Microsoft Defender for Endpoint has introduced real-time cut-off of compromised devices from the network, blocking lateral movement before ransomware or other advanced attacks can spread across an organization.
When Microsoft Defender for Endpoint detects that a device is compromised, it can automatically isolate it as part of its Automatic Attack Disruption capability.
The compromised device is immediately disconnected from the network, reducing the risk of further organizational impact while still retaining connectivity to the Microsoft Defender for Endpoint service, which continues to monitor the device throughout the isolation period.
Microsoft Defender Auto-Isolates Devices
This automated isolation is specifically scoped to end-user workstations that are onboarded and managed by Microsoft Defender for Endpoint. It does not broadly sweep the environment but targets only the specific devices involved in the active incident.
Microsoft Defender XDR correlates millions of individual signals from endpoints, identities, email and collaboration tools, and SaaS applications into a single high-confidence incident before acting, Microsoft said.
The platform operates in three key stages: correlating cross-source signals into a unified incident view; identifying assets controlled by the attacker and used to propagate the attack; and automatically executing response actions, including device isolation, across integrated Defender products in real time.
Critically, this approach differs from traditional prevention methods that block based on a single indicator of compromise (IOC).
Instead, Defender XDR weighs the full attack context and triggers automated containment only when it reaches a high-confidence threshold, significantly reducing the risk of false positives.
As shown in live incident data from the Microsoft Defender portal, the Attack Disruption engine automatically cycles devices through isolation and unisolation.
The Activities tab in Incident ID 27121 shows the device desktop-elak59m being isolated and unisolated multiple times between 3:10 PM and 3:51 PM on January 27, 2026, all triggered automatically with a status of Completed.
The Action Center history further confirms repeated isolation actions, some initiated by Disruption and others via the portal, with the majority completing successfully.
Microsoft has engineered several safeguards to prevent over-isolation from disrupting operations:
- Scoped action: Isolation targets only specific devices involved in the incident, not the broader environment
- Time-limited isolation: Isolation is automatically reversed after a defined time window
- Customer control: Security operators retain full authority to review the incident, release isolation early, and manage remediation
- Isolation exclusions: Administrators can define process- and network-based exclusion rules to keep critical tools such as VPNs, DNS servers, or forensic utilities connected even during device isolation
Automatic Attack Disruption is designed to limit lateral movement at the earliest stage of an attack, according to Microsoft, dramatically reducing overall impact from financial costs to productivity loss.
In April 2025, Microsoft further expanded the capability with granular containment for critical assets and IP address containment for unmanaged or undiscovered devices, ensuring that even shadow IT endpoints cannot be weaponized as an attacker’s entry point.
Security teams remain in complete control throughout the process, investigating, remediating, and safely bringing isolated assets back online once the threat is neutralized.
This combination of autonomous speed and human oversight positions Microsoft Defender’s attack disruption as one of the most robust automated defenses against ransomware campaigns operating in enterprise environments today.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
