Block file

If you identify a file that you want to prevent being used everywhere, you can select block file instead. This action will ensure the file is quarantined not only on this machine, but on all endpoints registered with the ATP service. Due to the potential widespread impact this could have across your environment, the ability needs to be enabled under the Preferences setup, in the Advanced Features.

This option works for both files and executable, to prevent unwanted applications being run.

The action is disabled for files signed by Microsoft to prevent negative impact on machines in your organization caused by the removal of files that might be related to the operating system.