Question

Your organization has enabled the ASR rule "Block Office applications from creating child processes" in Block mode across all Windows devices. A finance team uses a legacy macro-enabled Excel workbook that launches a signed helper executable, and this workbook is now being blocked. You must allow this specific workflow while keeping the ASR rule in Block mode for all other processes and users, using the least-permissive configuration. What should you do?

Accepted Answer

Add a per-rule ASR exclusion specifying the file path of the signed helper executable so it is exempt from that ASR rule.

Answer

Set the ASR rule to Audit mode for the device group containing the finance team's computers.

Answer

Disable the ASR rule entirely and rely on Microsoft Defender Antivirus real-time protection instead.

Answer

Create a Defender for Endpoint web content filtering policy to allow the executable.