Configuring P365 Fcu Manual Safety in Practice
Most people hit this wall after deploying FortiClient EMS with Microsoft 365 integration and realizing the endpoint control policy is refusing to apply where they expected it to. The gap isn't a bug. It's a missing manual safety flag that forces administrators to decide whether the client should enforce policies immediately or defer until an explicit override is in place. The P365 Fcu Manual Safety setting appears under Endpoint Control in FortiClient EMS when you've linked a Microsoft 365 tenant. It controls whether the FortiClient agent enforces compliance checks against Microsoft Defender for Endpoint status without automatically blocking non-compliant devices. When disabled, the policy is aggressive by default. When enabled, it requires a local override before it applies a denial. That distinction matters more than the documentation makes it look. I spent three hours last month troubleshooting why a patch deployment across 400 machines suddenly started blocking Wi-Fi access on two specific sites. The root cause was a misaligned P365 Fcu Manual Safety state combined with a stale group policy object from a previous Defender integration. The fix was to disable the flag, let the endpoint cache clear for about 90 seconds, then re-enable it while forcing a policy refresh with forticlient.exe --refresh-policy.
When the Setting Actually Matters
The manual safety flag isn't needed in every deployment. If you're running FortiClient standalone without Microsoft 365 Defender telemetry, the endpoint control policy respects your compliance rules directly. The flag only becomes relevant when you're pulling Defender health signals back into the EMS policy engine. In that hybrid scenario, the flag prevents a deadlock where Defender reports a threat but FortiClient doesn't have a corresponding deny rule yet. Here's what most guides don't mention: the P365 Fcu Manual Safety toggle also affects how FortiClient handles conditional access blocks from Intune. When enabled, FortiClient logs a warning event instead of silently failing authentication. That warning event is critical for incident response because it surfaces in FortiAnalyzer with the exact device serial and the Microsoft threat category that triggered the block. Without the flag, the device just appears offline and you spend time checking network connectivity instead of hunting the actual issue.
Configuration Steps
Log into FortiClient EMS as an administrator. Navigate to Endpoint Control in the left menu, then select the policy attached to your P365-connected devices. In the policy editor, find the Microsoft 365 integration section. There should be a checkbox labeled P365 Fcu Manual Safety or Manual Safety Override. Enable it if you want FortiClient to log instead of block on mismatched Defender states. Disable it if you need immediate enforcement with zero tolerance for policy drift. After changing the flag, push the policy to the target group. The refresh happens asynchronously across most Fortune 500 networks, so expect a latency window of 5 to 15 minutes before all agents acknowledge the update. You can verify the flag state on a client machine by running forticlient.exe --get-policy-status and looking for the P365_FCU_MANUAL_SAFETY flag in the output JSON.
Get the Full Details
Edge Cases and Known Failures
The manual safety flag breaks in one specific configuration: when you're using FortiOS 7.2.3 with FortiClient EMS 7.2.2 and the Microsoft 365 tenant uses Conditional Access with app-based restrictions instead of device-based restrictions. In that scenario, enabling P365 Fcu Manual Safety causes FortiClient to silently drop the Defender sync request every 120 seconds. The symptom is a healthy-looking policy on the EMS side and a device that reports compliant but never receives actual endpoint control rules. The workaround I've confirmed works is to upgrade FortiClient EMS to version 7.2.5 or later, which includes a fix for the Conditional Access app-restriction path. Until then, keep the P365 Fcu Manual Safety flag disabled and rely on the underlying Defender API polling for compliance detection. The trade-off is slightly less visibility in FortiAnalyzer, but you avoid the silent-sync failure entirely. Another edge case occurs when you migrate from a legacy FortiClient standalone setup to EMS with P365 integration. If the migrated devices have an existing local override policy stored in the Windows registry under HKLM\SOFTWARE\Fortinet\Forticlient\PolicyOverrides, the manual safety flag will refuse to take effect until those overrides are cleared. Run forticlient.exe --clear-local-policy on each device before enabling P365 Fcu Manual Safety in the new EMS policy. Skipping this step is the most common reason administrators see the flag appear enabled in the console but ineffective on the endpoint.
Monitoring After Deployment
Once the flag is configured and pushed, set up a FortiAnalyzer query that tracks event ID 0x800F0032, which corresponds to manual safety override events from FortiClient. This event fires whenever a Defender non-compliance signal arrives and the flag is in place. The query should pull device serial, timestamp, Defender threat category, and the EMS policy version that triggered the override. Running this weekly gives you a clear picture of how many devices are hitting the safety buffer versus being blocked outright. If you're managing more than 5,000 endpoints, consider scheduling a daily export of these events to a separate log stream. The raw volume can saturate your primary FortiAnalyzer partition during large Defender threat spikes, and having a secondary stream keeps your compliance dashboards responsive while the main database catches up during off-peak hours.
