Merge pull request #182 from MicrosoftDocs/deniseb

Update edr-block-mode-faqs.yml

Author: denisebmsft

defender-endpoint/edr-block-mode-faqs.yml

@@ -8,12 +8,14 @@ metadata:
   audience: ITPro
   author: siosulli
   ms.author: siosulli
-  ms.reviewer: sugamar 
+  ms.reviewer: sugamar, kausd
   manager: deniseb
-  ms.custom: asr
+  ms.custom: 
+  - asr
+  - partner-contribution
   ms.topic: faq
   ms.collection: m365-security
-  ms.date: 02/27/2024
+  ms.date: 04/26/2024
 
 title: Endpoint detection and response (EDR) in block mode frequently asked questions (FAQ)
 summary: |
@@ -36,11 +38,10 @@ sections:
       - question: |
           Do I need to turn EDR in block mode on if I have Microsoft Defender Antivirus running on devices?
         answer: |
-          The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product. There is minimal benefit in enabling EDR in block mode when Microsoft Defender Antivirus is in active mode, because real-time protection is expected to catch and remediate detections first. We recommend enabling EDR in block mode on endpoints where Microsoft Defender for Antivirus is running in passive mode. EDR detections can be automatically remediated by [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) or by [automated investigation & remediation capabilities](automated-investigations.md) in block mode.
-          
-          > [!NOTE]
-          > Microsoft recommends enabling EDR in block mode, even when primary antivirus software on the system is Microsoft Defender Antivirus.
-          
+          Yes, Microsoft recommends enabling EDR in block mode, even when primary antivirus software on the system is Microsoft Defender Antivirus. EDR detections can be automatically remediated by [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) or by [automated investigation & remediation capabilities](automated-investigations.md) in block mode.
+
+          The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product.
+
       - question: |
           Will EDR in block mode affect a user's antivirus protection?
         answer: |