Microsoft Defender Now Blocks Unknown Devices to Stop Cyberattacks

Microsoft is rolling out a new security feature in its Defender for Endpoint platform designed to block cyberattacks before they can spread across corporate networks. The company announced that the new feature will automatically block traffic to and from endpoints that have not yet been discovered or onboarded, reducing the risk of lateral movement by attackers.

This proactive security measure will help prevent hackers from using unprotected or unknown devices as a bridge to access other systems within an organization. With this enhancement, Microsoft Defender for Endpoint becomes more efficient in identifying threats and stopping them in real time.

How the New IP Containment Feature Works

The new feature works by automatically containing the IP addresses of devices that haven’t been discovered or officially onboarded to Microsoft Defender for Endpoint. This containment stops any data from being sent or received by these devices, thereby cutting off potential attack routes.

Microsoft explains that when Defender detects a suspicious or unknown IP address, it immediately applies a containment policy. This policy blocks communication on certain network ports and in specific directions, effectively limiting any chance for an attacker to move laterally across the network.

Here’s what Microsoft had to say about the process:

“Containing an IP address associated with undiscovered devices or devices not onboarded to Defender for Endpoint is done automatically through automatic attack disruption. The Contain IP policy automatically blocks a malicious IP address when Defender for Endpoint detects the IP address to be associated with an undiscovered device or a device not onboarded.”

In simpler terms, if a device hasn’t been officially added to the Defender system, it won’t be allowed to send or receive network data. This prevents attackers from jumping from one device to another — a common tactic in advanced cyberattacks.

Targeted Containment for Maximum Security

One of the key strengths of this update is its granular control. Defender doesn’t just shut down all traffic blindly. Instead, it evaluates the device’s role in the network and applies a tailored policy. The containment focuses on specific network ports and traffic directions, minimizing disruption while still keeping the threat under control.

This method is called “automatic attack disruption,” and it allows Defender for Endpoint to act fast without requiring manual intervention from IT administrators. Once an issue is detected, the system identifies the device as malicious, applies an appropriate policy, and contains the threat in real time.

Supported Systems and Manual Overrides

This new IP containment capability will be available on Defender for Endpoint-managed devices running:

• Windows 10

• Windows Server 2012 R2

• Windows Server 2016

• Windows Server 2019 and newer

Administrators will also have the option to manually remove the IP containment when needed. This can be done via the Action Center in Microsoft Defender. Simply select the “Contain IP” action and then choose “Undo” to restore the connection.