Protect Mission-Critical Systems with Selective Response Actions 

Selective Response Actions, a configuration option for Defender for Endpoint Plan 2, allow organizations to limit the scope of response actions available when a mission-critical Windows system has a security issue that requires investigation. This option allows the organization to ensure critical system stability, standardize responses to issues that occur on the systems, and ensure response tools are not abused to exploit those systems.

When a potential security incident on a Windows Server or Windows client system occurs, the endpoint detection and response (EDR) capabilities of Defender for Endpoint Plan 2 enable a broad spectrum of potential responses, including the following:

• A basic response (run AV scan, collect files and investigation packages, etc.)
• An advanced response (isolate the device or limit the permitted apps, and escalate for remediation)
• A live response (a remote shell, which helps with broader debugging and remediation)
• Device protection (automated investigation