Skip to main content

Set-XdrEndpointAdvancedFeatures

SYNOPSIS​

Configures advanced features settings for Microsoft Defender for Endpoint.

SYNTAX​

Set-XdrEndpointAdvancedFeatures [[-EnableEDRInBlockMode] <Boolean>]
 [[-EnableMicrosoftDefenderAntivirusInAuditMode] <Boolean>] [[-DeviceDiscovery] <Boolean>]
 [[-HidePotentialDuplicateDeviceRecords] <Boolean>] [[-AllowOrBlockFile] <Boolean>]
 [[-SkypeForBusinessIntegration] <Boolean>] [[-ShowUserDetails] <Boolean>]
 [[-MicrosoftDefenderForIdentityIntegration] <Boolean>] [[-AutomaticallyResolveAlerts] <Boolean>]
 [[-MicrosoftDefenderForCloudApps] <Boolean>] [[-AzureInformationProtection] <Boolean>]
 [[-TamperProtection] <Boolean>] [[-CustomNetworkIndicators] <Boolean>] [[-WebContentFiltering] <Boolean>]
 [[-MicrosoftEndpointDLP] <Boolean>] [[-DownloadQuarantinedFiles] <Boolean>]
 [[-RestrictCorrelationToWithinScopedDeviceGroups] <Boolean>] [[-ExcludeDevices] <Boolean>]
 [[-ActiveIncidentResponse] <Boolean>] [[-AggregatedReporting] <Boolean>]
 [[-LowFidelityEnrichmentEnabled] <Boolean>] [[-IsolationExclusionRules] <Boolean>]
 [[-DefaultToStreamlinedConnectivityWhenOnboardingDevicesInDefenderPortal] <Boolean>]
 [[-ApplyStreamlinedConnectivitySettingsToDevicesManagedByIntuneAndDefenderForCloud] <Boolean>]
 [[-PreviewFeatures] <Boolean>] [[-PurviewSharing] <Boolean>] [[-MicrosoftIntuneConnection] <Boolean>]
 [[-AuthenticatedTelemetry] <Boolean>] [[-LiveResponse] <Boolean>] [[-LiveResponseForServers] <Boolean>]
 [[-LiveResponseUnsignedScriptExecution] <Boolean>] [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm]
 [<CommonParameters>]

DESCRIPTION​

Sets advanced features configuration for Microsoft Defender for Endpoint. This function updates various advanced features across different configuration endpoints.

Note: AlwaysRemediatePUA and EnableAutomaticAttackDisruption cannot be changed through this function as they are part of PotentiallyUnwantedApplications which is read-only.

EXAMPLES​

EXAMPLE 1​

Set-XdrEndpointAdvancedFeatures -EnableEDRInBlockMode $true
Enables EDR in block mode.

EXAMPLE 2​

Set-XdrEndpointAdvancedFeatures -PreviewFeatures $true -WhatIf
Shows what would happen when enabling preview features without actually making the change.

EXAMPLE 3​

Set-XdrEndpointAdvancedFeatures -LiveResponse $true -LiveResponseForServers $true
Enables Live Response for both workstations and servers.

EXAMPLE 4​

Set-XdrEndpointAdvancedFeatures -MicrosoftIntuneConnection $true
Enables the Microsoft Intune connection.

EXAMPLE 5​

Set-XdrEndpointAdvancedFeatures -AuthenticatedTelemetry $true
Enables authenticated telemetry.

PARAMETERS​

-EnableEDRInBlockMode​

Enable EDR in block mode.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-EnableMicrosoftDefenderAntivirusInAuditMode​

Enable Microsoft Defender Antivirus in audit mode.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 2
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DeviceDiscovery​

Enable device discovery.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 3
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-HidePotentialDuplicateDeviceRecords​

Hide potential duplicate device records.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 4
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-AllowOrBlockFile​

Enable allow or block file feature.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 5
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-SkypeForBusinessIntegration​

Enable Skype for Business integration.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 6
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ShowUserDetails​

Show user details.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 7
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-MicrosoftDefenderForIdentityIntegration​

Enable Microsoft Defender for Identity integration.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 8
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-AutomaticallyResolveAlerts​

Automatically resolve alerts.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 9
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-MicrosoftDefenderForCloudApps​

Enable Microsoft Defender for Cloud Apps integration.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 10
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-AzureInformationProtection​

Enable Azure Information Protection integration.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 11
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-TamperProtection​

Enable tamper protection.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 12
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-CustomNetworkIndicators​

Enable custom network indicators.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 13
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-WebContentFiltering​

Enable web content filtering.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 14
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-MicrosoftEndpointDLP​

Enable Microsoft Endpoint DLP.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 15
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DownloadQuarantinedFiles​

Enable download of quarantined files.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 16
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-RestrictCorrelationToWithinScopedDeviceGroups​

Restrict correlation to within scoped device groups.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 17
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ExcludeDevices​

Enable exclude devices feature.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 18
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ActiveIncidentResponse​

Enable Active Incident Response (DART).

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 19
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-AggregatedReporting​

Enable aggregated reporting.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 20
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-LowFidelityEnrichmentEnabled​

Low fidelity enrichment enabled.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 21
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-IsolationExclusionRules​

Enable isolation exclusion rules.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 22
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DefaultToStreamlinedConnectivityWhenOnboardingDevicesInDefenderPortal​

Default to streamlined connectivity when onboarding devices.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 23
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ApplyStreamlinedConnectivitySettingsToDevicesManagedByIntuneAndDefenderForCloud​

Apply streamlined connectivity settings to devices managed by Intune and Defender for Cloud.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 24
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-PreviewFeatures​

Enable preview features.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 25
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-PurviewSharing​

Enable Purview alert sharing.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 26
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-MicrosoftIntuneConnection​

Enable Microsoft Intune connection to share onboarding information and threat levels.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 27
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-AuthenticatedTelemetry​

Enable authenticated telemetry to prevent spoofing telemetry into your dashboard.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 28
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-LiveResponse​

Enable Live Response.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 29
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-LiveResponseForServers​

Enable Live Response for servers.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 30
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-LiveResponseUnsignedScriptExecution​

Enable unsigned script execution in Live Response.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 31
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the command runs. The command is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts for confirmation before making changes.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

NOTES​