topic Re: Cortex XDR along side MS Defender for Endpoint in Cortex XDR Discussions

Cortex XDR along side MS Defender for Endpoint

tmeksik — Tue, 11 Mar 2025 23:57:52 GMT

We are in a position where we would want MS Defender for Endpoint (the EDR, not just the AV) to fully work alongside Cortex XDR.

We dialed Cortex XDR's protection down to work "passively" by re-configuring all modules to the "report only" as opposed to "block".

However, Defender for Endpoint still does not function properly i.e. no MDE security policies are applied unless we paused Cortex XDR production completely.

Any chance anyone is in the know if this is even possible to have MS Defender for Endpoint fully working while maintain some of Cortex XDR's presence?

Thanks!

Re: Cortex XDR along side MS Defender for Endpoint

aspatil — Wed, 12 Mar 2025 04:41:46 GMT

Hello @tmeksik ,

You can't use Windows Defender and Cortex XDR together. Its like running other AV or EDR along with XDR agent which can create conflict.

When you install Cortex XDR, it automatically disables Defender.

On server its recommended to put defender in passive mode or disable as advised by Microsoft if using other security product:

https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: Cortex XDR along side MS Defender for Endpoint

maximk — Sun, 16 Mar 2025 15:11:40 GMT

You can enable MS Defender alongside with Cortex XDR by modifying Agent Settings > Windows Security Center Integration.

Once you disable the integration, MS Defender will become fully active. Make sure you adjust your policy accordingly to avoid performance issues.

Re: Cortex XDR along side MS Defender for Endpoint

PhilBoe — Tue, 01 Apr 2025 11:04:20 GMT

Hi, that is not entirely correct.
MS Defender for Endpoint will NOT be disabled automatically.
Only the free Defender version will be disabled.

Re: Cortex XDR along side MS Defender for Endpoint

AliAlhaddad — Thu, 29 May 2025 14:31:21 GMT

did you find a way to make the two to work smoothly? we are trying this case in an environment and it seems cortex and defender don't like each other XD! Please if you have any exception suggetion or anything that would make the situation workable, let us know!

Re: Cortex XDR along side MS Defender for Endpoint

maximk — Thu, 05 Jun 2025 07:31:48 GMT

If your intention is to enable telemetry collection from MS ATP and Cortex XDR, then it's a bad idea.

If you want to enable Defender AV alongside Cortex XDR, then yes — it's possible. Just define relevant exclusions on both sides to avoid conflicts.