MC1227621 - Microsoft Defender Antivirus: Change to exclusion storage when using MDE configuration management

Updated February 13, 2026: We have updated the content. Thank you for your patience. 

Introduction

Microsoft Defender Antivirus on Windows is updating how antivirus configuration settings, such as exclusions, are stored when Microsoft Defender for Endpoint (MDE) configurationsecurity settings management is enabled. Starting with platform release 4.18.25110.6, devices using MDE configurationsecurity settings management will no longer store readable exclusion values in the local device registry. Organizations must retrieve configuration using supported Microsoft Defender PowerShell cmdlets, such as Get-MpPreference.

When this will happen:

General Availability (Worldwide): We will begin rolling out early March 2026 and expect to complete by late March 2026.

How this affects your organization:

Who is affected:

• Organizations using Microsoft Defender for Endpoint configurationsecurity settings management.
• Admins or tools relying on registry-based monitoring of antivirus settings.

What will happen:

• Antivirus exclusionDefender antivirus configuration, such as exclusions, values will no longer be readable from the local device registry.
• Registry‑registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. As such registry‑based extraction of exclusionsextractions will no longer be supported.
• Supported Microsoft Defender PowerShell cmdlets (such as Get-MpPreference) will become the required method to retrieve antivirus configuration settings.
• Devices not using MDE configuration management are not affected.
• The feature is on by default for tenants using MDE configuration management.

What you can do to prepare:

• Update monitoring workflows and scripts to use supported PowerShell cmdlets such as:
  • Get-MpPreference
  • Get-MpComputerStatus

• Review internal documentation on retrieving antivirus settings.
• Notify helpdesk or monitoring teams that registry-based queries will no longer return exclusion data.

Learn more: Troubleshoot Microsoft Defender Antivirus settings - Microsoft Defender for Endpoint | Microsoft Learn (will be updated to reflect this change)

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.