# Cloud Block Level should be High or higher

Checks that the cloud block level is set to High or higher in the assigned Microsoft Defender Antivirus policies.

Source: https://maester.dev/docs/tests/MT.1161

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/bdrogja" title="Boris Drogja · Original author"><img src="https://github.com/bdrogja.png" alt="Boris Drogja" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/gbenrotto" title="Olugbenro Ogundipe · Co-contributor"><img src="https://github.com/Gbenrotto.png" alt="Olugbenro Ogundipe" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/bdrogja">Boris Drogja</a> with <a href="/contributors/gbenrotto">Olugbenro Ogundipe</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Defender · Endpoint antivirus · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1161
```

## Overview

Checks that the cloud block level is set to High or higher in the assigned Microsoft Defender Antivirus policies.

A low cloud block level reduces proactive threat blocking capabilities, allowing more suspicious files to execute without cloud-based analysis.

#### Remediation action:

1. Open [Microsoft Endpoint Manager](https://endpoint.microsoft.com) > **Endpoint Security** > **Antivirus**
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set **Cloud Block Level** to High, High Plus, or Zero Tolerance

If your antivirus settings are split across several policies, this setting only needs to be set in one of them, as long as that policy is assigned to every device that needs it. No other assigned policy should set a different value: Intune does not merge this setting, so a device that receives both values may end up with either one, or none.

#### Related links

- [Policy merge and conflicts for Antivirus policy settings](https://learn.microsoft.com/intune/device-configuration/endpoint-security/antivirus#policy-merge-for-settings)
- [Configure Microsoft Defender Antivirus](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features)
- [Microsoft Endpoint Manager](https://endpoint.microsoft.com)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1161 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Related products | Intune |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | [Test-MtMdeCloudBlockLevel](https://github.com/maester365/maester/blob/main/tests/maester/defender/Test.MT.1161.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/defender/Test.MT.1161.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/defender/Test.MT.1161.ps1)
- Documentation: [`tests/maester/defender/Test.MT.1161.md`](https://github.com/maester365/maester/blob/main/tests/maester/defender/Test.MT.1161.md)