Important: This article is about the Microsoft Defender app on Windows, Mac, and Android. For information about the built-in Microsoft Defender Antivirus in Windows see Stay protected with Windows Security.
If Microsoft Defender finds malware on your device either during a manual scan, a scheduled scan, or with its real-time protection feature it'll let you know and tell you what actions, if any, it was able to take to protect you.
In most cases Defender will be able to block the malware, and in some cases, it may need you to approve a final action such as deleting or quarantining the malicious file.
How do I get notified of threats?
There are a few ways that Defender will try to notify you if we find a threat.
-
A notification message on the affected device. If you've allowed Microsoft Defender to send you notifications, then Defender may pop up an alert message on the affected device if it detects malware.
-
On the Defender dashboard. If Defender detects malware on one of your devices, it will display an alert on the Defender dashboard.
-
On the affected device you should see an alert right at the top of the dashboard.
-
If the malware is found on one of your other devices that is signed into Defender, you'll see that the device needs attention on the Other devices pane of the dashboard.
-
-
Under Security history in Defender. If you go to the Alerts screen you'll see the alert details there.
What's the difference between delete and quarantine?
If Defender wasn't able to automatically remove the blocked threat it may need you to let it know what to do. The options available may include:
-
Delete - Deletes the dangerous file from your system.
-
Quarantine - Moves the dangerous file to a safe location on your system where it can't do any harm. Once the file is quarantined you can delete or restore it from there.
Note: If you don't take any other action files in quarantine will be automatically deleted in 90 days.
What if I think it's safe and want to allow it to run anyhow?
One of the options you may have is Allow which tells Microsoft Defender not to block this threat in the future. It's important to know that this doesn't just allow this specific file or process to run, but any file or process in the future that contains the same threat. This may cause your device or data to be vulnerable to future attacks.
