Microsoft Defender can now automatically isolate hacked endpoints

Microsoft is previewing an automatic device isolation capability in Defender for Endpoint that disconnects suspected compromised endpoints from the network (while retaining connectivity to Defender for monitoring) to limit lateral movement and impact. The article also reviews related Defender features and testing milestones—manual containment, Linux support, account isolation, blocking traffic to undiscovered endpoints, and scheduled Linux scans—and explains how admins can release devices from isolation after investigation.