Cortex XDR along side MS Defender for Endpoint

[tmeksik]

Hi

We are in a position where we would want MS Defender for Endpoint (the EDR, not just the AV) to fully work alongside Cortex XDR.

We dialed Cortex XDR's protection down to work "passively" by re-configuring all modules to the "report only" as opposed to "block".

However, Defender for Endpoint still does not function properly i.e. no MDE security policies are applied unless we paused Cortex XDR production completely.

Any chance anyone is in the know if this is even possible to have MS Defender for Endpoint fully working while maintain some of Cortex XDR's presence?

Thanks!

[aspatil · Accepted solution]

Hello @tmeksik ,

You can't use Windows Defender and Cortex XDR together. Its like running other AV or EDR along with XDR agent which can create conflict.

When you install Cortex XDR, it automatically disables Defender. 

On server its recommended to put defender in passive mode or disable as advised by Microsoft if using other security product:

https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[maximk]

You can enable MS Defender alongside with Cortex XDR by modifying Agent Settings >  Windows Security Center Integration. 

Once you disable the integration, MS Defender will become fully active. Make sure you adjust your policy accordingly to avoid performance issues.