Defender for Endpoint: Integrate & Onboard
Microsoft Defender for Endpoint is the enterprise threat protection platform. Learn how to integrate it with Intune and onboard devices for advanced detection, investigation, and response.
What is Defender for Endpoint?
If antivirus is a security camera, Defender for Endpoint is an entire security operations centre.
A security camera records what happens. A security operations centre (SOC) watches the cameras, spots suspicious behaviour, investigates incidents, and sends the response team. Defender for Endpoint does the same for your devices: it detects threats, investigates what happened, and helps you respond — all from a single dashboard.
When integrated with Intune, they share information: Intune tells Defender which devices are managed, and Defender tells Intune which devices have threats — enabling automatic compliance enforcement.
Integrating Intune with Defender for Endpoint
Step 1: Enable the connection
- Microsoft Defender portal (security.microsoft.com) → Settings → Endpoints → Advanced features
- Enable Microsoft Intune connection → Save
- Intune admin center → Endpoint security → Microsoft Defender for Endpoint
- Enable Connect to Microsoft Defender for Endpoint → Save
What integration enables
| Feature | How It Works |
|---|---|
| Device risk score in compliance | Intune compliance policies can check MDE’s machine risk level (Clear, Low, Medium, High) |
| Conditional access enforcement | High-risk devices automatically blocked from M365 resources |
| Configuration delivery | MDE security settings can be delivered via Intune |
| Unified device view | See MDE alerts alongside Intune management data |
| Onboarding via Intune | Deploy MDE onboarding package through Intune configuration profiles |
Step 2: Create compliance policies using device risk
Once connected, add device risk to compliance policies:
| Setting | Value | Effect |
|---|---|---|
| Require the device to be at or under the machine risk score | Medium | Devices with “High” risk are marked non-compliant |
| Combined with CA policy | Require compliant device | High-risk devices are blocked from Exchange, SharePoint, Teams |
Chen Wei at Meridian Bank sets the threshold to “Low” — even medium-risk devices are blocked from banking applications. The bank’s zero-tolerance security stance means any device flagged by Defender loses access instantly.
Onboarding devices
Windows onboarding via Intune
- Intune admin center → Endpoint security → Endpoint detection and response → Create policy
- Select platform: Windows 10, Windows 11, and Windows Server
- Profile: Endpoint detection and response
- The onboarding configuration package is delivered via Intune’s config profile mechanism
- Assign to device groups
Multi-platform onboarding
| Platform | Onboarding Method |
|---|---|
| Windows | Intune EDR policy (recommended), GPO, ConfigMgr, script |
| macOS | Intune config profile, manual package (.pkg), JAMF |
| iOS/iPadOS | Defender for Endpoint app from App Store + app config |
| Android | Defender for Endpoint app from Managed Google Play + app config |
| Linux | Script-based onboarding, Ansible/Puppet |
Exam tip: Defender for Endpoint licences
MDE comes in two plans:
- Plan 1 — included in Microsoft 365 E3. Core protection: ASR, next-gen AV, device control. No EDR.
- Plan 2 — included in Microsoft 365 E5. Full protection: everything in P1 + EDR, automated investigation, threat analytics, advanced hunting.
The exam may test: “What licence is needed for endpoint detection and response (EDR)?” → MDE Plan 2 or M365 E5.
For Intune integration (risk-based compliance), you need MDE Plan 2 — Plan 1 doesn’t provide the device risk score used in compliance policies.
Deep dive: onboarding status verification
After onboarding, verify devices are reporting to MDE:
- Microsoft Defender portal → Device inventory → check the device appears
- Intune admin center → Devices → select device → check “Defender for Endpoint status”
- On the device itself: run
Get-MpComputerStatusin PowerShell → checkAMRunningModeis “Normal”
Common onboarding issues:
- Device doesn’t appear in Defender portal — wait 24 hours (initial sync can be slow)
- Onboarding fails — check prerequisites: .NET 4.5+, Windows telemetry enabled, proxy/firewall allows MDE URLs
- Risk score not showing in Intune — verify the Intune-MDE connection is enabled in both portals
🎬 Video walkthrough
Flashcards
Knowledge Check
Chen Wei integrates Intune with Defender for Endpoint at Meridian Bank. He creates a compliance policy requiring devices to have a risk score of 'Low' or below. A banker's laptop is flagged as 'High' risk by Defender after suspicious PowerShell activity. What happens?
Sam needs to onboard macOS devices to Defender for Endpoint. What's the recommended approach?
Next up: Plan and Manage Windows Updates — update rings, feature update policies, and staged rollout strategies.