Did You Know: Defender for Endpoint Device Isolation Keeps the Sensor Online and Lifts Itself After Seven Days

NEW YORK - Isolating a device in Microsoft Defender for Endpoint cuts it off from the network, but not from Microsoft. Microsoft's documentation on device response actions says the isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device. The aim, Microsoft says, is to keep an attacker from controlling the device and carrying out further activity such as data exfiltration and lateral movement. Isolate device is one of only four manual response actions included in Defender for Endpoint Plan 1, alongside running an antivirus scan, stopping and quarantining a file, and adding an indicator to block or allow a file.

Isolation is also not permanent. In its list of points to keep in mind, Microsoft says device isolation is automatically lifted after seven days. If a device is inactive or offline when the action is submitted, Defender for Endpoint retries enforcing the isolation for up to three days; if the device does not reconnect in that time, Microsoft says the isolation is not retried and administrators should reissue it once the device is active. The same list warns that isolating a server running Microsoft Hyper-V blocks network traffic to all of its child virtual machines, and that an isolated device is removed from isolation when an administrator modifies or adds a new iptables rule on it. Isolation on Linux lists iptables and ip6tables among its prerequisites.

Network design can change what isolation leaves standing. Microsoft says only certain processes and destinations are allowed while a device is isolated, so a device behind a full VPN tunnel will not be able to reach the Defender for Endpoint cloud service after isolation; it recommends split tunneling for Defender traffic. In environments that use web proxies, including Proxy Auto Configuration, WPAD, or static or direct proxy settings, Microsoft says devices might not be able to recover from network isolation and recommends selective isolation instead.

Selective isolation is the second of two modes. Microsoft's isolation exclusions page describes full isolation as blocking all traffic except essential communications with the Defender agent, with no exclusions applied, and selective isolation as a mode in which administrators apply exclusions so that critical tools and communications keep working. Exclusion rules can name a Windows process path, a service, an app package family name, or remote IP addresses, up to 20 per rule, and an excluded process does not pass its exemption to the child processes it creates. Microsoft warns that any exclusion weakens device isolation. It also says that once the isolation exclusions feature is enabled, the previously embedded exclusions for Microsoft Teams, Outlook and Skype no longer apply and the list starts empty, and that exclusions for email, messaging and other applications are not supported for macOS and Linux isolation.

For a SOC, isolation is a containment step with a clock and a scope. Because the sensor stays connected, responders can keep investigating: Microsoft says an investigation package collected from the device page helps identify the current state of the device, and on Windows it includes active network connections, the ARP and DNS caches, Prefetch files and SMB sessions. Microsoft also says Defender for Endpoint can isolate end-user workstations on its own as part of automatic attack disruption, a preview feature, so not every isolated device was isolated by an analyst. Record when each device was isolated and in which mode, check which exclusion rules apply to it, and schedule a review before the seven days run out. A device still marked isolated in a case ticket may already be back on the network.