. This setting makes sure Defender isolates those threats right away, keeping them from running or spreading. SHIELD enables this policy to maintain consistent protection across all threat levels. It’s like locking away anything suspicious until it can be safely reviewed—just to be sure.

**Learn More**

- [Microsoft Defender for Endpoint | Configure remediation for Microsoft Defender Antivirus detections](https://learn.microsoft.com/en-us/defender-endpoint/configure-remediation-microsoft-defender-antivirus)

***

## ESM Security Setting - Remediation Action For Severe Threats

**Description**: This policy sets the default remediation action for threats classified as Severe by Microsoft Defender Antivirus. When set to Quarantine, any detected severe threat is automatically moved to a secure quarantine area where it cannot harm the system. This action prevents the threat from executing while allowing administrators to review and restore the file if needed.

**Why It's Important**: Severe threats are the most dangerous—they can steal data, damage systems, or spread quickly. This setting makes sure Defender immediately isolates these threats by moving them to quarantine, where they can’t do any harm. SHIELD enables this policy to protect devices from high-risk malware without delay. It’s like locking a dangerous item in a secure box until experts can decide what to do with it.

**Learn More**

- [Microsoft Defender for Endpoint | Configure remediation for Microsoft Defender Antivirus detections](https://learn.microsoft.com/en-us/defender-endpoint/configure-remediation-microsoft-defender-antivirus)

***

## ESM Security Setting - Scan Parameter Policy

**Description**: Selects whether to perform a quick scan or full scan.

**Why It's Important**: This setting tells Defender to run a quick scan, which checks the places where malware is most likely to hide. It’s faster and uses fewer system resources, making it ideal for regular checks without slowing down the computer. SHIELD uses this policy to balance security and performance. It’s like doing a routine inspection of the most critical areas instead of checking every corner—efficient and effective for everyday protection.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

## ESM Security Setting - Quick Scan Time Policy

**Description**: Selects the time of day that the Windows Defender quick scan should run. Note the scan type will depend on what scan type is selected in the Defender/ScanParameter setting. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120.

**Why It's Important**: This setting tells Defender when to run its regular quick scan. In this case, it’s set to 2:00 AM—an ideal time when most users aren’t actively using their devices. SHIELD uses this schedule to ensure scans happen consistently without interrupting work. It’s like scheduling maintenance during off-hours to keep everything running smoothly without getting in the way.

**Learn More**

- [Defender Policy CSP | Schedule Quick Scan Time](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-Defender?WT.mc_id=Portal-fx#schedulequickscantime)

***

## ESM Security Setting - Scan Day Policy

**Description**: Selects the day that the Windows Defender scan should run. Note the scan type will depends on what scan type is selected in the Defender/ScanParameter setting.

**Why It's Important**: This setting tells Defender which day to run its regular scan. In this case, it’s set to Wednesday, which helps ensure that devices are checked for threats on a consistent weekly schedule. SHIELD uses this policy to maintain routine security checks without disrupting users. It’s like choosing a regular day for maintenance to keep everything running safely and smoothly.

**Learn More**

- [Defender Policy CSP | Schedule Scan Day](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-Defender?WT.mc_id=Portal-fx#schedulescanday)

***

## ESM Security Setting - Schedule Scan Time Policy

**Description**: Selects the time of day that the Windows Defender scan should run. Note the scan type will depends on what scan type is selected in the Defender/ScanParameter setting. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120.

**Why It's Important**: This setting tells Defender when to run its scheduled scan. In this case, it’s set to 2:00 AM, which is a good time because most users aren’t actively using their devices. SHIELD uses this schedule to make sure scans happen regularly without interrupting work. It’s like scheduling cleaning after hours so everything stays safe and efficient without getting in the way.

**Learn More**

- \[coming soon]

***

## ESM Security Setting - Submit Samples Policy

**Description**: Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not, (and if the user has specified never to ask), the UI is launched to ask for user consent (when Defender/AllowCloudProtection is allowed) before sending data.

