You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md
+5-13Lines changed: 5 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,31 +19,23 @@ search.appverid: met150
19
19
20
20
# Contextual file and folder exclusions
21
21
22
-
**Applies to:**
23
-
24
-
-[Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
25
-
-[Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
26
-
27
-
- Microsoft Defender for Business
28
-
29
-
- Microsoft Defender Antivirus
30
-
31
-
- Microsoft Defender for individuals
32
-
33
22
This article/section describes the contextual file and folder exclusions capability for Microsoft Defender Antivirus on Windows. This capability allows you to be more specific when you define under which context Microsoft Defender Antivirus shouldn't scan a file or folder, by applying restrictions.
34
23
35
24
## Overview
36
25
37
-
Exclusions are primarily intended to mitigate affects on performance. They come at the penalty of reduced protection value. These restrictions allow you to limit this protection reduction by specifying circumstances under which the exclusion should apply. Contextual exclusions aren't suitable for addressing false positives in a reliable way. If you encounter a false positive, you can submit files for analysis through the [Microsoft Defender](https://security.microsoft.com/) portal (subscription required) or through the [Microsoft Security Intelligence](https://www.microsoft.com/wdsi/filesubmission) website. For a temporary suppression method, consider creating a custom _allow_ indicator in [Microsoft Defender for Endpoint](indicator-file.md).
26
+
Exclusions are primarily intended to mitigate affects on performance. They come at the penalty of reduced protection value. These restrictions allow you to limit this protection reduction by specifying circumstances under which the exclusion should apply. Contextual exclusions aren't suitable for addressing false positives in a reliable way. If you encounter a false positive, you can submit files for analysis through the [Microsoft Defender portal](https://security.microsoft.com/) (subscription required) or through the [Microsoft Security Intelligence](https://www.microsoft.com/wdsi/filesubmission) website. For a temporary suppression method, consider creating a custom _allow_ indicator in [Microsoft Defender for Endpoint](indicator-file.md).
38
27
39
28
There are four restrictions you can apply to limit the applicability of an exclusion:
40
29
41
-
-**File/folder path type restriction**. You can restrict exclusions to only apply if the target is a file, or a folder by making the intent specific. If the target is a file but the exclusion is specified to be a folder, it will not apply. Conversely, if the target is folder but the exclusion is specified to be a file, the exclusion will apply.
30
+
-**File/folder path type restriction**. You can restrict exclusions to only apply if the target is a file, or a folder by making the intent specific. If the target is a file but the exclusion is specified to be a folder, it will not apply. Conversely, if the target is folder but the exclusion is specified to be a file, the exclusion applies.
31
+
42
32
-**Scan type restriction**. Enables you to define the required scan type for an exclusion to apply. For example, you only want to exclude a certain folder from Full scans but not from a "resource" scan (targeted scan).
33
+
43
34
-**Scan trigger type restriction**. You can use this restriction to specify that the exclusion should only apply when the scan was initiated by a specific event:
44
35
- on demand
45
36
- on access
46
37
- or originating from behavioral monitoring
38
+
47
39
-**Process restriction**. Enables you to define that an exclusion should only apply when a file or folder is being accessed by a specific process.
0 commit comments