Introduction 

Clicking the toggle will open the 8-step configuration wizard. Set your preferences in the wizard, and within 1-3 hours of enabling the feature, you will see Antivirus Management configurations for endpoints on the Endpoints Devices page. 

This article walks through the process of enabling Antivirus Management in the Field Effect MDR Portal. To learn more about this feature, see our overview article. 

Enabling Antivirus Management

If you're a Field Effect Partner, this feature is enabled on a per-client basis. Before enabling this feature, make sure the organization selector is set to the client you want to enable this feature for.

To begin, navigate to the Administration section's Antivirus Management tab and click the enable toggle. 

The configuration form will open. Begin by selecting the management mode want for the feature. After making your selection, click Next.

• Audit: Field Effect MDR will monitor the antivirus configurations all devices with an endpoint agent installed and report any antivirus configurations that do not comply with your preferences (which are determined during this set up process). 
• Enforce: Field Effect MDR will not only report on non-compliant endpoint configurations, but actively change them the align with your preferences.

The second step allows you to enable/disable the Headless UI and Disable Notification features. After making your selections, click Next.

• Headless UI: hides the Microsoft Defender Antivirus user interface and notifications on endpoint devices. It also prevents the virus & threat protection tile from appearing in the Windows Security app.
• Disable All Notifications: disables all Windows Security notifications to prevent end users from inadvertently modifying settings, running antivirus scans, or otherwise performing security-related actions without your input or knowledge.

The third step gives you the opportunity to set the Cloud-Delivered Protection and Automatic Sample Submissions settings. After making your selections, click Next.

Cloud-Delivered Protection: 

Takes advantage of emergency dynamic intelligence updates. When enabled, fixes for malware issues can be delivered via the cloud within minutes, instead of waiting for the next scheduled update.

1. Basic
2. Advanced
3. Disabled

Automatic Sample Submissions:

Allows Microsoft Defender to send file samples to cloud protection when more intelligence is needed when verifying the intent of a suspicious file.

1. Always Prompt
2. Send Safe Samples Automatically
3. Send All Samples Automatically
4. Never Send

The fourth step allows you to configure exclusions for the feature. If there are any paths, software, or process names you would like to exclude, add them in the appropriate field.

After adding your exclusions, click Next.

On the fifth step, you can select whether you'd like to enable/disable SmartScreen and Potentially Unwanted Applications (PUAs) for the feature.

• SmartScreen: scans app and file downloads to protect against phishing or malware websites, applications, and other potentially malicious files.
• PUA Protection: blocks PUAs and any attempts to download, move, run, or install them.

After making your selections, click Next.

On step six, you can configure the feature’s scan preferences. After making your selections, click Next.

Step seven allows you to configure the feature's Signature Update Preferences. After making your selections, click Next

The final step allows you to adjust the feature’s Advanced Antivirus Preferences. After making your final selections, click Submit.

• Purge Quarantine After Delay (days): specifies the number of days after which items are purged from the Quarantine folder. If set to disable, the setting will be forced to zero days, meaning that malicious files will not be purged from the quarantine folder.
• NIS Definition Retirement: helps improve Microsoft Defender's performance by not checking for exploits that a device is not vulnerable to.
• NIS Protocol Recognition:  enables or disables protocol recognition of known vulnerabilities for network protection.

The feature will now be enabled, and you'll be taken back its Administration page. All of the preference you set while enabling the feature will become visible and editable on this page. 

Within 1-3 hours of enabling the feature, antivirus configurations will be displayed on the Endpoint Devices page. To learn more about using the feature once it's enabled, see our overview article. 

Appendix: All Available Defender Configuration Options

The following Microsoft Defender configurations can be reported on, or enforced, by the endpoint agent: