(Updated) New Microsoft Defender Antivirus services on Windows Devices

Updated April 18, 2024: We have updated the rollout timeline and content below. Thank you for your patience.

Microsoft Defender Antivirus on Windows 10 and Windows 11 will be shipping with a new service:

• Microsoft Defender Core service.

[When this will happen:]

Preview: Nov ‘23 to Beta channel (Prerelease).

Worldwide: We will roll out to all rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during late April 2024 (previously mid-April).

GCC Moderate, GCC High and DOD: We will roll out to all rings (Current Channel (Preview), Current Channel (Staged) and Current Channel (Broad)) during mid-June 2024.

[How this will affect your organization:]

To enhance your endpoint security experience, we are shipping the Microsoft Defender Core service which will help with stability and performance of Microsoft Defender Antivirus.

[What you need to do to prepare:]

1. Update the Platform Update to the latest version 4.18.23110.0 or newer
2. Allow the following URL’s:
   • Commercial:
     • *.events.data.microsoft.com
     • *.endpoint.security.microsoft.com
     • *.ecs.office.com
   • For US Gov, the ECS URL’s are:
     • GCC Mod: *.gccmod.ecs.office.com
     • GCC High: *.config.ecs.gov.teams.microsoft.us
     • DOD: *.config.ecs.dod.teams.microsoft.us
3. If using an Application Control application or running a 3rd party AV and/or EDR, add the following process to the allowed list.
   • Microsoft Defender Core Service – MdCoreSvc – MpDefenderCoreService.exe