ASD's Blueprint for Secure Cloud


This section describes the configuration of endpoints within Microsoft Defender associated with systems built according to the guidance provided by ASD's Blueprint for Secure Cloud.

Estimated reading time: 2 minutes

Advanced Features

Restrict correlation to within scoped device groupsOff
Enable EDR in block modeOn
Automatically resolve alertsOn
Allow or block fileOn
Hide potential duplicate device recordsOn
Custom network indicatorsOn
Tamper protectionOn
Show user detailsOn
Skype for business integrationOn
Microsoft Defender for Cloud AppsOn
Web content filteringOn
Device discoveryOn
Download quarantined filesOn
Live responseOn
Live response for ServersOn
Live response unsigned script executionOff
Share endpoint alerts with Microsoft Compliance CenterOn
Microsoft Intune connectionOn
Authenticated telemetryOn
Preview featuresOff

Security & Governance




Do you have a suggestion on how the above page could be improved? Get in touch! ASD's Blueprint for Secure Cloud is an open source project, and we would love to get your input. Submit an issue on our GitHub, or send us an email at

Acknowledgement of Country icon

Acknowledgement of Country
We acknowledge the Traditional Owners and Custodians of Country throughout Australia and their continuing connections to land, sea and communities. We pay our respects to them, their cultures and their Elders; past, present and emerging. We also recognise Australia's First Peoples' enduring contribution to Australia's national security.

Authorised by the Australian Government, Canberra