Cloud-delivered protection is enabled in Microsoft Defender Antivirus

Maester checks this too

MT.1150 (Cloud Protection should be enabled.) checks the same setting. Running both reports it twice.

Overview

Cloud-delivered protection connects Microsoft Defender Antivirus to Microsoft cloud protection services, also called Microsoft Advanced Protection Service. Microsoft Learn states that these services work with Defender Antivirus to provide accurate, real-time, and intelligent protection and rapid identification of new threats, sometimes before any endpoint is infected. This matters because new malware can appear before a device has received a traditional security intelligence update. When cloud protection is enabled, Defender Antivirus can query Microsoft cloud services that use distributed resources and machine learning to deliver faster protection to endpoints. Learn recommends keeping cloud protection turned on and notes that some Defender for Endpoint capabilities, including block at first sight and certain attack surface reduction protections, depend on it. Cloud protection is enabled by default, but previous organizational policy can disable it, so tenant-level evidence is still needed. This check reads the pinned MDATP Secure Score control IDs scid_2016, scid_5094, and scid_6094 named for this spec and requires every returned control to be fully scored and not ignored.

Remediation

• Use Microsoft cloud-delivered protection
• Turn on cloud protection
• Specify the cloud protection level
• Configure block at first sight
• Configure and validate Microsoft Defender Antivirus network connections

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1204.002 Malicious File
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.