Turn on block at first sight

This article describes an antivirus/antimalware feature known as "block at first sight", and describes how to enable block at first sight for your organization. Before you begin, review the Prerequisites section for required settings and supported operating systems.

Prerequisites

Supported operating systems

Block at first sight is supported on the following operating systems:

• Windows

What is "block at first sight"?

Block at first sight is a threat protection feature of next-generation protection. It detects new malware and blocks it within seconds. The feature is enabled when you turn on these settings:

• Cloud protection (also called cloud-delivered protection in Windows Security) is turned on.
• Sample submission is set to send samples automatically.
• Microsoft Defender Antivirus is up to date on devices.

In most enterprise organizations, these settings are already configured with Microsoft Defender Antivirus deployments. For more information, see Turn on cloud protection in Microsoft Defender Antivirus.

How it works

When Microsoft Defender Antivirus finds a suspicious file it hasn't seen before, it sends a query to the cloud protection backend. The cloud backend checks the file using heuristics, machine learning, and automated analysis. It then decides if the file is malicious or safe.

Microsoft Defender Antivirus uses multiple detection and prevention methods to deliver accurate, real-time protection.

A few things to know about block at first sight

Keep the following details in mind when using block at first sight:

• Block at first sight can block nonportable executable files (such as JS, VBS, or macros) and executable files, running the latest Defender antimalware platform on Windows or Windows Server.

• Block at first sight only uses the cloud protection backend for executable files and nonportable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if the file is a previously undetected file.

• If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs more analysis to reach a determination. The cloud then either allows the file to run or blocks the file in all future encounters, depending on whether the cloud determines the file to be malicious or not a threat.

• In many cases, this cloud-based analysis and blocking process can reduce the response time for new malware from hours to seconds.

• You can specify how long a file should be prevented from running while the cloud-based protection service analyzes the file. And, you can customize the message displayed on users' desktops when a file is blocked. You can change the company name, contact information, and message URL.

Turn on block at first sight with Microsoft Intune

To enable block at first sight using a Microsoft Intune Endpoint Security Antivirus policy, see Create an endpoint security policy (opens in a new tab in the Intune documentation). When creating the policy, use these settings:

• Policy type: Antivirus
• Platform: Windows
• Profile: Microsoft Defender Antivirus
• Configuration settings: Configure the following settings:
  • Allow cloud protection: Select Allowed. Turns on Cloud Protection (Default).
  • Submit samples consent: Select one of the following values:
    • Send safe samples automatically. (Default)
    • Send all samples automatically

For more information about antivirus profiles in Microsoft Intune, see Antivirus policy for endpoint security in Microsoft Intune.

Turn on block at first sight with Group Policy

1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > MAPS.

5. In the details pane of MAPS, configure the following settings. To open and configure a setting, use any of the following methods:

   • Double-click the setting.
   • Right-click the setting, and then select Edit.
   • Select the setting, and then select Action > Edit.

Configure the 'Block at First Sight' feature:

1. In the details pane of MAPS, open the Configure the 'Block at First Sight' feature setting.
2. In the setting window that opens, select Enabled, and then select OK.

Send file samples when further analysis is required:

1. In the details pane of MAPS, open the Send file samples when further analysis is required setting.
2. In the setting window that opens, configure the following options:

   1. Select Enabled.

   2. Send file samples when further analysis is required: Select one of the following values:

      • Send safe samples (0x1)
      • Send all samples (0x3)

      Important

      Setting to Always prompt (0x0) lowers the protection state of the device. Never send (0x2) means block at first sight doesn't function.

   3. Select OK.

Confirm block at first sight is enabled on individual client devices

You can confirm that block at first sight is enabled on individual client devices using the Windows Security app. Block at first sight is automatically enabled as long as Cloud-delivered protection and Automatic sample submission are both turned on.

1. Open the Windows Security app.

2. Select Virus & threat protection, and then, under Virus & threat protection settings, select Manage Settings.

   

3. Confirm that Cloud-delivered protection and Automatic sample submission are both turned on.

Turn off block at first sight

Turn off block at first sight with Microsoft Intune

To disable block at first sight with Microsoft Intune, see Modify existing policies (opens in a new tab in the Intune documentation). Choose the following options:

• Policy: Antivirus, then select your Microsoft Defender Antivirus policy
• Allow cloud protection: Not allowed. Turns off Cloud Protection

Turn off block at first sight with Group Policy

Use the following steps to turn off block at first sight with Group Policy:

1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > MAPS.

5. In the details pane of MAPS, open the Configure the 'Block at First Sight' feature setting.

6. In the setting window that opens, select Disabled, and then select OK.

Not an enterprise admin or IT Pro?

If you aren't an enterprise admin or an IT Pro, but you have questions about block at first sight, the following guidance for personal device users can help. Block at first sight is a threat protection feature that detects and blocks malware within seconds. Although there isn't a specific setting called "Block at first sight," the feature is enabled when certain settings are configured on your device.

How to manage block at first sight on or off on your own device

If you have a personal device that isn't managed by an organization, you might be wondering how to turn block at first sight on or off. You can use the Windows Security app to manage block at first sight.

1. On your Windows 10 or Windows 11 computer, open the Windows Security app.

2. Select Virus & threat protection.

3. Under Virus & threat protection settings, select Manage settings.

4. Take one of the following steps:

   • To enable block at first sight, make sure that both Cloud-delivered protection and Automatic sample submission are both turned on.

   • To disable block at first sight:

     Caution

     Turning off block at first sight lowers the level of protection for your device. We don't recommend permanently disabling block at first sight.

     Turn off Cloud-delivered protection or Automatic sample submission.

See also

For more information about Microsoft Defender Antivirus and related features, see the following resources:

• Microsoft Defender Antivirus in Windows
• Enable cloud-delivered protection
• Stay protected with Windows Security
• Onboard to Microsoft Defender for Endpoint