Cloud Block Level should be High or higher

Contributed by Boris Drogja with Olugbenro OgundipeAll contributors →

Part of Maester · Defender · Endpoint antivirus · All checks

Run this check

Invoke-Maester -TestId MT.1161

Overview

Checks that the cloud block level is set to High or higher in the assigned Microsoft Defender Antivirus policies.

A low cloud block level reduces proactive threat blocking capabilities, allowing more suspicious files to execute without cloud-based analysis.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set Cloud Block Level to High, High Plus, or Zero Tolerance

If your antivirus settings are split across several policies, this setting only needs to be set in one of them, as long as that policy is assigned to every device that needs it. No other assigned policy should set a different value: Intune does not merge this setting, so a device that receives both values may end up with either one, or none.

Related links

• Policy merge and conflicts for Antivirus policy settings
• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Details

Every attribute of this check

Field	Value
Test ID	MT.1161
Severity	Medium
Suite	Maester
Product	Defender
Related products	Intune
Feature	Endpoint antivirus
Area	Devices and endpoints
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1204.002 Malicious File
Supports controls	nist-800-53-r5:SI-3
PowerShell test	Test-MtMdeCloudBlockLevel
Services	Graph

Source

• Test: tests/maester/defender/Test.MT.1161.ps1
• Documentation: tests/maester/defender/Test.MT.1161.md