how to quarantine a compromised laptop with defender for endpoint
Isolates a compromised laptop from the network using Microsoft Defender for Endpoint device isolation. Covers triggering isolation from the Defender portal, what the user experiences, gathering investigation evidence while isolated, and releasing the device after cleanup. Use at the first sign of active compromise such as ransomware behavior or callbacks to attacker infrastructure. Not for routine malware alerts that auto-remediated.
TL;DR
In the Microsoft Defender portal, open the device and choose Isolate device; full isolation is the right call for active compromise. The laptop loses all network except the Defender channel, which stops exfiltration while you investigate. Run your scans, pull the incident timeline, remediate, then release the device and log the whole sequence in the ticket.
Steps
- Microsoft Defender portal / Assets / Devices / select the laptop / Isolate device. Choose full isolation for active compromise; choose selective isolation if you need live response through the Defender channel while blocking everything else. Expected: the device status changes to Isolated within about a minute.
- Tell the user what happened: their laptop keeps working locally but nothing reaches the network, and they should stop trying to reconnect or reboot around it. Expected: the user stops interfering with the containment.
- While the device is isolated, run a full antivirus scan from the portal and review the incident timeline for the malicious process tree. Expected: you see what ran and what it touched, with no further exfiltration possible.
- Remediate: remove the threat, rotate the user's credentials, and confirm the device is clean before choosing Release from isolation. Expected: the device reconnects and the incident can be closed.
- Log the isolation time, the indicators found, and the release decision in the ticket. Expected: a complete timeline for the incident record.
Use this when
- You see ransomware-like behavior on a managed laptop
- Alert triage shows callbacks to known attacker infrastructure
- A user reports something actively wrong and you need containment before diagnosis
Not for this skill when
- A routine malware alert already auto-remediated with no persistence signs (no isolation needed)
- The device is not onboarded to Defender for Endpoint (isolate at the network level instead)
- You need forensic disk imaging (isolation preserves the running state; image separately if your process requires it)
Compatibility
- Microsoft Defender for Endpoint Plan 1 or Plan 2 with the device onboarded
- Windows, macOS, and Linux devices supported
Variants
Selective isolation
Keeps the Defender portal channel open while blocking everything else. Useful when you want live response actions during containment.
Isolate and scan in one motion
The portal lets you trigger isolation together with an antivirus scan so containment and triage start at the same time.
Why it happens
Isolation cuts the attacker's remote access and stops exfiltration while keeping the device manageable. It is a containment control, not a cleanup: the threat is still on the disk until you remediate, which is why release only happens after the device is confirmed clean.
Edge cases
- Isolation does not stop someone with physical access to the laptop. Pair it with disabling the user account in Entra ID.
- If the device is powered off or not checking in, the isolation action queues until it reconnects. Disable the user account in the meantime so a reconnect cannot authenticate.
- A compromised device may have a second foothold elsewhere; check the incident's related devices before declaring the event over.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstVwxnpYpN-hylulg23HLtA
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.