Microsoft Defender previews automatic isolation for compromised endpoints
Summary
Microsoft is previewing automatic isolation in Defender for Endpoint to limit lateral movement and contain attacks. Isolated devices lose network access but remain connected to the service for monitoring.
Key points
- The preview automatically isolates devices suspected of compromise as part of Defender for Endpoint's automatic attack disruption.
- Isolation disconnects devices from the network while preserving connectivity to Defender for Endpoint for monitoring.
- The capability is designed to limit lateral movement and reduce the risk of further attack impact, including ransomware propagation and data exfiltration.
- It applies to onboarded end-user workstations managed by Defender for Endpoint.
- Security operators can release a device from isolation after investigating the incident and mitigating risks.
Article Details
- Event Type
- Preview of automatic endpoint isolation in Microsoft Defender for Endpoint
- Impact
- The capability automatically disconnects suspected-compromised, onboarded end-user workstations from the network to limit lateral movement and reduce the risk of data exfiltration or ransomware propagation. Isolated devices remain connected to Defender for Endpoint for monitoring, and security operators can release them after investigation and risk mitigation.