You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Data in the control of some ransom software can sometimes be decrypted. Decryption is only possible if the user hasn't restarted or turned off the computer. For more information, see [Wanna Cry Ransomware](https://answers.microsoft.com/en-us/windows/forum/windows_10-security/wanna-cry-ransomware/5afdb045-8f36-4f55-a992-53398d21ed07?auth=1)
539
+
1. Data in the control of some ransom software can sometimes be decrypted. Decryption is only possible if the user hasn't restarted or turned off the computer. For more information, see [WannaCrypt ransomware worm targets out-of-date systems](https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/)
540
540
541
-
>[!NOTE]
541
+
>[!NOTE]
542
542
> To disable a suspicious activity alert, contact support.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/caac-known-issues.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,6 +19,8 @@ In cases like these, be sure to cover files that are larger than 50 MB by using
19
19
20
20
In Microsoft Defender XDR, select **Settings** > **Conditional Access App Control** > **Default behavior** to manage settings for files that are larger than 50 MB.
21
21
22
+
With Edge in-browser protection, in case the end user session is protected AND the policy is set to 'Always apply the selected action even if data cannot be scanned', any file larger than 50MB is blocked.
23
+
22
24
## Maximum file size for session policies based on content inspection
23
25
24
26
When you apply a session policy to block file uploads or downloads based on content inspection, the inspection is performed only on files that are smaller than 30 MB and that have fewer than 1 million characters.
Copy file name to clipboardExpand all lines: defender-endpoint/data-storage-privacy.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ ms.date: 05/12/2025
34
34
This section covers some of the most frequently asked questions regarding privacy and data handling for Defender for Endpoint.
35
35
36
36
> [!NOTE]
37
-
> This article explains the data storage and privacy details related to Defender for Endpoint and Defender for Business. For more information related to Defender for Endpoint and other products and services like Microsoft Defender Antivirus and Windows, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576), and also [Windows privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577).
37
+
> This article explains the data storage and privacy details related to Defender for Endpoint and Defender for Business. For more information related to Defender for Endpoint and other products and services like Microsoft Defender Antivirus and Windows, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576).
3. Select **Download onboarding package**. Save it as _GatewayWindowsDefenderATPOnboardingPackage.zip_ to the same directory.
487
+
488
+
489
+
1. Select **Download onboarding package**. Save it as _GatewayWindowsDefenderATPOnboardingPackage.zip_ to the same directory.
Copy file name to clipboardExpand all lines: defender-endpoint/machines-view-overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.collection:
13
13
- tier2
14
14
ms.topic: article
15
15
search.appverid: met150
16
-
ms.date: 01/23/2025
16
+
ms.date: 07/20/2025
17
17
---
18
18
19
19
# Device inventory
@@ -46,7 +46,7 @@ There are several options you can choose from to customize the devices list view
46
46
During the onboarding process, the **Devices list** is gradually populated with devices as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online, or download the complete endpoint list as a CSV file for offline analysis.
47
47
48
48
> [!NOTE]
49
-
> If you export the devices list, it contains every device in your organization. It might take a significant amount of time to download, depending on how large your organization is. Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file includes all devices in the organization, regardless of any filtering applied in the view itself.
49
+
> If you export the devices list, it contains every device in your organization. It might take a significant amount of time to download, depending on how large your organization is.
50
50
>
51
51
> In addition, when you export the devices list, the antivirus status shows as `Not-Supported`. For antivirus status, use the recently released [Microsoft Defender Antivirus health report](device-health-microsoft-defender-antivirus-health.md) instead. This report allows you to export even more details.
- Support phase: **Security and Critical Updates**
109
+
110
+
#### What's new
111
+
112
+
- Added filtering to improve scan stability and prevent engine crashes
113
+
- Additional performance improvements to prevent concurrent scans. This change ensures that if a quick or full scan is already running, no additional quick or full scan scans are initiated from `MpCmdRun` or Powershell (`Start-Scan`).
114
+
- Resolved the issue where subfolder exclusions were not being honored in Microsoft Defender Antivirus scans related to non-Microsoft SIEM solutions. This fix ensures that specified subfolders are now correctly excluded from scans, preventing unnecessary detections and improving overall system performance.
- Support phase: **Security and Critical Updates**
151
-
152
-
#### What's new
153
-
154
-
- Improved caching of [device control settings](device-control-policies.md) to improve reliability in occasionally connected environments.
155
-
- Performance improvement in on-access scans of files in network locations.
156
-
- Fixed the Defender service description to match the latest installed version.
157
-
- Improved Defender engine update logic when the update is included in a custom image.
158
-
- Fix in health reporting where signature update data might have been incorrect.
159
-
- Fixed reporting issue with [controlled folder access](controlled-folders.md) (CFA) protected folders using the PowerShell cmdlet [Get-MpPreference](/powershell/module/defender/get-mppreference) when CFA is disabled.
160
-
- Improved performance when scanning UPX-packed files (Ultimate Packer for eXecutables) and updated the validation process to verify the integrity of the packed file itself.
161
-
- Added support for distinguishing regular cloud allow signatures from clean [Indicators of Compromise](indicators-overview.md) (IoC) in [attack surface reduction](attack-surface-reduction.md) (ASR).
162
-
163
158
### Previous version updates: Technical upgrade support only
164
159
165
160
After a new package version is released, support for the previous two versions is reduced to technical support only. For more information about previous versions, see [Microsoft Defender Antivirus updates: Previous versions for technical upgrade support](msda-updates-previous-versions-technical-upgrade-support.md).
- Support phase: **Technical upgrade support (only)**
39
+
40
+
#### What's new
41
+
42
+
- Improved caching of [device control settings](device-control-policies.md) to improve reliability in occasionally connected environments.
43
+
- Performance improvement in on-access scans of files in network locations.
44
+
- Fixed the Defender service description to match the latest installed version.
45
+
- Improved Defender engine update logic when the update is included in a custom image.
46
+
- Fix in health reporting where signature update data might have been incorrect.
47
+
- Fixed reporting issue with [controlled folder access](controlled-folders.md) (CFA) protected folders using the PowerShell cmdlet [Get-MpPreference](/powershell/module/defender/get-mppreference) when CFA is disabled.
48
+
- Improved performance when scanning UPX-packed files (Ultimate Packer for eXecutables) and updated the validation process to verify the integrity of the packed file itself.
49
+
- Added support for distinguishing regular cloud allow signatures from clean [Indicators of Compromise](indicators-overview.md) (IoC) in [attack surface reduction](attack-surface-reduction.md) (ASR).
> After onboarding to the Microsoft Sentinel data lake, auxiliary log tables are no longer available in Microsoft Defender advanced hunting. Instead, you can access them through data lake exploration KQL queries in the Defender portal. For more information, see [KQL queries in the Microsoft Sentinel data lake](/azure/sentinel/datalake/kql-queries).
0 commit comments