EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirus

Overview

EDR in block mode adds Microsoft Defender for Endpoint blocking when Microsoft Defender Antivirus is not the primary antivirus and is running in passive mode. Microsoft documents that it provides added protection from malicious artifacts in this scenario and is available in Defender for Endpoint Plan 2. This matters because threat actors can evade or outpace a third-party antivirus product, then continue from execution into defense evasion, credential access, lateral movement, and impact while defenders investigate. With EDR in block mode disabled, EDR can still detect activity, but malicious artifacts that another antivirus missed might not be actively remediated by Microsoft Defender for Endpoint. The feature does not restore all capabilities that require Defender Antivirus active mode; Microsoft notes that real-time protection, network protection, attack surface reduction rules, and indicators have active-mode dependencies. It is still a critical safety net for tenants that rely on non-Microsoft antivirus. This check uses the pinned MDATP Secure Score control scid_2004.

Remediation

• Endpoint detection and response in block mode
• Frequently asked questions on EDR in block mode
• Microsoft Defender Antivirus compatibility

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1204.002 Malicious File
Licence	WINDEFATP
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.