Microsoft Defender best practices

Microsoft Defender is a family of products: Defender for Endpoint on devices, Defender Antivirus inside Windows, Defender Vulnerability Management, and Defender for Office 365 for email and collaboration, with Defender XDR correlating them. This guide covers the settings that decide whether that family actually protects you, ordered roughly by impact.

1. Onboard every device to Defender for Endpoint

Defender for Endpoint protects only the devices that are onboarded to it. The most common gap is coverage: Windows devices registered in Entra ID that have no matching Defender machine record, so no endpoint detection and response (EDR) is watching them. Onboard through Intune with an endpoint detection and response policy so new devices are covered at enrollment, then reconcile your Entra and Intune device lists against the Defender device inventory on a schedule. Require Defender for Endpoint integration in your Intune compliance policy so a device that never onboarded cannot claim to be compliant.

2. Turn on every Defender Antivirus protection

Defender Antivirus runs by default, but several of its strongest layers depend on configuration. Cloud-delivered protection lets Microsoft's cloud make a verdict on new files in seconds; behavior monitoring and script scanning catch attacks that never write a recognizable file; email, archive, network, and removable drive scanning close the common delivery paths. Turn on potentially unwanted application (PUA) blocking and automatic sample submission. Then verify the result on the devices themselves: real-time protection on, malware protection enabled, and security intelligence current. A policy that says "on" is not evidence that a device is protected.

3. Turn on tamper protection

Ransomware operators routinely try to switch off antivirus before they encrypt anything. Tamper protection blocks changes to Defender Antivirus protections from local administrators, scripts, and malware, so that step fails. Turn it on tenant-wide from the Defender portal or through Intune, and treat any device where it is off as a finding.

4. Enforce attack surface reduction rules and Controlled Folder Access

Attack surface reduction (ASR) rules are part of Defender for Endpoint and block the behaviors attackers depend on: Office macros calling Win32 APIs, Office apps creating child processes or executable content, obfuscated scripts, executables from email and webmail, PsExec and WMI process creation, credential theft from LSASS, and ransomware-like file activity. Microsoft names three rules as standard protection with little effect on legitimate work: block abuse of exploited vulnerable signed drivers, block credential stealing from LSASS, and block persistence through WMI event subscription. Put those in block mode now. Run the others in audit mode, review the events in the Defender portal, add narrow exclusions, then move them to block. Controlled Folder Access adds a ransomware guard on user documents.

5. Feed Defender device risk into Conditional Access

Defender for Endpoint scores each device's risk. Intune compliance can require a device to be at or under a machine risk score you choose, and Conditional Access can require a compliant device. Together, a device Defender sees as compromised loses access to Microsoft 365 automatically, without waiting for an analyst. Set the allowed threat level conservatively, and hold privileged users to the requirement first.

6. Let Defender act: EDR in block mode and automated investigation

Turn on EDR in block mode so Defender for Endpoint can remediate malicious artifacts that its behavioral detections find, including on devices where another antivirus product is primary and Defender Antivirus runs in passive mode. Set automated investigation and response to full automation, which Microsoft recommends, so confirmed threats are remediated rather than queued. Review the Action center so you know what Defender did on your behalf.

7. Close the vulnerabilities Defender finds

Defender Vulnerability Management inventories installed software and operating system builds on onboarded devices and raises security recommendations. Prioritize by exploitation, not by count: a recommendation tied to a vulnerability on the CISA Known Exploited Vulnerabilities catalog or with a public exploit comes first. Senserva reads these findings per device and ranks them with CISA KEV and EPSS, alongside the KB articles each device is still missing. Our Microsoft patch tracker and CVE and vulnerability management pages carry the same ranking for every release.

8. Configure Defender for Office 365 for email

Apply Microsoft's preset security policies (Standard or Strict) as the starting point rather than tuning each policy by hand, then confirm the pieces are in force: Safe Links checking URLs at click time, Safe Attachments detonating attachments before delivery, anti-phishing with user and domain impersonation protection and mailbox intelligence, malware filtering, and inbound anti-spam. Senserva checks these against the CISA SCuBA baseline for Exchange Online.

9. Use Secure Score as a work list

Microsoft Secure Score measures how many of Microsoft's recommended controls you have implemented across Defender, Entra ID, and Microsoft 365. Its value is the list of controls earning zero points. Track the score over time rather than chasing a number, and investigate any drop, which usually means a setting changed.

10. Route alerts, hunt, and keep the data

Defender XDR correlates alerts from devices, identities, and email into incidents. Make sure someone owns the incident queue and that notifications reach a monitored mailbox or ticketing system. Advanced hunting in Defender XDR keeps 30 days of data, so stream Defender data to a SIEM such as Microsoft Sentinel for longer history and correlation. Senserva brings Entra, Microsoft 365, Defender, and Sentinel log sources into one model so a gap in coverage shows up before an investigation needs the data.

Frequently asked questions

Onboard every device to Defender for Endpoint and confirm it. Windows devices registered in Entra ID without a matching Defender record get no endpoint detection and response, and no alert reports the gap.

Defender Antivirus is strong when fully configured, with cloud-delivered protection, behavior monitoring, script scanning, and tamper protection on. It is one layer: Defender for Endpoint adds EDR, attack surface reduction, device risk scoring, and automated investigation on top.

Yes, after an audit period. Turn on the three standard protection rules in block mode first, audit the rest long enough to find legitimate exceptions, add narrow exclusions, then switch each rule to block.

A Defender for Endpoint feature that lets behavioral detections block and remediate malicious artifacts, including on devices where another antivirus product is primary and Defender Antivirus runs in passive mode.

Advanced hunting in Defender XDR keeps 30 days of data. Stream Defender data to a SIEM such as Microsoft Sentinel for longer retention and investigation history.

Next: read the Intune security best practices and Entra ID security best practices guides, or scan your own tenant free.