Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Microsoft Intune has two separate controls for sending files to Microsoft for analysis: Sample Sharing in Defender for Endpoint endpoint detection and response (EDR) policy, and Submit Samples Consent in Microsoft Defender Antivirus policy. Choose the right one for the product and policy you manage. EDR Sample Sharing can be set to All or None; Defender Antivirus lets you submit safe samples or all samples automatically. Both choices have privacy implications, and disabling EDR Sample Sharing can reduce detection capabilities.
Which Microsoft Defender sample-sharing setting do you need?
Start with the product and policy area, not just the phrase “sample sharing.” Microsoft uses similar language for distinct settings with different scopes and options.
As an Amazon Associate I earn from qualifying purchases.
| Control | Where it applies | What it controls | Documented choices |
|---|---|---|---|
| Sample Sharing | Microsoft Defender for Endpoint EDR configuration in Intune | Sharing suspicious file samples with Microsoft for analysis | All enables automatic sample sharing; None disables it |
| Submit Samples Consent | Microsoft Defender Antivirus policy in Intune | Automatic submission of safe samples or all samples | Send safe samples automatically or Send all samples automatically |
The first control is an EDR setting; the second belongs to Defender Antivirus. They are not interchangeable, and configuring one does not mean you have configured the other.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do I configure EDR Sample Sharing?
In an Intune Defender for Endpoint onboarding or EDR configuration policy, the setting is described as: “Sample Sharing: Configure whether devices share suspicious file samples with Microsoft for analysis.” Microsoft documents All to enable automatic sharing and None to turn it off. Microsoft’s Intune onboarding guidance cautions that disabling Sample Sharing can reduce detection capabilities. Its EDR settings reference says the setting sends a file to Microsoft for deep analysis and notes that organizations can disable it on devices considered too sensitive.
#1 Best Overall
- In the Intune admin center, open the Defender for Endpoint onboarding or EDR configuration policy you use for the target Windows devices.
- Find Sample Sharing in the policy settings.
- Choose All to enable automatic sample sharing, or None to disable it.
- Assign the policy to the intended device group, then verify that the targeted devices receive the policy.
Policy names and available settings can depend on the policy workflow and platform. Confirm that you are editing Defender for Endpoint EDR policy and targeting the intended devices before deployment.
How do I configure Defender Antivirus sample submission?
For Defender Antivirus, Microsoft documents an Intune endpoint security Antivirus policy for Windows using the Microsoft Defender Antivirus profile. In this policy area, cloud protection and Submit Samples Consent are related but separate settings.
Rank #2
- In the Intune admin center, create or edit an endpoint security Antivirus policy for Windows with the Microsoft Defender Antivirus profile.
- Set Allow cloud protection to Allowed.
- Set Submit Samples Consent to either Send safe samples automatically or Send all samples automatically, according to your organization’s data-handling rules.
- Assign the policy to the intended device group and confirm deployment.
Microsoft identifies safe-sample submission as the default choice in this documented policy flow. For managed devices, use the supported Intune policy workflow; PowerShell can help validate the resulting Defender Antivirus preferences.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11PowerShell values for validation
Microsoft documents these PowerShell equivalents for Defender Antivirus configuration:
- Enable cloud protection reporting:
Set-MpPreference -MAPSReporting Advanced - Submit safe samples automatically:
Set-MpPreference -SubmitSamplesConsent SendSafeSamples - Submit all samples automatically:
Set-MpPreference -SubmitSamplesConsent SendAllSamples
To inspect the current preferences, run Get-MpPreference and review MAPSReporting, SubmitSamplesConsent, and CloudBlockLevel. Microsoft documents MAPSReporting value 2 as Advanced reporting, and SubmitSamplesConsent values 1 and 3 as automatic safe-sample and all-sample submission, respectively. Microsoft’s cloud protection configuration guide provides the policy and PowerShell context.
What do safe samples and all samples mean for privacy?
Submitting a sample means a file is sent to Microsoft for analysis. In Defender Antivirus, the safe-samples option narrows automatic submissions. Microsoft describes safe samples as files that typically do not contain personally identifiable information, with examples including .bat, .scr, .dll, and .exe. “Typically” is not a guarantee that a file can never contain sensitive information; review the choice against your organization’s data-handling requirements. The applicable Microsoft documentation also describes an always-prompt choice in relevant policy contexts. Microsoft’s Defender Antivirus Intune configuration guidance covers these consent options.
For EDR Sample Sharing, Microsoft explicitly describes disabling sharing on specific devices that are considered too sensitive. A scoped policy lets administrators make that decision for particular device groups rather than applying one setting indiscriminately. The trade-off is that Microsoft warns disabling EDR Sample Sharing can reduce detection capabilities; its documentation does not quantify the size of that effect.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Keep cloud protection separate from sample-submission consent
Cloud protection is not the same setting as consent to submit samples. Microsoft recommends keeping cloud protection enabled because some Defender features rely on it. Automatic sample submission relies on cloud protection, although it can also be configured as a standalone setting. Block at first sight, for example, uses the cloud protection backend to assess suspicious files.
Cloud protection level is another distinct configuration. Microsoft’s guidance says to enable cloud protection before setting the level; choices include Default, High, High plus, and Zero tolerance. Higher levels can affect false-positive risk or performance, so do not treat them as sample-submission consent options. For baseline settings, see Microsoft’s Intune security baseline reference for Defender for Endpoint.
Quick Recap
Before deploying the policy
- Confirm whether your goal concerns Defender for Endpoint EDR Sample Sharing or Defender Antivirus Submit Samples Consent.
- Check the policy type, Windows platform, profile, and assigned device groups.
- Decide whether your privacy rules permit automatic submission of safe samples, all samples, or neither for the relevant devices.
- For EDR devices where sample sensitivity differs, evaluate a separate scoped policy rather than assuming one organization-wide choice is appropriate.
- Keep cloud protection configuration distinct from sample-sharing consent, and validate Defender Antivirus preferences with
Get-MpPreferencewhen appropriate.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
