You have a hybrid environment that contains the following servers: •50 Azure virtual machines that run Windows Server 2019 •20 physical, on premises…

To enable Microsoft Defender for Endpoint (MDE) capabilities, specifically Endpoint Detection and Response (EDR), on servers that already have a third-party antivirus (AV) solution, Microsoft Defender Antivirus must be configured to run in passive mode. This configuration prevents conflicts that arise from running two active antimalware solutions simultaneously. In passive mode, Defender Antivirus does not perform real-time scanning or threat remediation, deferring to the active third-party AV. However, its engine remains available for the MDE EDR sensor to use for detection and reporting. The ForceDefenderPassiveMode registry value is the explicit method to ensure Defender Antivirus enters this state, thereby meeting both requirements.

A. Set the Microsoft Defender for Endpoint service to Disabled.

This would disable the EDR sensor (MsSense.exe), which directly contradicts the requirement to enable EDR capabilities.

B. Disable Microsoft Defender Antivirus real-time protection by using Set-MpPreference.

While this disables a conflicting feature, forcing passive mode is the officially recommended and more robust method for ensuring full coexistence and EDR functionality.

D. Enable EDR in block mode.

EDR in block mode is a feature that enhances EDR, but it requires Microsoft Defender Antivirus to be in passive mode as a prerequisite. It is a subsequent step, not the initial configuration to prevent conflicts.

---

1. Microsoft Learn. (2024). Microsoft Defender Antivirus compatibility with other security products.

Section: "How passive mode works" and "How to set passive mode"

Content: This document explicitly states

"To set passive mode

you can use one of several methods

such as... a registry key." It then specifies the registry key: Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

Name: ForceDefenderPassiveMode

Type: DWORD

Value: 1. This directly validates option C as the correct method to ensure coexistence.

2. Microsoft Learn. (2024). Onboard Windows Server to the Microsoft Defender for Endpoint service.

Section: "Microsoft Defender Antivirus and your non-Microsoft antivirus solution"

Content: "If you are using a non-Microsoft antimalware solution on your Windows Servers

you can run Microsoft Defender Antivirus in passive mode... You can set passive mode by using the following registry key: Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

Name: ForceDefenderPassiveMode..." This confirms the procedure for the exact server types mentioned in the question.

3. Microsoft Learn. (2024). Endpoint detection and response in block mode.

Section: "Prerequisites for EDR in block mode"

Content: The documentation lists as a prerequisite: "Microsoft Defender Antivirus is in passive mode." This confirms that enabling EDR in block mode (Option D) is a secondary action that depends on passive mode (Option C) being configured first.