Security Policy Errors

How to View Blocked Threats in Microsoft Defender for Endpoint

Algirdas Jasaitis Oct 10, 2026 870 views

Question details

Administrators need to investigate actions, processes, or files that have been blocked by endpoint security policies.

How to View What Microsoft Defender Blocked on an Endpoint

Product: Microsoft Defender for Endpoint
Device & OS: not provided
Scenario: Reviewing security alerts and investigating specific threats blocked on enterprise devices.
Observed behavior: To locate and access detailed information about blocked items, including threat name, severity, and the specific process or file involved.

Before you start

Ensure you have the appropriate administrator or security analyst credentials to access your organization's Microsoft Defender portal.

Solution 1Recommended

Check the Incident Timeline in the Defender Portal

The most effective way to investigate blocked actions and threats is by navigating through the Microsoft Defender portal's incident timeline.

Microsoft Defender records all policy enforcements and blocked actions within the centralized portal. By reviewing specific incidents, administrators can retrieve critical diagnostic data such as the threat ID, process details, and severity levels to determine the necessary response.

Sign in to the Portal

Navigate to the Microsoft Defender portal and sign in using your administrator account credentials.

Open Incidents

From the main navigation menu, select 'Incidents' to view the list of active security alerts and events.

Select the Relevant Incident

Locate and click on the specific incident you are investigating to open its detailed overview.

Review the Timeline

Navigate to the incident timeline. Scroll through the events and click on the specific blocked action to reveal details like the threat name, severity, threat ID, and the affected file or process.

Investigate Further

If further action is required, click on the 'Investigate' button to explore additional response actions and remediation options.

Check the Incident Timeline in the Defender Portal

Detail Availability: The level of detail available for a blocked action depends heavily on the specific Defender features and security policies currently enabled in your tenant.

Free Microsoft Office alternative

Stay Productive While Maintaining Endpoint Security

While your IT team manages security policies in Microsoft Defender, ensure your workforce stays fully productive with WPS Office. It is a lightweight, secure, and free alternative to Microsoft Office that easily deploys across enterprise endpoints without high overhead.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install Safely: Run the installer. WPS Office installs seamlessly without triggering standard Defender block policies.
3. Open Your Documents: Launch WPS Office and immediately open your existing Microsoft Office files with full format retention.

Secure document processing that operates safely alongside endpoint security tools like Microsoft Defender.Fully compatible with Microsoft Word, Excel, and PowerPoint document formats.Lightweight installation minimizes endpoint resource consumption while maximizing productivity.Cost-effective solution to equip entire teams with premium office capabilities at zero subscription cost.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I see the full file details of a blocked action in Defender?

The visibility of detailed threat information, such as the exact process or file path, depends on the specific security configurations and Defender features enabled in your organization's tenant.

Can I unblock a file if it was wrongly flagged as a threat?

Yes. If an action was blocked due to a false positive, administrators with sufficient permissions can investigate the file and add a specific indicator to the allow list directly from the portal.

Who has permission to view the incident timeline?

Access to incident timelines requires specific role assignments within the Microsoft Defender portal, such as Security Administrator, Security Reader, or Global Administrator roles.

Microsoft Office Security Issues