**Why It's Important**: This setting makes sure Defender sends suspicious files to Microsoft automatically, so they can be analyzed for threats. It helps Microsoft learn about new malware and improve protection for everyone. SHIELD enables this policy to speed up threat detection and response. It’s like reporting a suspicious package to security right away—so they can investigate and prevent harm before it spreads.

**Learn More**

- [Defender Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender?WT.mc_id=Portal-fx)

***

# Privileged

***

## PSM Security Setting - Archive Scanning Policy

**Description**: Allows or disallows scanning of archives.

**Why It's Important**: This policy allows Defender to scan archive files such as ZIP or CAB files, helping detect malware that may be hidden inside compressed folders.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Behavior Monitoring Policy

**Description**: Allows or disallows Windows Defender Behavior Monitoring functionality.

**Why It's Important**: This policy enables behavior monitoring so Defender can watch for suspicious or abnormal activity, helping catch new or unknown threats that don’t yet have a signature.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Cloud Protection Policy

**Description**: To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.

**Why It's Important**: This policy turns on cloud protection, allowing Defender to use Microsoft’s cloud intelligence to quickly identify and block new or emerging threats in real time.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Datagram Processing On Win Server

**Description**: This setting controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of `DisableDatagramProcessing` will be ignored and default to disabling Datagram inspection.

**Why It's Important**: This policy enables datagram processing on Windows Server, allowing SHIELD to inspect UDP traffic for malicious activity that could otherwise bypass standard connection-based monitoring.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Email Scanning Policy 

**Description**: To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.

**Why It's Important**: This policy turns on cloud protection, allowing Defender to use Microsoft’s cloud intelligence to quickly identify and block new or emerging threats in real time.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Full Scan on Mapped Network Drives Policy

**Description**: Allows or disallows a full scan of mapped network drives.

**Why It's Important**: This policy allows Defender to scan mapped network drives during a full scan, helping detect and stop malware that may be stored or shared across network locations.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Full Scan Removable Drives Policy 

**Description**: Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.

**Why It's Important**: This policy allows Defender to include removable drives, like USBs and external hard drives, in full scans. It helps detect and remove malware that could spread through portable media.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Network Protection Down Level

**Description**: This setting controls whether Network Protection is allowed to be configured into block or audit mode on windows downlevel of RS3. If false, the value of `EnableNetworkProtection` will be ignored.

**Why It's Important**: This policy enables Network Protection on down-level Windows versions, allowing SHIELD to extend malicious traffic blocking and auditing to older devices that still require protection.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Allow On Access Protection

**Description**: Allows or disallows Windows Defender On Access Protection functionality.

**Why It's Important**: This policy enables On Access Protection, ensuring SHIELD scans files in real time as they are opened or executed to block malware before it can run.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Realtime Monitoring Policy

**Description**: Allow Scanning Network Files: Allowed. Scans network files.

**Why It's Important**: Allows or disallows a scanning of network files.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Scanning Network Files Policy

**Description**: Allows or disallows a scanning of network files.

**Why It's Important**: This policy allows Defender to scan files stored on network shares, helping detect and block malware that could spread through shared folders or servers.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Scanning Downloaded files Policy

**Description**: Allows or disallows Windows Defender IOAVP Protection functionality.

**Why It's Important**: This policy makes Defender scan all downloaded files and email attachments, helping prevent malware from spreading through web downloads or phishing messages.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Script Scanning Policy

**Description**: Allows or disallows Windows Defender Script Scanning functionality.

**Why It's Important**: This policy allows Defender to scan scripts like PowerShell or JavaScript for malicious behavior, helping stop threats that try to run through scripts instead of traditional programs.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - User UI Access Policy

**Description**: Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.

**Why It's Important**: This policy lets users open the Defender interface so they can view protection status, scan results, and security notifications directly on their device.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Check For Signatures Before Running Scan Policy

**Description**: This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. This setting applies to scheduled scans as well as the command line `mpcmdrun -SigUpdate`, but it has no effect on scans initiated manually from the user interface. If you enable this setting, a check for new definitions will occur before running a scan. If you disable this setting or do not configure this setting, the scan will start using the existing definitions. 

