AMRunningmode -Active or Passive

Sunny2024 Hi, using additional properties from Get-MpComputerStatus and checking the status of services, signature updates and security settings, you can effectively distinguish between devices that are properly in Passive Mode with EDR Block Mode enabled and those that are not supported or not updated.

You can use this:

if ($mpStatus.AMRunningMode -eq 'EDR Block Mode' -and $avSigVersion -and ((Get-Date) - $avSigLastUpdated).Days -lt 7 -and $mpStatus.RealTimeProtectionEnabled -and $mpStatus.AntivirusEnabled) {
# Device is in Passive Mode and healthy
} else {
# Device is unsupported, not updated, or unhealthy
}