Is an e-mail from [email protected] legitimate?

Do not use the email’s Update Defender app button; update Microsoft Defender directly through Microsoft Store, because the visible From address alone cannot establish that the message is authentic.

Update Defender safely

1. Open Start, search for Microsoft Store, and open it.
2. Select Library.
3. Select Check for updates or locate Microsoft Defender and select Update if offered.
4. In Microsoft Store, select your profile picture → Store settings and ensure App updates is turned On. Store apps can then update automatically.^1^

If no Defender update is offered, do not take further action through the email.

Why Microsoft 365 did not update it directly

There are two different Defender products on Windows:

• Microsoft Defender app is the cross-device security app included with Microsoft 365 Personal or Family. On Windows, it is installed with Microsoft 365 apps or added through a subsequent update, but it must be opened and signed in to become active.^2^
• Microsoft Defender Antivirus is part of the built-in Windows Security application. Its security intelligence and engine updates are delivered through Windows Update, Automatic Updates, or WSUS—not through the Microsoft 365 application updater.^3^

Therefore, having Microsoft 365 does not mean every Defender component is updated by the Microsoft 365 desktop-app update mechanism. The Defender app can be Store-managed, while built-in antivirus protection is Windows Update-managed.

Assess and report the email

The address [Email] resembles a Microsoft address, but sender addresses and display names can be spoofed. Broken images are also not conclusive. Since the email was unexpected, keep avoiding its links and attachments. Microsoft recommends independently opening the relevant application or website and warns that an unexpected message can still be phishing even when it appears to come from a recognized source.^4^

In Outlook:

• Open the message.
• Select Report → Report phishing or Report message → Phishing.
• Delete it after reporting.

If the button was clicked but no information was entered, close the page and run a Windows Security scan. If Microsoft account credentials were entered, change the password immediately and review the account’s security activity.

References

1. Turn on automatic app updates | Microsoft Support
2. Installing Microsoft Defender | Microsoft Support
3. Description of Windows Defender definition updates | Microsoft Support
4. Protect yourself from phishing