Introduction
Keep Windows Defender definitions up to date on managed devices without manual intervention. Add this action to any automation to trigger a definition update on demand — after onboarding new devices, before scheduled scans, or on a recurring schedule.
Windows Defender Update
From the automation pipeline in edit mode, click + Add action and select Windows Defender update from the Security category. The action panel opens with two sections: Action type (pre-set to Windows Defender update) and Step configuration.
Add Level to Windows Defender as an Exclusion
The Add Level to Windows Defender as an exclusion checkbox is enabled by default. When checked, Level adds itself to Windows Defender's exclusion list before running the update.
This prevents Windows Defender from flagging Level's processes mid-update, which can interrupt or abort the operation.
💡 TIP: Leave this on unless your organization has a policy against adding exclusions automatically. Disabling it on heavily locked-down endpoints may cause the update to fail silently.
Conditions
The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action. Expand the section to add conditions.
See Action Conditions for the full reference on condition types, operators, and values.
Additional Options
Expand Additional options for execution settings including action name, failure behavior, output variables, and retries.
See Actions Overview for the full reference on additional options available on every action.
FAQ
Does this action work on macOS or Linux? No. Windows Defender is Windows-only. This action is silently ignored on macOS and Linux devices. If your automation targets a mixed-OS group, only Windows devices will execute this step.
What happens if the device is offline when the action runs? The action queues and resumes once the device comes back online.
Why would I leave the exclusion checkbox enabled? Windows Defender can interrupt or abort its own update if it flags Level's agent processes. The exclusion prevents that conflict. It's safe to leave on in most environments.
Who can add or modify this action in an automation? Technicians with permission to edit automations in the relevant group. See Workspace → Permissions for access control configuration.
Will this action update Windows itself, or just Defender definitions? Defender definitions only. To install Windows OS updates, use the Install Windows Updates action.