Skip to content

feedback-loop-blocking.md

Latest commit

 

History

History
80 lines (54 loc) · 3.76 KB

feedback-loop-blocking.md

File metadata and controls

80 lines (54 loc) · 3.76 KB

title: Feedback-loop blocking description: Feedback-loop blocking, also called rapid protection, is part of behavioral blocking and containment capabilities in Microsoft Defender for Endpoint keywords: behavioral blocking, rapid protection, feedback blocking, Microsoft Defender for Endpoint author: chrisda ms.author: chrisda manager: bagol ms.reviewer: shwetaj audience: ITPro ms.topic: concept-article ms.service: defender-endpoint ms.localizationpriority: medium ms.custom:

  • next-gen
  • mde-edr ms.subservice: edr ms.collection:
  • m365-security
  • tier2 search.appverid: met150 ms.date: 10/20/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2
    • Microsoft Defender Antivirus

Feedback-loop blocking

Overview

Feedback-loop blocking, also referred to as rapid protection, is a component of behavioral blocking and containment capabilities in Microsoft Defender for Endpoint. With feedback-loop blocking, devices across your organization are better protected from attacks.

Prerequisites

Supported operating systems

  • Windows

How feedback-loop blocking works

When a suspicious behavior or file is detected, such as by Microsoft Defender Antivirus in Windows, information about that artifact is sent to multiple classifiers. The rapid protection loop engine inspects and correlates the information with other signals to arrive at a decision as to whether to block a file. Checking and classifying artifacts happens quickly. It results in rapid blocking of confirmed malware, and drives protection across the entire ecosystem.

With rapid protection in place, an attack can be stopped on a device, other devices in the organization, and devices in other organizations, as an attack attempts to broaden its foothold.

Configuring feedback-loop blocking

If your organization is using Defender for Endpoint, feedback-loop blocking is enabled by default. However, rapid protection occurs through a combination of Defender for Endpoint capabilities, machine learning protection features, and signal-sharing across Microsoft security services. Make sure the following features and capabilities of Defender for Endpoint are enabled and configured:

Tip

If you're looking for Antivirus related information for other platforms, see:

Related articles