Merge pull request #176 from YongRhee-MSFT/patch-1

emmwalshh · web-flow · commit f8d4ac5b6366 · 2025-01-23T13:01:42.000Z
Update microsoft-defender-antivirus-compatibility.md -- Emm is reviewing
diff --git a/defender-endpoint/microsoft-defender-antivirus-compatibility.md b/defender-endpoint/microsoft-defender-antivirus-compatibility.md
@@ -213,6 +213,7 @@ You can use one of several methods to confirm the state of Microsoft Defender An
 > - To switch Microsoft Defender Antivirus to passive mode, even if it was disabled before onboarding, you can apply the [ForceDefenderPassiveMode configuration](switch-to-mde-phase-2.md#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) with a value of `1`. To place it into active mode, switch this value to `0` instead.
 > 
 > Note the modified logic for `ForceDefenderPassiveMode` when tamper protection is enabled: Once Microsoft Defender Antivirus is toggled to active mode, tamper protection prevents it from going back into passive mode even when `ForceDefenderPassiveMode` is set to `1`.
+>Microsoft Defender for Endpoint – EDR response actions always operate in Passive mode, even if EDR is in block mode.
 
 ### Use the Windows Security app to identify your antivirus app
 

Original file line number	Diff line number	Diff line change
`@@ -213,6 +213,7 @@ You can use one of several methods to confirm the state of Microsoft Defender An`
`213`	`213`	> - To switch Microsoft Defender Antivirus to passive mode, even if it was disabled before onboarding, you can apply the [ForceDefenderPassiveMode configuration](switch-to-mde-phase-2.md#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) with a value of `1`. To place it into active mode, switch this value to `0` instead.
`214`	`214`	`>`
`215`	`215`	> Note the modified logic for `ForceDefenderPassiveMode` when tamper protection is enabled: Once Microsoft Defender Antivirus is toggled to active mode, tamper protection prevents it from going back into passive mode even when `ForceDefenderPassiveMode` is set to `1`.
	`216`	`+>Microsoft Defender for Endpoint – EDR response actions always operate in Passive mode, even if EDR is in block mode.`
`216`	`217`
`217`	`218`	`### Use the Windows Security app to identify your antivirus app`
`218`	`219`