Skip to main content
Version: 2.1.1-preview

MT.1161 - Cloud Block Level should be High or higher

Overview​

Checks that the cloud block level is set to High or higher in all assigned Microsoft Defender Antivirus policies.

A low cloud block level reduces proactive threat blocking capabilities, allowing more suspicious files to execute without cloud-based analysis.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Set Cloud Block Level to High, High Plus, or Zero Tolerance

Test Metadata​

FieldValue
Test IDMT.1161
SeverityHigh
SuiteMaester
CategoryDefender
PowerShell testTest-MtMdeCloudBlockLevel
TagsDefender, Maester, MT.1161

Source​

  • Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/maester/defender/Test-MtMdeCloudBlockLevel.ps1