Security Policy Errors

How to Create a Suppression Rule for False-Positive Alerts in Microsoft Defender

Aamir Naveed Akram Oct 19, 2026 868 views

Question details

The user needs to create a suppression rule in Microsoft Defender to prevent recurring false-positive alerts from triggering.

How to Create a Suppression Rule for False-Positive Alerts in Microsoft Defender

Product: Microsoft Defender
Device & OS: not provided
Scenario: Managing security alerts and reducing false positives in the Defender portal.
Observed behavior: Recurring false-positive alerts are triggering, requiring a suppression rule to ignore specific matching alert criteria.

Before you start

Ensure you have administrator credentials and the necessary permissions to access the Microsoft Defender portal and manage alert settings.

Solution 1Recommended

Create a Suppression Rule in the Microsoft Defender Portal

Follow these steps to configure and save a suppression rule for a specific false-positive alert directly in the Defender portal.

By setting up a suppression rule, you can prevent similar false-positive alerts from cluttering your incident queue in the future.

Sign in to the Microsoft Defender portal

Navigate to the Microsoft Defender portal and sign in using your administrator credentials.

Navigate to Alerts

In the left-hand navigation pane, click on 'Incidents & alerts', and then select 'Alerts' to view your active security alerts.

Select the false-positive alert

Review the list of alerts and click on the specific false-positive alert that you want to suppress.

Initiate the suppression rule

With the alert selected, open the 'Actions' menu and click on 'Create suppression'.

Configure and save

On the Create suppression page, define your suppression criteria and specify how long the rule should remain active, then click 'Save'.

Create a Suppression Rule in the Microsoft Defender Portal

Review Rules Periodically: It is recommended to review your active suppression rules periodically to ensure they remain relevant and do not inadvertently block critical security alerts.

Free Microsoft Office alternative

Experience a secure and seamless Microsoft Office alternative

While managing complex security policies in Microsoft 365 can be demanding, everyday document productivity doesn't have to be. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office, providing essential tools and robust document protection without the heavy overhead.

1. Download the installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the suite: Run the downloaded file and follow the lightweight setup wizard to install the software in minutes.
3. Open and edit seamlessly: Launch WPS Office and immediately start opening, editing, and securely saving your existing Microsoft Office documents.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture that ensures fast installation and smooth operation on any device.Familiar user interface for a seamless, zero-learning-curve migration.Robust built-in document encryption and permission controls to keep your files secure.

microsoft office alternative - wps office

Frequently Asked Questions

What is a suppression rule in Microsoft Defender?

A suppression rule allows administrators to automatically hide or resolve alerts that match specific criteria, effectively reducing alert fatigue caused by known false positives.

Who can create suppression rules in the Defender portal?

You need specific administrative privileges, such as Security Administrator or Security Operator roles, to create and manage suppression rules in the Microsoft Defender portal.

Can I set an expiration date for an alert suppression rule?

Yes, when configuring the suppression rule on the 'Create suppression' page, you can specify a duration or an exact expiration date for how long the rule should remain in effect.

Will a suppression rule delete the false-positive alert entirely?

No, suppression rules do not permanently delete alerts from the system backend. They simply resolve or hide them automatically based on your criteria so they do not impact your active incident queue.

Microsoft Office Security Issues