Document AI runtime protection and prompt evidence PowerShell preferences

docset/winserver2025-ps/Defender/Get-MpPreference.md

@@ -2,10 +2,11 @@
 description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.
 external help file: MSFT_MpPreference.cdxml-help.xml
 Module Name: Defender
-ms.date: 12/20/2016
+ms.date: 11/11/2026
 online version: https://learn.microsoft.com/powershell/module/defender/get-mppreference?view=windowsserver2025-ps&wt.mc_id=ps-gethelp
 schema: 2.0.0
 title: Get-MpPreference
+ai-usage: ai-assisted
 ---
 
 # Get-MpPreference
@@ -40,6 +41,19 @@ The first command gets the preferences, and then stores them in the **$Preferenc
 The second command uses standard dot syntax to display the **ScanScheduleDay** property of the
 object stored in the **$Preferences** variable.
 
+### Example 2: View AI agent runtime protection preferences
+
+```powershell
+Get-MpPreference |
+    Select-Object AiAgentProtection, AiAgentNetworkInspection, PromptEvidenceCollection
+```
+
+This command displays the device's agent-native inspection, network inspection, and prompt evidence
+collection preferences.
+The properties require supported Microsoft Defender Antivirus platform and engine updates.
+For requirements, configuration, and policy precedence, see
+[Set up AI agent runtime protection](/defender-endpoint/configure-ai-agent-runtime-protection).
+
 ## PARAMETERS
 
 ### -AsJob

docset/winserver2025-ps/Defender/Remove-MpPreference.md

@@ -2,10 +2,11 @@
 description: The Remove-MpPreference cmdlet removes exclusions for file name extensions, paths, and processes, or default actions for high, moderate, and low threats.
 external help file: MSFT_MpPreference.cdxml-help.xml
 Module Name: Defender
-ms.date: 12/20/2016
+ms.date: 11/11/2026
 online version: https://learn.microsoft.com/powershell/module/defender/remove-mppreference?view=windowsserver2025-ps&wt.mc_id=ps-gethelp
 schema: 2.0.0
 title: Remove-MpPreference
+ai-usage: ai-assisted
 ---
 
 # Remove-MpPreference
@@ -45,7 +46,8 @@ Remove-MpPreference [-ExclusionPath <String[]>] [-ExclusionExtension <String[]>]
  [-DisableDnsOverTcpParsing] [-DisableSshParsing] [-PlatformUpdatesChannel] [-EngineUpdatesChannel]
  [-SignaturesUpdatesChannel] [-DisableGradualRelease] [-AllowNetworkProtectionDownLevel]
  [-AllowDatagramProcessingOnWinServer] [-EnableDnsSinkhole] [-DisableInboundConnectionFiltering]
- [-DisableRdpParsing] [-Force] [-CimSession <CimSession[]>] [-ThrottleLimit <Int32>] [-AsJob]
+ [-DisableRdpParsing] [-AiAgentProtection] [-AiAgentNetworkInspection] [-PromptEvidenceCollection]
+ [-Force] [-CimSession <CimSession[]>] [-ThrottleLimit <Int32>] [-AsJob]
  [<CommonParameters>]
 ```
 
@@ -69,8 +71,52 @@ Remove-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Windows\App.exe"
 
 This command will exclude only that specific file app.exe in that specific folder.
 
+### Example 3: Remove a local prompt evidence collection preference
+
+```powershell
+Remove-MpPreference -PromptEvidenceCollection
+```
+
+This command removes the locally configured prompt evidence collection preference.
+It doesn't remove or override a setting configured through Intune or another management channel.
+To explicitly disable local collection instead, use `Set-MpPreference -PromptEvidenceCollection $false`.
+
 ## PARAMETERS
 
+### -AiAgentNetworkInspection
+
+Removes the locally configured AI agent network inspection preference.
+This switch doesn't remove or override managed device policy.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: ani
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -AiAgentProtection
+
+Removes the locally configured agent-native AI agent runtime protection preference.
+This switch doesn't remove or override managed device policy.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: ap
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -AllowDatagramProcessingOnWinServer
 Indicates that the cmdlet removes whether to disable inspection of UDP connections on Windows Server.
 
@@ -995,6 +1041,26 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -PromptEvidenceCollection
+
+Removes the locally configured prompt evidence collection preference.
+Removing the preference isn't the same as explicitly disabling collection, and doesn't remove
+or override a setting configured through Intune or another management channel.
+For requirements and policy precedence, see
+[Configure prompt evidence collection](/defender-endpoint/configure-ai-agent-runtime-protection#configure-prompt-evidence-collection).
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: pec
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -ProxyBypass
 Specifies proxy bypasses.
 

docset/winserver2025-ps/Defender/Set-MpPreference.md

@@ -2,10 +2,11 @@
 description: The Set-MpPreference cmdlet configures preferences for Windows Defender scans and updates.
 external help file: MSFT_MpPreference.cdxml-help.xml
 Module Name: Defender
-ms.date: 09/29/2025
+ms.date: 11/11/2026
 online version: https://learn.microsoft.com/powershell/module/defender/set-mppreference?view=windowsserver2025-ps&wt.mc_id=ps-gethelp
 schema: 2.0.0
 title: Set-MpPreference
+ai-usage: ai-assisted
 ---
 
 # Set-MpPreference
@@ -65,6 +66,8 @@ Set-MpPreference [-ExclusionPath <String[]>] [-ExclusionExtension <String[]>] [-
  [-SignaturesUpdatesChannel <UpdatesChannelType>] [-DisableGradualRelease <Boolean>]
  [-AllowNetworkProtectionDownLevel <Boolean>] [-AllowDatagramProcessingOnWinServer <Boolean>]
  [-EnableDnsSinkhole <Boolean>] [-DisableInboundConnectionFiltering <Boolean>] [-DisableRdpParsing <Boolean>]
+ [-AiAgentProtection <AiAgentProtectionType>]
+ [-AiAgentNetworkInspection <AiAgentNetworkInspectionType>] [-PromptEvidenceCollection <Boolean>]
  [-CimSession <CimSession[]>] [-ThrottleLimit <Int32>] [-AsJob] [<CommonParameters>]
 ```
 
