Skip to content

Commit 63a51f9

Browse files
authored
Clarify EDR response actions in passive mode
1 parent 09d6f14 commit 63a51f9

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

defender-endpoint/microsoft-defender-antivirus-compatibility.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ You can use one of several methods to confirm the state of Microsoft Defender An
213213
> - To switch Microsoft Defender Antivirus to passive mode, even if it was disabled before onboarding, you can apply the [ForceDefenderPassiveMode configuration](switch-to-mde-phase-2.md#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) with a value of `1`. To place it into active mode, switch this value to `0` instead.
214214
>
215215
> Note the modified logic for `ForceDefenderPassiveMode` when tamper protection is enabled: Once Microsoft Defender Antivirus is toggled to active mode, tamper protection prevents it from going back into passive mode even when `ForceDefenderPassiveMode` is set to `1`.
216-
> All Microsoft Defender for Endpoint – EDR response actions work in Passive mode whether or not in EDR in block mode.
216+
>Microsoft Defender for Endpoint – EDR response actions always operate in Passive mode, even if EDR is in block mode.
217217
218218
### Use the Windows Security app to identify your antivirus app
219219

0 commit comments

Comments
 (0)