Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint

New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint

Written By Anoop C Nair
Last Updated May 8, 2026
SHARE

Key Takeaways

  • Selective Response Actions is currently available in Preview.
  • Helps organisations customise security response actions during device onboarding.
  • Provides better control over high-impact security operations on critical devices.
  • Supports protection for Tier-0 systems and other high-value assets.
  • Helps maintain operational stability while improving security protection.
  • Enhances flexibility and control in Microsoft Defender for Endpoint security operations.

Selective Response Actions is a new Preview feature in Microsoft Defender for Endpoint that gives organizations better control over security response actions during device onboarding. It helps IT and security teams apply high-impact actions more carefully on Tier-0 systems and other important devices, improving protection while maintaining operational stability.

Table of Content

New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint

To use the Selective Response Actions feature, organisations must first enable it in the Microsoft Defender portal. Sign in to the portal, go to Settings > Endpoints > Advanced features, and turn on the Allow restricted security operations during onboarding option. Once enabled, administrators can start configuring restricted security operations for onboarded devices.


Feature
Selective Response Actions
New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint – Table 1
New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint - Fig.1 - Creds to MS
New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint – Fig.1 – Creds to MS

How Selective Response Actions Work in Microsoft Defender for Endpoint

To use Selective Response Actions, organisations must first enable the feature in their tenant environment. After enabling it, administrators can use the Defender Deployment Tool (DDT) to create an onboarding package with customised security operation settings.

  • During package configuration, admins can choose between two onboarding modes:
    • Full Functionality – Allows all response actions on onboarded devices.
    • Restricted Functionality – Limits high-impact response actions for better operational control.

If Restricted Functionality is selected, organisations can decide which security actions are allowed or blocked on Tier-0 systems and other critical devices. This helps reduce operational risks while maintaining strong security protection and device stability.

Patch My PC
CapabilityWhat It Does
Basic ResponseRun antivirus scans, collect files, and gather investigation packages from devices.
Advanced ResponseIsolate devices, restrict app execution, and start remediation actions for vulnerabilities.
Live ResponseAllows security teams to start live remote response sessions on devices.
Device ProtectionSupports automated investigation and response (AIR) actions on devices automatically or manually.
New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint – Table 2

Prerequisites and Supported Operating Systems

Selective Response Actions in restricted mode are supported on Windows client and Windows Server devices running Sense version 10.8798 or later. Organisations must also install the required KB updates to use this feature properly.

  • Supported Operating Systems
    • Windows Server 2025 (All Editions) — KB5063878
    • Windows Server 2022 — KB5063880
    • Windows Server 2019 — KB5063877
    • Windows 10 22H2 — KB5062649
    • Windows 11 23H2 — KB5062663
    • Windows 11 24H2 — KB5062660
    • Windows 11 25H2 — Supported on all versions

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community  and the Whatsapp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Resources

Selective response actions on critical assets in Microsoft Defender for Endpoint – Microsoft Defender for Endpoint | Microsoft Learn

Author

Anoop C Nair is a Workplace Technology solution architect with 25+ years of experience. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He is a blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, and Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Entra, and Microsoft Security.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint EDR Updates are now Separate from Monthly Windows Security Updates for Faster Protection

Key Takeaways In this post, we are discussing how Microsoft Defender for Endpoint EDR Updates Will Be Delivered Through Microsoft Update. Microsoft has introduced a new update model for Microsoft Defender for Endpoint Detection and Response (EDR) security updates. Previously, these updates were included with the monthly Windows security updates. This change enables Microsoft to […]

AC Anoop C Nair 5 min read
Microsoft Defender for Endpoint

Microsoft Defender Custom Data Collection Lets You Collect Custom Endpoint Logs Without Extra Agents

Key Takeaways: Let’s discuss about Microsoft Defender Custom Data Collection to Streamlined Telemetry without Extra Agent. Microsoft announced the general availability of Microsoft Defender Custom Data Collection. This feature is simplified collection of logging through the Defender agent itself. Microsoft Defender Custom Data Collection to Streamlined Telemetry without Extra Agent Admins can define which events […]

AC Anoop C Nair 3 min read
Intune

Manage Offline Security Updates for Linux using Microsoft Defender and Intune

Key Takeaways Manage Offline Security Updates for Linux using Microsoft Defender and Intune! Microsoft now allows admins to manage offline security intelligence updates for Linux devices directly from the Defender and Intune portals. Admins can configure how Linux devices receive Defender security updates without using manual command-line configurations on each device. Configure Offline Security Intelligence […]

AC Anoop C Nair 3 min read
Microsoft Defender for Endpoint

New Microsoft Security Recommendation to Block mshta.exe and Reduce Attack Risks

Key Takeaways Hey, let’s discuss about New Microsoft Security Recommendation to Block mshta.exe and Reduce Attack Risks. Microsoft introduces a new Microsoft Secure Score recommendation in Microsoft Defender for Endpoint (MDE) to help organizations strengthen endpoint security and reduce exposure to common attack techniques. This recommendation focuses on blocking outbound traffic from mshta.exe, a legitimate […]

AC Anoop C Nair 3 min read