@@ -115,8 +118,72 @@ PS C:\> Set-MpPreference -SignatureScheduleTime 02:00:00
 
 This command configures preferences to check for definition updates 120 minutes after midnight on days when it's scheduled to check.
 
+### Example 3: Audit AI agent activity
+
+```powershell
+Set-MpPreference -AiAgentProtection Audit -AiAgentNetworkInspection Audit
+```
+
+This command enables agent-native event inspection and network inspection in audit mode.
+Each inspection method detects supported threats without blocking the agent action.
+Configure each method independently, using `Block` for enforcement or `Disabled` to turn it off.
+
+### Example 4: Enable prompt evidence collection
+
+```powershell
+Set-MpPreference -PromptEvidenceCollection $true
+```
+
+This command enables additional prompt evidence collection on the device.
+Use `$false` to disable collection.
+Review the privacy considerations in
+[Configure prompt evidence collection](/defender-endpoint/configure-ai-agent-runtime-protection#configure-prompt-evidence-collection)
+before enabling this setting.
+
 ## PARAMETERS
 
+### -AiAgentNetworkInspection
+
+Configures network inspection for supported AI agent-to-LLM traffic.
+Use `Disabled` to turn off this inspection method, `Audit` to detect and report threats without
+blocking, or `Block` to block detected threats at supported inspection points.
+This setting is independent of **AiAgentProtection**.
+The device preference is disabled by default.
+
+```yaml
+Type: AiAgentNetworkInspectionType
+Parameter Sets: (All)
+Aliases: ani
+Accepted values: Disabled, Block, Audit
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -AiAgentProtection
+
+Configures AI agent runtime protection through supported agent-native event interfaces.
+Use `Disabled` to turn off this inspection method, `Audit` to detect and report threats without
+blocking, or `Block` to block detected threats at supported inspection points.
+This setting is independent of **AiAgentNetworkInspection**.
+The device preference is disabled by default.
+
+```yaml
+Type: AiAgentProtectionType
+Parameter Sets: (All)
+Aliases: ap
+Accepted values: Disabled, Block, Audit
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -AllowDatagramProcessingOnWinServer
 Specifies whether to disable inspection of UDP connections on Windows Server.
 
@@ -1221,6 +1288,46 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -PromptEvidenceCollection
+
+Controls prompt evidence collection for AI agent runtime protection.
+When collection is enabled and runtime protection is enabled in audit or block mode, Defender
+exposes prompt snippets exchanged between the user and the agent to support deeper analysis of
+agent-related alerts.
+These snippets include only the portions of user prompts or agent responses identified as suspicious
+and relevant to security classification.
+Set this parameter to `$true` to enable collection or `$false` to disable it.
+
+The default is changing from Off to On through an update to the November 2026 Microsoft Defender
+Antivirus platform release.
+Devices that haven't received that update still default to Off.
+Explicitly configured settings take precedence over this default.
+
+Managed device policy takes precedence over a local PowerShell preference and the tenant-wide
+prompt evidence collection preference.
+This setting doesn't enable runtime protection or change the audit or block mode of either
+inspection method.
+Content associated with activity that Defender blocks can still appear in the associated alert
+when this additional collection is disabled.
+
+> [!IMPORTANT]
+> Prompt evidence can contain sensitive customer conversations.
+> Review your organization's privacy and data-handling requirements before enabling collection.
+> For prerequisites and privacy details, see
+> [Configure prompt evidence collection](/defender-endpoint/configure-ai-agent-runtime-protection#configure-prompt-evidence-collection).
+
+```yaml
+Type: Boolean
+Parameter Sets: (All)
+Aliases: pec
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -ProxyBypass
 Specifies proxy bypasses.
 
@@ -2062,6 +2169,12 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
 
 ## NOTES
 
+AI agent runtime protection is a preview feature for supported Windows client devices.
+The AI agent and prompt evidence parameters require supported Microsoft Defender Antivirus platform
+and engine updates.
+For requirements and deployment guidance, see
+[Set up AI agent runtime protection](/defender-endpoint/configure-ai-agent-runtime-protection).
+
 ## RELATED LINKS
 
 [Add-MpPreference](./Add-MpPreference.md)