Configure Microsoft Defender Antivirus notifications that appear on endpoints

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender Antivirus

Platforms

• Windows

In Windows 10 and Windows 11, application notifications about malware detection and remediation are more robust, consistent, and concise. Microsoft Defender Antivirus notifications appear on endpoints when scans are completed and threats are detected. Notifications follow both scheduled and manually triggered scans. These notifications also appear in the Notification Center, and a summary of scans and threat detections appear at regular time intervals.

If you're part of your organization's security team, you can configure how notifications appear on endpoints, such as notifications that prompt for a system reboot or that indicate a threat was detected and remediated.

You can configure the display of more notifications, such as recent threat detection summaries, in the Windows Security app and with Group Policy.

1. On your Group Policy management computer, open the Group Policy Management Console.

2. Right-click the Group Policy Object you want to configure, and then select Edit.

3. In the Group Policy Management Editor go to Computer configuration.

4. Select Administrative templates.

5. Expand the tree to Windows components > Microsoft Defender Antivirus > Reporting.

6. Double-click Turn off enhanced notifications, and set the option to Enabled. Then select OK. This setting prevents more notifications from appearing.

1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for Security.

2. Select Virus & threat protection tile (or the shield icon on the left menu bar) and, then select Virus & threat protection settings

3. Scroll to the Notifications section and select Change notification settings.

4. Slide the switch to Off or On to disable or enable other notifications.

You can use Group Policy to:

• Display more, customized text on endpoints when the user needs to perform an action
• Hide all notifications on endpoints
• Hide reboot notifications on endpoints

Hiding notifications can be useful in situations where you can't hide the entire Microsoft Defender Antivirus interface. See Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface for more information. Hiding notifications will only occur on endpoints to which the policy is deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the Microsoft Configuration Manager Endpoint Protection monitoring dashboard and reports.

To add custom contact information to endpoint notifications, see Customize the Windows Security app for your organization.

1. On your Group Policy management computer, open the Group Policy Management Console.

2. Right-click the Group Policy Object you want to configure, and then select Edit.

3. In the Group Policy Management Editor go to Computer configuration and then select Administrative templates.

4. Expand the tree to Windows components > Microsoft Defender Antivirus > Client interface.

5. Double-click Suppress all notifications and set the option to Enabled.

6. Select OK. This setting prevents more notifications from appearing.

1. On your Group Policy management computer, open the Group Policy Management Console.

2. Right-click the Group Policy Object you want to configure and then select Edit.

3. In the Group Policy Management Editor go to Computer configuration.

4. Click Administrative templates.

5. Expand the tree to Windows components > Microsoft Defender Antivirus > Client interface.

6. Double-click Suppresses reboot notifications and set the option to Enabled.

7. Select OK. This setting prevents more notifications from appearing.