Enable or Disable Microsoft Defender Cloud Protection

This post shows students and new users steps to turn on or off Microsoft Defender Antivirus Cloud-delivered Protections in Windows 11. Microsoft Defender works seamlessly with its cloud services to deliver precise, real-time, and intelligent protection. 

Antivirus cloud protection services, or Microsoft Advanced Protection Service (MAPS), offer rapid identification of new threats, sometimes even before a single endpoint is infected.

The cloud-delivered protection is enabled by default and will automatically turn on when you enable Virus & threat protection in the Windows Security app. Therefore, turning off Microsoft Defender Antivirus cloud protection drastically reduces the protection on your endpoints and is not recommended.

You can turn Microsoft Defender Antivirus cloud protection on or off by using one of several methods:

• Microsoft Endpoint Manager
• Group Policy
• PowerShell cmdlets
• Windows Security app

If you turn on its Cloud-delivered protection, you will see a red alert in the Windows Security app under Cloud-delivered protection, alerting you to re-enable always-on protection to keep your device secure.

How to enable or disable Microsoft Defender Cloud-delivered protection in Windows 11

As mentioned above, Microsoft Defender Cloud-delivered protection works seamlessly with its cloud services to deliver accurate, real-time, intelligent protection. 

Below is how to turn On or Off Cloud-delivered protection in the Microsoft Defender Antivirus Windows Security app in Windows 11.

Change Cloud-delivered protection setting:

In the search box on the taskbar, type Windows Security and select Windows Security in the results list.

In Windows Security, select Virus & threat protection.

Under Virus & threat protection settings, select Manage settings.

Change the Cloud-delivered Protection setting to On or Off.

How to turn on or off cloud-delivered protection in Group Policy

In Windows 11, open Local Group Policy Editor by clicking on the Start menu and searching for Edit group policy, as highlighted below. Under Best match, select Edit group policy to launch Local Group Policy Editor.

In the left pane of Local Group Policy Editor, expand the tree: 

Computer Configuration>Administrative Templates>Windows Components>Microsoft Defender Antivirus>MAPS

Then, in the Join Microsoft MAPS details pane on the right, local and double-click Join Microsoft MAPS.

Ensure the option is turned on and set to Basic MAPS or Advanced MAPS.

Select OK.

Close Local Group Policy Editor.

That should do it!

Conclusion:

• Microsoft Defender Antivirus Cloud-delivered Protection is crucial for maintaining endpoint security.
• It is enabled by default when activating Virus & threat protection in the Windows Security app.
• Disabling cloud protection significantly lowers your device’s safety and is not advisable.
• Users can easily manage cloud protection settings through multiple methods:
  • Windows Security app
  • Local Group Policy Editor
  • Microsoft Endpoint Manager
  • PowerShell cmdlets
• Regularly checking and adjusting these settings helps ensure your device remains secure against emerging threats.