[Josh Bregman (j0shbregman)]

Summary

Document the AI agent runtime protection and prompt evidence collection preferences in the latest Defender PowerShell reference.

• Add AiAgentProtection, AiAgentNetworkInspection, and PromptEvidenceCollection to Set-MpPreference and the corresponding reset switches to Remove-MpPreference.
• Add examples for audit mode, optional prompt evidence collection, preference inspection, and local preference removal.
• Explain the device default changing from Off to On through an update to the November 2026 platform release, the audit/block prerequisite, managed-policy precedence, privacy considerations, and the distinction between collection and evidence for blocked activity. Earlier builds retain the Off default; explicit settings take precedence.
• Link to the runtime protection setup guide for prerequisites and deployment guidance. These additions describe the supported Windows client preview; they do not extend runtime protection support to Windows Server.

Validation

Compared parameter types, aliases, and enum names with native Windows PowerShell cmdlet metadata. Parsed examples without executing configuration changes. Checked whitespace, parameter headings, and documentation links.

• Descriptive title and change summary
• Contributor guidance reviewed
• Changes follow the existing reference structure and formatting

November default transition: publication gate

Confirm the exact first Microsoft Defender Antivirus platform version containing the default-On change before publication, and use that minimum version in the reference. The current wording identifies the November 2026 release update without assuming every November build contains the change. Enabling collection does not enable runtime protection or change its audit or block mode. Parameter syntax, types, and aliases are unchanged.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[learn-build-service-prod]

Learn Build status updates of commit 90b4917:

✅ Validation status: passed

File	Status	Preview URL	Details
docset/winserver2025-ps/Defender/Get-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/Defender/Remove-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/Defender/Set-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[learn-build-service-prod]

Learn Build status updates of commit f981695:

✅ Validation status: passed

File	Status	Preview URL	Details
docset/winserver2025-ps/Defender/Get-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/Defender/Remove-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/Defender/Set-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[learn-build-service-prod]

Learn Build status updates of commit 6df3501:

✅ Validation status: passed

File	Status	Preview URL	Details
docset/winserver2025-ps/Defender/Get-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/Defender/Remove-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/Defender/Set-MpPreference.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.