When an agent is in a Disabled state, what happens to policy enforcement?

When a Cortex XDR agent is in the "Disabled" state, it ceases all protective functions on the endpoint. This means no prevention policies—including malware, exploit, and restriction profiles—are enforced. The agent, however, remains installed and continues to communicate with the Cortex XDR management console, allowing it to receive policy updates and be re-enabled remotely. This state is primarily used for troubleshooting purposes, to temporarily suspend the agent's security enforcement without requiring a full uninstallation.