Configure Microsoft Defender Antivirus notifications that appear on endpoints

This article explains how to configure Microsoft Defender Antivirus notifications on Windows endpoints, including threat-detection, scan-completion, and reboot-required notifications.

In Windows 10 and Windows 11, application notifications about malware detection and remediation are more robust, consistent, and concise. Microsoft Defender Antivirus notifications appear on endpoints when scans are completed and threats are detected. Notifications follow both scheduled and manually triggered scans. Notifications for completed scans and detected threats also appear in the Notification Center, and a summary of scans and threat detections appear at regular time intervals.

If you're part of your organization's security team, you can configure how notifications appear on endpoints, such as notifications that prompt for a system reboot or that indicate a threat was detected and remediated.

Prerequisites

Supported operating systems

The following operating systems are supported:

• Windows 10
• Windows 11

Configure antivirus notifications using Group Policy or the Windows Security app

You can configure the display of enhanced notifications (additional notification summaries such as recent threat detections) in the Windows Security app and with Group Policy.

Use Group Policy to disable other notifications

To disable additional notifications by using Group Policy, perform the following steps:

1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Reporting.

   Note

   Group Policy paths before Windows 10, version 2004 (May 2020) might use Windows Defender Antivirus instead of Microsoft Defender Antivirus. Both names refer to the same policy location.

5. In the details pane of Reporting, open the Turn off enhanced notifications setting. To open the setting, use any of the following methods:

   • Double-click the setting.
   • Right-click the setting, and then select Edit.
   • Select the setting, and then select Action > Edit.

6. In the setting window that opens, select Enabled, and then select OK.

   Enabling Turn off enhanced notifications prevents more notifications from appearing.

Use the Windows Security app to disable additional notifications

Use the following steps to disable additional notifications in the Windows Security app:

1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for Security.

2. Select Virus & threat protection tile (or the shield icon on the left menu bar) and, then select Virus & threat protection settings

3. Scroll to the Notifications section and select Change notification settings.

4. Slide the switch to Off or On to disable or enable other notifications.

Configure standard notifications on endpoints using Group Policy

Hide notifications with Group Policy

You can use Group Policy to configure Microsoft Defender Antivirus notifications in the following ways:

• Display more, customized text on endpoints when the user needs to perform an action
• Hide all notifications on endpoints
• Hide reboot notifications on endpoints

Hiding notifications can be useful in situations where you can't hide the entire Microsoft Defender Antivirus interface. See Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface for more information. Hiding notifications will only occur on endpoints to which the policy is deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the Microsoft Configuration Manager Endpoint Protection monitoring dashboard and reports.

To add custom contact information to endpoint notifications, see Customize the Windows Security app for your organization.

Use Group Policy to hide notifications

To hide all notifications by using Group Policy, perform the following steps:

1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Client interface.

   Note

   Group Policy paths before Windows 10, version 2004 (May 2020) might use Windows Defender Antivirus instead of Microsoft Defender Antivirus. Both names refer to the same policy location.

5. In the details pane of Client interface, open the Suppress all notifications setting. To open the setting, use any of the following methods:

   • Double-click the setting.
   • Right-click the setting, and then select Edit.
   • Select the setting, and then select Action > Edit.

1. In the setting window that opens, select Enabled, and then select OK.

   Enabling Suppress all notifications prevents more notifications from appearing.

Use Group Policy to hide reboot notifications

To hide reboot notifications by using Group Policy, perform the following steps:

1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Client interface.

   Note

   Group Policy paths before Windows 10, version 2004 (May 2020) might use Windows Defender Antivirus instead of Microsoft Defender Antivirus. Both names refer to the same policy location.

5. In the details pane of Client interface, open the Suppresses reboot notifications setting. To open the setting, use any of the following methods:

   • Double-click the setting.
   • Right-click the setting, and then select Edit.
   • Select the setting, and then select Action > Edit.

1. In the setting window that opens, select Enabled, and then select OK.

   Enabling Suppresses reboot notifications prevents reboot notifications from appearing.