From 4ee0543e381e2dff35e1cd23f62ebee1d7cf8663 Mon Sep 17 00:00:00 2001 From: 2929kinniku <40157969+2929kinniku@users.noreply.github.com> Date: Fri, 14 Aug 2026 10:03:05 +0900 Subject: [PATCH] Update respond-machine-alerts.md I am a Microsoft Support Engineer (dainomat). A customer pointed out that it is not user-friendly for the documentation to omit a workaround for this issue when device isolation is triggered by Automatic Attack Disruption. Therefore, I would like to submit a pull request with a proposed revision. --- defender-endpoint/respond-machine-alerts.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/defender-endpoint/respond-machine-alerts.md b/defender-endpoint/respond-machine-alerts.md index d5a69c5584..08b09ab90c 100644 --- a/defender-endpoint/respond-machine-alerts.md +++ b/defender-endpoint/respond-machine-alerts.md @@ -209,7 +209,8 @@ Depending on the severity of the attack and the sensitivity of the device, you m **Important points to keep in mind**: -- In environments that use web proxies (including Proxy Auto Configuration (PAC), WPAD, or static/direct proxy configurations), devices might not be able to recover from network isolation. Use selective isolation in such cases. When using selective isolation, exclusion settings aren't required to avoid this scenario. +- In environments that use web proxies (including Proxy Auto Configuration (PAC), WPAD, or static/direct proxy configurations), devices might not be able to recover from network isolation. Use selective isolation in such cases. When using selective isolation, exclusion settings aren't required to avoid this scenario. This issue, in which a device is unable to reconnect to the network, can also occur when device isolation is triggered as full isolation by Automatic Attack Disruption. For selective isolation to be triggered by Automatic Attack Disruption, an isolation exception rule must be configured. Therefore, if you would like to avoid this issue when device isolation is triggered by Automatic Attack Disruption, please configure an isolation exclusion rule of some kind. + - Isolating devices from the network is supported for macOS for client version 101.98.84 and above. You can also use live response to run the action. For more information on live response, see [Investigate entities on devices using live response](live-response.md) - Full isolation is available for devices running Windows 11, Windows 10, version 1703 or later, Windows Server 2012 R2 and later, and Azure Stack HCI OS, version 23H2 and later. - Isolating devices from the network is supported when Defender is running in passive mode on all supported Windows operating systems, macOS and Linux supported versions.