Defender for Endpoint Tests Auto-Isolation to Stop Lateral Movement
Microsoft Defender for Endpoint is previewing automatic isolation as part of Automatic Attack Disruption, automatically isolating suspected-compromised onboarded endpoints to limit attacker lateral movement and data exfiltration while keeping the device monitored; security operators can release the device after investigation, with the feature expanding prior isolation capabilities across Windows and Linux devices and user accounts.