How to Enable EDR in Block Mode in Microsoft 365 Defender
Question details
The user needs to locate and enable the Endpoint Detection and Response (EDR) in block mode setting within Microsoft 365 Defender.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Configuring advanced endpoint security policies in the Microsoft 365 Defender portal.
- Observed behavior
- The user is trying to turn on EDR in block mode but may find the option missing due to lacking administrator permissions or unsupported enterprise licenses.
Ensure you are signed into the Microsoft 365 Defender portal with an account that has sufficient administrative privileges to modify endpoint settings.
Turn on EDR in Block Mode via Defender Settings
Navigate through the Microsoft 365 Defender portal settings to locate and activate the advanced feature for EDR block mode.
Enabling this feature provides an additional layer of protection by allowing Microsoft Defender for Endpoint to automatically block malicious artifacts, even if Microsoft Defender Antivirus is not the primary antivirus software.
Sign in to the Microsoft 365 Defender portal using your global administrator or security administrator credentials.
In the left-hand navigation pane, scroll down and click on 'Settings', then select 'Endpoints'.
Under the Endpoints menu, click on 'General' to expand the configuration options.
Select 'Advanced features'. Scroll down to find 'Enable EDR in block mode' and toggle the switch to turn it on, then save your changes.
Verify Licensing and Administrator Roles
Check with your organization's IT department to ensure your tenant holds the required E5 licensing and your account has the correct roles.
Looking for a Secure and Lightweight Office Suite?
While managing enterprise security features like Microsoft 365 Defender requires complex administrative portals and specific E5 licenses, managing your daily documents shouldn't be complicated. WPS Office provides a lightweight, highly compatible alternative for creating, editing, and managing your files seamlessly without heavy subscription fees.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the quick on-screen instructions to set up the software.
- 3. Open Your Documents: Launch WPS Office to instantly start opening and editing your existing Microsoft Office files with perfect formatting.
Frequently Asked Questions
Why is the 'Enable EDR in block mode' option missing in my settings?
The option is usually missing because your account lacks the necessary Security Administrator or Global Administrator permissions, or your organization's tenant does not have the required E5 tier licensing.
Which licenses are required to use EDR in block mode?
Supported licenses include Windows 10 Enterprise E5, Microsoft 365 E5, or the Microsoft 365 E5 Security add-on attached to a Microsoft 365 E3 subscription.
Does EDR in block mode replace my third-party antivirus?
No, EDR in block mode is designed to work alongside non-Microsoft antivirus solutions. It acts as an additional layer of defense that allows Microsoft Defender for Endpoint to block malicious artifacts detected in the background.