**Why It's Important**: This policy makes Defender check for the latest threat definitions before each scan. It helps SHIELD ensure every scan uses the most up-to-date protection to detect the newest threats.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Cloud Block Level Policy

**Description**: This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see the Windows Defender Antivirus documentation site. Note: This feature requires the Join Microsoft MAPS setting enabled in order to function.

**Why It's Important**: This policy makes Defender use its highest protection level in the cloud, helping SHIELD block suspicious files immediately before they can cause harm. It gives faster protection by using Microsoft’s cloud intelligence to detect new or rare threats.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Disable Full Catch Up Scan Policy

**Description**: This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. If you enable this setting, catch-up scans for scheduled full scans will be disabled. Supported values:0 - Disabled1 - Enabled (default)OMA-URI Path: . /Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan.

**Why It's Important**: This policy makes sure a full Defender scan still runs if a scheduled scan was missed, such as when a device was turned off. It helps SHIELD keep devices fully checked for malware without depending on users to start scans manually.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Disable Catchup Quick Scan

**Description**: This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. If you disable or do not configure this setting, catch-up scans for scheduled quick scans will be turned off. Supported values:0 - Disabled1 - Enabled (default)OMA-URI Path: . /Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan.

**Why It's Important**: This policy ensures catch-up quick scans run if a scheduled scan is missed, allowing SHIELD to maintain regular malware detection even when devices are offline at scan time.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Core Service ECS Integration Policy

**Description**: Turn off ECS integration for Defender core service.

**Why It's Important**: This policy disables Defender ECS integration, ensuring SHIELD prevents unapproved configuration changes and maintains strict control over how fixes and updates are applied.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Core Service Telemetry Policy

**Description**: Turn off `OneDsCollector` telemetry for Defender core service.

**Why It's Important**: This policy disables Defender core service telemetry collection, allowing SHIELD to reduce unnecessary data exposure while maintaining control over what security information is shared externally.

**Learn More**

- [Defender CSP | Configuration/Disable Core Service Telemetry](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisablecoreservicetelemetry)

***

## PSM Security Setting - Dns Over Tcp Parsing Policy

**Description**: This setting disables DNS over TCP Parsing for Network Protection.

**Why It's Important**: This policy keeps DNS over TCP parsing enabled for Defender Network Protection, allowing SHIELD to detect and block malicious domains even when attackers try to tunnel traffic over DNS.

**Learn More**

- [Defender CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx)

***

## PSM Security Setting - Http Parsing Policy

**Description**: This setting disables HTTP Parsing for Network Protection

**Why It's Important**: This policy keeps HTTP parsing enabled for Defender Network Protection, allowing SHIELD to inspect web traffic and block malicious connections delivered over HTTP.

**Learn More**

- [Defender CSP | Configuration/Disable HTTP Parsing](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationdisablehttpparsing)

***

## PSM Security Setting - Local Admin Merge Policy

**Description**: When this value is set to false, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings.

**Why It's Important**: This policy disables local admin merge, ensuring SHIELD prevents administrators from overriding centralized Defender policies and weakening security controls.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - SSH Parsing Policy

**Description**: This setting disables SSH Parsing for Network Protection.

**Why It's Important**: This policy keeps SSH parsing enabled for Defender Network Protection, allowing SHIELD to detect and block malicious activity hidden in SSH traffic.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - TLS Parsing Policy

**Description**: This setting disables TLS Parsing for Network Protection.

**Why It's Important**: This policy keeps TLS parsing enabled for Defender Network Protection, allowing SHIELD to inspect encrypted traffic for threats while preventing attackers from hiding malicious activity in TLS sessions.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Low CPU Priority Policy

**Description**: This policy setting allows you to enable or disable low CPU priority for scheduled scans. If you enable this setting, low CPU priority will be used during scheduled scans. If you disable or do not configure this setting, not changes will be made to CPU priority for scheduled scans. Supported values:0 - Disabled (default)1 - Enabled.

**Why It's Important**: This policy disables low CPU priority for scheduled scans, allowing SHIELD to run Defender scans with normal priority to ensure timely and complete threat detection.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Network Protection Policy

**Description**: This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the Block option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. If you enable this policy with the Audit option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center. If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center. If you do not configure this policy, network blocking will be disabled by default.

