Microsoft Defender privacy settings: what they control

Microsoft Defender privacy settings are the Defender-related switches in Windows Security that control how much security data your PC shares with Microsoft. The settings that matter most are cloud-delivered protection, automatic sample submission, and any diagnostic data or feedback controls that appear on your device; they affect what Defender sends when it checks suspicious files, uses cloud reputation data, or reports problems.

What Microsoft Defender privacy settings actually are

Inside Windows Security, “privacy settings” usually means the options tied to Defender’s protection features rather than the general privacy pages in Windows Settings. That boundary matters because some telemetry, account, and app-permission settings live elsewhere in Windows.

For example, if you turn on cloud-delivered protection, Defender can use Microsoft’s online reputation and threat intelligence when checking a file or app. That is a Defender protection setting with privacy impact, not the same thing as camera, location, or advertising controls in Windows Settings.

These settings do not all live in one exact place on every PC. On some versions you’ll find them directly under Virus & threat protection; on others, one or more related controls may be moved, renamed, or managed by policy.

The settings most people mean when they ask about privacy

The settings that usually matter first are:

• Cloud-delivered protection: lets Defender send some threat-related information to Microsoft’s cloud services so it can check suspicious items against current reputation and threat data.
• Automatic sample submission: lets Defender send suspicious files or file samples to Microsoft for analysis.
• Diagnostic data and feedback-related options: can allow Windows and Microsoft security components to send device and usage diagnostics that may help improve detection and reliability.

Say you open a downloaded file and Defender flags it as suspicious. With cloud protection and sample submission on, Defender has more room to compare that file against Microsoft’s current threat data and, if needed, submit a sample for review.

If your goal is more privacy, these are the first settings to check because they are the most directly tied to data leaving your PC for Microsoft’s security services. They are also the settings most likely to differ across Windows editions and Defender versions.

What each setting changes in practice

Cloud-delivered protection usually improves detection speed and helps with newer threats, but it also means your device consults Microsoft’s cloud services during scans and when evaluating suspicious items. If you turn it off, Defender relies more on local signatures and behavior checks, which may reduce how quickly it recognizes a new threat.

Automatic sample submission is the clearest privacy tradeoff. With it on, Defender can send suspicious files or related samples to Microsoft for analysis. With it off, fewer files leave your PC, but Microsoft has less to work with if a new or unusual threat appears.

Diagnostic data settings are broader and may not live only inside Defender’s own page. If those options are enabled, Microsoft can receive device diagnostics that help troubleshoot and improve protection. Turning them down or off can reduce data sharing, but it can also make problem reports and protection tuning less detailed. The exact effect depends on your Windows edition, account type, and device management policy.

What each setting actually sends can vary by version and configuration. In general, cloud-delivered protection sends threat-reputation requests and related security context, sample submission sends the suspicious file or sample itself when Defender asks for it, and diagnostic settings send device and usage data that Windows uses for reliability and security reporting. If you want the exact data categories for your PC, check the wording on your device rather than assuming every edition behaves the same way.

What to check before you change anything

The labels and switches can vary by Windows version, Defender version, and whether the PC is managed by work or school policy. Some options may be hidden, renamed, or locked, and some devices use Microsoft account or organization settings that override what you can change locally.

Before you change anything, confirm the exact wording on your PC:

• Open Windows Security and check the current labels under Virus & threat protection and any related cloud or privacy options.
• See whether the toggle is available or greyed out.
• Check whether the device is signed in with a personal Microsoft account or managed by an organization.
• Compare your screen with the Windows build and Defender version on your PC, because the layout can differ.

If you are following a screenshot or guide, make sure it matches your exact Windows and Defender version before you copy the steps. A toggle with the same name can behave differently when policy controls it, and some systems expose the privacy-related switches in a different place entirely.

The safest privacy-first way to review them

Start in Windows Security, then review the Defender settings one by one instead of turning everything off at once. If your goal is more privacy, the first items to inspect are cloud-delivered protection and automatic sample submission, because those are the settings most directly tied to sending security-related data to Microsoft.

A practical sequence is:

1. Open Windows Security.
2. Go to Virus & threat protection.
3. Open Manage settings under the protection section.
4. Check the cloud protection and sample submission switches.
5. Review any diagnostic or feedback controls that appear on your device.
6. Leave the settings that match your privacy and security preference unchanged.

If you are unsure about a toggle, stop there and compare its exact label with your Windows version’s help or admin policy. The safest choice is the one that matches both your privacy preference and the protection level you want to keep.