The best first step is to enable troubleshooting mode on the device from the Microsoft Defender portal.
Enabling Troubleshooting Mode allows a security administrator to temporarily bypass or modify security settings directly on a targeted endpoint. This lets you test whether security features like Attack Surface Reduction (ASR) or real-time antivirus protection are causing an application or plugin to break. It keeps administration low because the mode automatically terminates after 4 hours, reverting the device back to its original centralized management state without needing a policy overhaul.
Incorrect:
[Not A]
Selective Isolation Mode: This feature isolates a compromised device from the network to contain threats while allowing specific tools or applications to communicate. It is used for incident response containment, not for local policy debugging or troubleshooting false-positive application blocks.
[Not C]
Using Set-MpPreference -DisableTamperProtection $true: Under normal operation, Microsoft Defender's Tamper Protection actively prevents local administrators or scripts from modifying endpoint security preferences. Running this command on a standard onboarded device will be blocked by Tamper Protection unless Troubleshooting Mode has already been initiated from the cloud portal.
[Not D]
Using Set-MpPreference to modify ASR IDs manually: Attempting to alter specific ASR rules on the machine locally using PowerShell will also fail or be overridden by central policies and Tamper Protection. Modifying individual policies directly for a single test introduces higher administrative overhead compared to the 1-click cloud troubleshooting session.
Reference:
https://www.indefent.com/troubleshooting-performance-bottlenecks-in-microsoft-defender-for-endpoint/