Malware protection in Microsoft 365

Malware includes viruses, spyware, ransomware, and any other malicious software designed to steal data or harm computer systems. Microsoft 365 systems include anti-malware solutions, such as Microsoft Defender antivirus detection, to prevent malware introduction by a client or Microsoft 365 server. Anti-malware software is a primary mechanism used to protect Microsoft 365 assets from malicious software. It provides both preventive and detective measures against malicious software.

Anti-malware solutions check software versions and known malware signatures at least daily to make detections. Each service team centrally manages the following functions on each endpoint:

• Automatic scans of the environment
• Periodic scans of the file system (at least weekly)
• Real-time scans of files upon download, opening, or execution
• Automatic download and application of signature updates at least daily from the vendor's virus definition site
• Alerting, cleaning, and mitigation of detected malware

When anti-malware solutions detect malware, they alert the responsible Microsoft incident response team so they can start the incident response process. For a unified threat intelligence approach to ransomware, see Microsoft Defender XDR.

Protection against malware is a shared responsibility. For more information on how Microsoft 365 can help secure your data, see Exchange Online Protection, Microsoft Defender for Office 365, and Shared ransomware protection.