
Platform updates are retried after a reboot or when all monitored services are stopped. Platform updates can be temporarily postponed if other protection features (such as Endpoint DLP or Device Control) are actively monitoring running processes. The mde-urls workbook also lists the services and their associated URLs that your network must be able to connect to, as described in Enable access to Microsoft Defender for Endpoint service URLs in the proxy server.

If you're looking for a list of Microsoft Defender processes, download the mde-urls workbook, and then select the Microsoft Defender Processes worksheet.

To learn more about security intelligence updates, see Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware. To learn more about the gradual rollout process, and to see more information about the next release, see Manage the gradual rollout process for Microsoft Defender updates. See the latest broad channel release here. This article lists changes that are included in the broad release channel. Monthly updates are released in phases, resulting in multiple packages visible in your Window Server Update Services.

Updates are released under the following KBs:
