Microsoft Defender for Endpoint: download quarantine files GA

Microsoft Defender for Endpoint

When this setting is on, quarantined files will be backed up to a secure and compliant location so they can be downloaded directly from quarantine. The Download file button will always be available to use from the file’s detailed profile page in the Microsoft 365 Security Center. This feature is turned ‘On’ by default.

Newly quarantined files from any supported endpoint in your organization will be copied to the same secure Azure storage location as your existing sample submission files. A quarantined file will only be collected once per organization.

Users may be prompted to provide consent before the quarantined file is collected, depending on your automatic sample submission configuration.

Go to Settings > Advanced features > Download quarantined files to adjust the setting.


  • Protected devices have Windows 10 version 1703 or later, Windows Server 2016 or later
  • Your organization uses Microsoft Defender Antivirus with cloud–delivered protection enabled
  • Microsoft Defender for Endpoint is in active mode
  • Engine version is 1.1.17300.4 or later