**Why It's Important**: This policy blocks access to malicious domains through Network Protection, allowing SHIELD to prevent phishing, exploit sites, and other dangerous connections across all applications.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Engine Updates Channel Policy

**Description**: Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout.

**Why It's Important**: \[coming soon]

**Learn More**

- [Defender CSP | Configuration/Engine Updates Channel](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationengineupdateschannel)

***

## PSM Security Setting - Metered Connection Updates Policy

**Description**: Allow managed devices to update through metered connections. Default is 0 - not allowed, 1 - allowed.

**Why It's Important**: This policy allows Defender updates over metered connections, ensuring SHIELD devices stay protected with the latest security intelligence even on restricted networks.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Platform Updates Channel Policy

**Description**: Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout.

**Why It's Important**: This policy sets Defender platform updates to the Current Channel (Broad), allowing SHIELD to keep devices secure with tested updates while minimizing disruption in production.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - PUA Protection Policy 

**Description**: Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer.

**Why It's Important**: This policy blocks potentially unwanted applications, allowing SHIELD to prevent adware, unwanted installers, and other undesirable software from running on devices.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Real Time Scan Direction Policy

**Description**: Controls which sets of files should be monitored. Note if `AllowOnAccessProtection` is not allowed, then this configuration can be used to monitor specific files.

**Why It's Important**: This policy enables Defender to monitor all files in real time, allowing SHIELD to detect and block threats whether files are opened, created, or modified.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Remediation for High Severity Threats Policy

**Description**: \[coming soon]

**Why It's Important**: This policy quarantines severe threats, allowing SHIELD to immediately contain high-risk files while preventing execution until administrators confirm removal.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Remediation Action For Low Severity Threats

**Description**: \[coming soon]

**Why It's Important**: This policy quarantines low-severity threats, enabling SHIELD to block potentially unwanted files from running while allowing administrators to review and decide on further action.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Remediation Action For Moderate Severity Threats

**Description**: \[coming soon]

**Why It's Important**: This policy quarantines moderate-severity threats, allowing SHIELD to contain suspicious files safely while preventing them from executing until further review.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Remediation Action For Severe Threats

**Description**: \[coming soon]

**Why It's Important**: This policy quarantines severe threats, allowing SHIELD to immediately contain high-risk files while preventing execution until administrators confirm removal.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Scan Parameter Policy

**Description**: Selects whether to perform a quick scan or full scan.

**Why It's Important**: This policy configures Defender to run full scans, allowing SHIELD to check all files and processes on a device as part of scheduled threat detection.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Schedule Scan Day Policy

**Description**: Selects the day that the Windows Defender scan should run. Note The scan type will depends on what scan type is selected in the Defender/ScanParameter setting.

**Why It's Important**: This policy makes sure Defender scans run on a consistent day each week, helping SHIELD maintain regular threat detection across devices.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Schedule Scan Time Policy

**Description**: Selects the time of day that the Windows Defender scan should run. Note The scan type will depends on what scan type is selected in the Defender/ScanParameter setting. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is

**Why It's Important**: \[coming soon]

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Randomize Schedule Task Times Policy

**Description**: This setting allows you to configure the scheduler randomization in hours. The randomization interval is \[1 - 23] hours. For more information on the randomization effect please check the `RandomizeScheduleTaskTimes` setting.

**Why It's Important**: This policy randomizes Defender scheduled tasks, helping SHIELD reduce predictability that attackers could exploit while maintaining consistent security scans.

**Learn More**

- [Defender CSP | Configuration/Scheduler Randomization Time](https://learn.microsoft.com/en-us/windows/client-management/mdm/defender-csp?WT.mc_id=Portal-fx#configurationschedulerrandomizationtime)

***

## PSM Security Setting - Samples Consent Policy

**Description**: Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not, (and if the user has specified never to ask), the UI is launched to ask for user consent (when Defender/AllowCloudProtection is allowed) before sending data.

**Why It's Important**: This policy ensures Defender automatically submits samples, helping SHIELD improve threat detection and response without relying on user consent prompts.

**Learn More**

- \[coming soon]