Learning path
Microsoft Defender for Endpoint: Attack Surface Reduction (ASR)
Skill Level
Fundamentals
Duration 10 minutes
Updated Nov 5, 2026
About this learning path
Seeing a device on the dashboard is not the same as protecting it. This article shows how attack surface reduction rules in Microsoft Defender for Endpoint close the behaviors attackers commonly abuse, how Audit, Warn, and Block modes work, and how a business can move rules from Audit to Block without breaking the tools its people rely on every day.
Your instructors
Prerequisites
- Windows devices already onboarded to Microsoft Defender for Endpoint and reporting, as covered in the Onboarding byte.
- A working feel for Microsoft Defender Antivirus, including real-time protection, cloud-delivered protection, and active mode
- Comfort creating and assigning policies with Intune, Group Policy, or Configuration Manager
- A basic feel for how attacks start, such as macros, scripts, and stolen credentials
What you'll learn
- Recognize the risky behaviors ASR rules target, like Office apps launching processes, scripts running downloads, and credential theft
- Identify the three standard protection rules and why Microsoft recommends Block mode for them
- Compare Not configured, Audit, Warn, and Block, including what Warn can and cannot do
- Move rules from Audit to Block safely, ring by ring, using narrow per-rule exclusions
- Read the ASR rules report, device timeline, advanced hunting, and Windows Event Viewer to see what your rules are doing