Defender for Endpoint: plans, ASR, response

Microsoft Defender for Endpoint is Microsoft’s endpoint security platform: it prevents, detects, investigates and responds to threats on Windows, macOS, Linux, Android and iOS devices, and feeds its signals into the Microsoft Defender portal and Defender XDR. The decision rule for exams: Plan 1 is prevention plus manual response, Plan 2 adds detection and automated investigation (EDR, hunting, vulnerability management), and every setting that targets “some devices” runs through device groups.

Five layers, and which plan owns each

Sort the capabilities into layers and the plan question mostly answers itself.

Licensing, per Learn: Plan 1 is a standalone subscription or part of Microsoft 365 E3; Plan 2 is included in Microsoft 365 E5. Neither plan includes server licenses. Servers need Defender for Servers Plan 1 or 2 (from Defender for Cloud) or Defender for Endpoint for Servers. Small businesses of up to 300 employees get Defender for Business, included in Microsoft 365 Business Premium. See Defender XDR versus Defender for Cloud for how the Defender products divide the work.

What the sensor needs before anything works

Onboarding a device turns on the EDR sensor; the other layers are configured afterwards. Two facts decide many questions.

• Antivirus mode. The agent depends on Microsoft Defender Antivirus for scanning. If a non-Microsoft antivirus is the active product, Defender Antivirus goes into passive mode. ASR rules and network protection only work when Defender Antivirus is in active mode.
• First-run choice. When you first run the onboarding wizard you choose where Defender for Endpoint data is stored (European Union, United Kingdom or United States). It cannot be changed afterwards.

For the third-party antivirus case, EDR in block mode (Plan 2, Windows) lets Defender Antivirus remediate malicious artifacts found by behavioral EDR detections after the other product missed them. It is enabled under Settings, Endpoints, Advanced features in the Defender portal, or with Intune or Group Policy.

ASR rules: audit first, then block

Attack surface reduction rules target behavior that malware commonly uses, such as Office apps creating child processes or running obfuscated scripts. Facts to hold:

• They are a Windows feature. They do not exist on macOS or Linux, even on onboarded devices.
• They need Defender Antivirus active, real-time protection on, and cloud-delivered protection.
• Modes: Block, Audit, Warn (the user can unblock for 24 hours), Not configured and Off.
• Microsoft calls three rules “standard protection” and recommends Block for them without extensive testing. Other rules should run in Audit first, then move to Block or Warn once you have excluded the legitimate line-of-business apps they flag.
• Defender for Endpoint has no built-in way to push ASR settings. Microsoft Intune endpoint security policies are the recommended route; Group Policy, Configuration Manager, any MDM through the Policy CSP, and PowerShell also work.

Worked example. Contoso wants “Block all Office applications from creating child processes” on 4,000 laptops. The admin deploys it in Audit through an Intune policy, reviews the audit events in the ASR rules report and in advanced hunting (DeviceEvents | where ActionType startswith "Asr" is the pattern Learn gives; see KQL cheat sheet), adds a per-rule exclusion for the finance macro that legitimately launches a helper, and only then flips the policy to Block.

Device groups: where access and automation are decided

Device groups (Plan 1 and Plan 2) matter for two things: who can see the devices, and how aggressively remediation runs. Each group has a name, a remediation level, a matching rule (device name, domain, tags, OS platform), the Microsoft Entra user groups allowed in, and a rank. A device that matches several groups lands only in the highest-ranked one; unmatched devices fall into “Ungrouped devices”. A group with no Entra group assigned is open to every user with portal access.

The automation levels are Full (remediate automatically), three Semi levels that require approval for all folders, core folders or non-temporary folders, and No automated response. Pending actions wait in the Action center and time out after seven days, which counts as a rejection. Full automation is the default for tenants created on or after August 16, 2020 that have no device groups yet.

A change to know. Microsoft Learn now states that as of September 1, 2026, Automated Investigation and Response no longer runs as a separate investigation experience or can be triggered manually, because its detection and response capabilities already run in the default antivirus stack. The SC-200 outline from October 21, 2026 still lists automation levels and automated investigation, so learn the concepts but check current portal behavior.

Responding on a device

• Isolate device cuts the device off from the network but keeps its connection to the Defender service, so you can keep monitoring. Plan 1 includes it.
• Live response opens a remote shell. It must be enabled under Advanced features, basic and advanced commands are split by role, and scripts must be uploaded to the library before run works. Unsigned PowerShell scripts need a separate setting.
• Investigation package and device timeline help reconstruct what happened. This pairs with the steps in the incident response lifecycle.

Which exams test this

How the questions are built

• “Third-party antivirus is the primary product” means Defender Antivirus is passive, so ASR and network protection do not apply, and EDR in block mode (Plan 2) is the Microsoft answer.
• “Without disrupting users” or “line-of-business apps” means Audit mode before Block.
• “Different approval rules for servers and workstations” means device groups with different remediation levels, not tenant-wide settings.
• “Keep monitoring but stop the spread” means isolate device, not delete or disable the account.
• “Run a script on the device” means live response, with the script uploaded to the library first.
• Plan traps: EDR, hunting and automated investigation point to Plan 2; ASR, isolation and antivirus work in both.

Go deeper

• Microsoft Defender for Endpoint overview (Microsoft Learn)
• Defender for Endpoint Plan 1 (Microsoft Learn)
• ASR rules overview (Microsoft Learn)
• Device groups (Microsoft Learn)
• Related on this site: SIEM, SOAR and XDR, Insider Risk Management, vulnerability management and CVSS