ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
MC687846 Plan for changeUpdated messageNew featureUser impactAdmin impact

New Microsoft Defender Antivirus services on Windows Devices

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Defender XDR
Message Center archive Open in your tenant

Rollout

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions we saw
  • Seen 5 Jul 2024 late June 2024 → mid-July 2024
  • Seen 21 Jun 2024 mid-June 2024 → late June 2024
  • Seen 18 Apr 2024 April 15, 2024, June 10, 2024 → late April 2024, mid-June 2024
  • Seen 5 Mar 2024 March 11th, 2024, April 8th, 2024 → April 15, 2024, June 10, 2024

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, safely structured

Updated July 5, 2024: We have updated the rollout timeline and content below. Thank you for your patience.

Microsoft Defender Antivirus on Windows 10 and Windows 11 will be shipping with a new service:

  • Microsoft Defender Core service.

When this will happen

Preview: November ‘23 to Beta channel (Prerelease).

Worldwide: We will roll out to all rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during late April 2024 (previously mid-April).

GCC Moderate, GCC High and DOD: We will roll out to all rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during mid-July 2024 (previously late June).

How this will affect your organization

To enhance your endpoint security experience, we are shipping the Microsoft Defender Core service which will help with stability and performance of Microsoft Defender Antivirus.

What you need to do to prepare

  1. Update the Platform Update to the latest version 4.18.23110.0 or newer
  2. Allow the following URL’s:
    • Commercial:
      • *.events.data.microsoft.com
      • *.endpoint.security.microsoft.com
      • *.ecs.office.com
    • For US Gov, the ECS URL’s are:
      • GCC Mod: *.gccmod.ecs.office.com
      • GCC High: *.config.ecs.gov.teams.microsoft.us
      • DOD: *.config.ecs.dod.teams.microsoft.us
  3. If using an Application Control application or running a 3rd party AV and/or EDR, add the following process to the allowed list.
    • Microsoft Defender Core Service – MdCoreSvc - MpDefenderCoreService.exe

What changed

Between archive captures, newest first

  1. Updated June 21,July 5, 2024: We have updated the rollout timeline and content below. Thank you … rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during late June mid-July 2024 (previously mid-June).late June). How this will affect your organization: To enhance your endpoint security experience, …

  2. Updated April 18,June 21, 2024: We have updated the rollout timeline and content below. Thank you … a new service: Microsoft Defender Core service. When this will happen: Preview: NovNovember ‘23 to Beta channel (Prerelease). Worldwide: We will roll out to all … rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during mid-June 2024.late June 2024 (previously mid-June). How this will affect your organization: To enhance your endpoint security experience, …

  3. Updated March 5,April 18, 2024: We have updated the rollout timeline and content below. Thank you … rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during the week of April 15, 2024. late April 2024 (previously mid-April). GCC Moderate, GCC High and DOD: We will roll out to all rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during the week of June 10,mid-June 2024. How this will affect your organization: To enhance your endpoint security …

  4. Updated January 9,March 5, 2024: We have updated the rollout timeline and content below. Thank you … 11 will be shipping with a new service: Microsoft Defender Core service. [WhenWhen this will happen:]happen: Preview: Nov ‘23 to Beta channel (Prerelease). For Standard: Worldwide: We will roll out to all rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during the week of March 11th,April 15, 2024. For GCC Moderate, GCC High and DOD: We will roll out to all … (Preview), Current Channel (Staged) and Current Channel (Broad)) during the week of April 8th,June 10, 2024. [HowHow this will affect your organization:]organization: To enhance your endpoint security experience, we are shipping the Microsoft Defender … service which will help with stability and performance of Microsoft Defender Antivirus. [WhatWhat you need to do to prepare:]prepare: Update the Platform Update to the latest version 4.18.23110.0 or newer Allow …

  5. … 11 will be shipping with a new service: Microsoft Defender Core service. When[When this will happen:happen:] Preview: Nov ‘23 to Beta channel (Prerelease). For Standard: We will roll … (Staged) and Current Channel (Broad)) during the week of April 8th, 2024. How[How this will affect your organization:organization:] To enhance your endpoint security experience, we are shipping the Microsoft Defender … service which will help with stability and performance of Microsoft Defender Antivirus. What[What you need to do to prepare:prepare:] Update the Platform Update to the latest version 4.18.23110.0 or newer Allow …

  6. · first version seen

No related announcements were found in the saved public history. Check the source for newer announcements.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 12:11 UTC · 256 of 275 readable · 252 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.