> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files/microsoft-defender-for-endpoint-delete-malicious-files.md).

# Microsoft Defender for Endpoint: Delete Malicious Files

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## How It Works <a href="#h_01jj4s9s9dzdhs11pn5p8zrckq" id="h_01jj4s9s9dzdhs11pn5p8zrckq"></a>

If our SOC identifies a malicious file that must be deleted due to malware or suspicious hash, Workbench completes the action automatically unless the machine is offline or the file is specifically designated as a "Never Delete" asset (these files must be added as context and then configured in Workbench; see [Step 3](#h_01jj4s9s9e687wb2rzkmxws3kt)).

## Scope and Limitations <a href="#h_01jj4s9s9dh3brkk5951ca9f3v" id="h_01jj4s9s9dh3brkk5951ca9f3v"></a>

When choosing to enable this auto remediation, remember the following:

* If your machine is offline at the time the auto remediation is triggered, the action will be assigned to you to perform manually instead.
* Due to limitations with the Microsoft Defender for Endpoint API, there is no ability to undo a delete file action performed via the auto remediation.

## Prerequisites <a href="#h_01jj4s9s9djsm4c0hdsj34ted9" id="h_01jj4s9s9djsm4c0hdsj34ted9"></a>

1. You must have admin access in Azure to add the API permissions to the enterprise application.&#x20;
2. You must have admin access in Microsoft Defender to enable live response.
3. You must be using one of these [supported operating systems](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response#minimum-requirements).
4. You must have admin access in Workbench, as auto remediations are enabled at the organization level.

## Step 1: Grant Necessary Permissions in Azure <a href="#h_01jj4s9s9exrthh7rkmd8t6exa" id="h_01jj4s9s9exrthh7rkmd8t6exa"></a>

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required.&#x20;

1. [Log in to Azure.](https://portal.azure.com/)
2. Search for and select **App Registrations**.
3. On the App registrations page, select the **All applications** tab.
4. Locate and select the Microsoft Defender for Endpoint application that you configured [during your initial onboarding](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-endpoint-setup-for-workbench.md).
5. In the left menu, select **Manage > API Permissions**.
6. Select **Add a permission**.
7. Search for "WindowsDefenderATP".
8. Select the following two **Application** permissions for WindowsDefenderATP:
   * Machine.LiveResponse
   * Library.Manage
9. Select **Update permissions**.
10. Check the Status column for your new permissions, and make sure to **grant admin consent** if you see a "Not granted" message.

## Step 2: Grant Necessary Permissions in Microsoft Defender <a href="#h_01jj4s9s9e61m5f0byhynt23yp" id="h_01jj4s9s9e61m5f0byhynt23yp"></a>

These permissions allow us to run a small script on the machine that uses an ID or process path to kill the process. The script is in Powershell for Windows and Bash for Linux and Mac.

1. Log in to the [Microsoft Defender portal](https://security.microsoft.com/).
2. Go to **Settings > Endpoints > Advanced Features**.&#x20;
3. Turn on the following three settings:
   * Live Response
   * Live Response for Servers
   * Live Response unsigned script execution
4. Select **Save preferences**.

## Step 3: Update Your Context <a href="#h_01jj4s9s9e687wb2rzkmxws3kt" id="h_01jj4s9s9e687wb2rzkmxws3kt"></a>

**If you do not want to specify any processes for a "do not delete" list, skip to** [**Step 4**](#h_01jj4s9s9eve79yahw27rqzepf)**.**

Working with your Customer Success Manager, add any files that should be on the "do not delete" list as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment. You will then be able to select those files as "Never delete" assets when you enable the auto remediation in Workbench.

{% hint style="info" %}
If our SOC identifies a file that must be deleted, any file added as "Never delete" assets are assigned to you as actions rather than being killed automatically.
{% endhint %}

## Step 4: Return to the Main Setup Guide <a href="#h_01jj4s9s9eve79yahw27rqzepf" id="h_01jj4s9s9eve79yahw27rqzepf"></a>

Your Microsoft Defender for Endpoint device is now ready for the Delete Malicious Files auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files/microsoft-defender-for-endpoint-delete-malicious-files.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.