How to Onboard Devices into Microsoft Defender for Endpoint: Step-by-Step Guide (2025)

In-Depth Guide: Onboarding Devices into Microsoft Defender for Endpoint

Connecting every endpoint to Microsoft Defender for Endpoint (MDE) is essential for modern threat protection. Once onboarded, devices stream security telemetry to the cloud service. That data powers advanced features like Endpoint Detection and Response (EDR), real-time threat blocking, automated investigation, and Threat & Vulnerability Management. This guide covers planning, setup, deployment methods, and verification to ensure a smooth rollout.

---

1. Why Onboarding Matters

Onboarding transforms unmanaged devices into protected endpoints that can:

• Report suspicious activity and security signals in real time
• Block malware and ransomware before they spread
• Automate threat investigation and remediation
• Provide visibility into software vulnerabilities and misconfigurations
• Integrate with Conditional Access to enforce device health

Without onboarding, devices remain invisible to MDE and cannot benefit from these capabilities. Planning a structured deployment ensures coverage while minimizing disruption.

---

2. Planning Your Deployment

2.1 Establish Service Integration

First, link Intune and Defender:

1. Sign in to the Intune Admin Center.
2. Navigate to Endpoint Security → Microsoft Defender for Endpoint.
3. Turn on Allow Microsoft Defender for Endpoint to enforce Endpoint security configurations.

This setting grants Defender the permissions to deploy protection policies and gather device telemetry through Intune.

2.2 Define Deployment Rings

Rolling out to all devices at once is risky. Instead:

• Evaluation ring: A few test machines in a lab environment
• Pilot ring: A representative mix of workstations and servers from different departments
• Broad rollout: All remaining devices after validation

Each ring lets you catch issues—such as script errors or network bandwidth spikes—before wider deployment.

---

3. Onboarding Methods

Choose the method that best fits each platform and management scenario:

• Intune (recommended for Windows 10/11): Easiest for cloud-managed PCs
• Group Policy: For domain-joined Windows devices not managed by Intune
• Configuration Manager (SCCM): For hybrid on-premises environments
• Local script or package: For macOS, Linux, or devices without centralized management

You can mix methods across rings—for example, use Intune for your pilot group and Group Policy for servers in the evaluation ring.

---

4. Onboarding Windows Devices via Intune

4.1 Prepare the Onboarding Package in Defender

1. Open the Microsoft Defender portal.
2. Go to Settings → Endpoints → Device Management → Onboarding.
3. Under Windows 10 and later, choose either:
   – Streamlined onboarding for automatic deployment via Intune
   – Standard onboarding if you need a script package
4. Select Intune as the deployment channel and download the ZIP package (for Standard onboarding).

4.2 Create the Intune Configuration Profile

1. In Intune Admin Center, select Devices → Configuration profiles → Create profile.
2. Set Platform to Windows 10 and later.
3. Choose Profile type: Endpoint protection.
4. Under Microsoft Defender Antivirus, expand Onboarding.
5. Upload the ZIP file or enter the package details for Streamlined onboarding.
6. Assign the profile to your evaluation ring device group.
7. Review and create the profile.

4.3 Deploy to Additional Rings

After validating with the evaluation group:

1. Add the pilot group to the profile’s assignments.
2. Monitor for errors, script failures, or policy conflicts.
3. Once pilot devices show healthy onboarding status, include the broad rollout group.

Use separate profiles if you need different settings per ring.

---

5. Onboarding via Group Policy and Configuration Manager

For devices not in Intune:

5.1 Group Policy

1. In the Defender portal, choose Standard onboarding and download the MSI or script.
2. Copy the package to a shared network location.
3. Open Group Policy Management on your domain controller.
4. Create or edit a GPO applied to target computers.
5. Under Computer Configuration → Policies → Software Settings, add the MSI as a startup installation.
6. Force a Group Policy update on client machines (gpupdate /force).

5.2 Configuration Manager

1. Download the onboarding script from the Defender portal.
2. Create a Package in Configuration Manager containing the script and any dependencies.
3. Distribute the Package to distribution points.
4. Deploy it to a test collection.
5. Verify successful script execution and onboarding status in the Defender portal.

---

6. Verifying Onboarding Success

6.1 Defender Portal Checks

• Under Device inventory, confirm that new devices appear.
• Check Onboarding status to see which method each device used.
• Look at Alert Dashboard to ensure no large influx of false positives.

6.2 Local Device Verification

On a Windows device, open PowerShell as administrator and run:

textGet-MpComputerStatus

Confirm AMServiceEnabled, AntivirusEnabled, and RealTimeProtectionEnabled are set to True.

For Linux and macOS, use the onboarding script’s built-in verification commands or check the service status as documented.

---

7. Monitoring, Reporting, and Maintenance

7.1 Ongoing Monitoring

• Use the Defender portal’s Threat and Vulnerability Management dashboard to track unpatched vulnerabilities.
• Review Device health reports in Intune to confirm continuous compliance.
• Set up email alerts for critical detections and sensor health failures.

7.2 Maintenance Tasks

• Update onboarding packages when Microsoft releases new versions.
• Periodically audit group memberships to ensure only the intended devices receive onboarding profiles.
• Re-validate onboarding on any device that re-images or undergoes major OS updates.

---

8. Troubleshooting Common Issues

• Onboarding script errors: Check log files on clients (usually in `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection“) for detailed error codes.
• Network bandwidth spikes: Stagger deployments across rings and limit concurrency in Configuration Manager.
• Policy conflicts: Ensure no overlapping GPO or Intune policies disable Defender services.
• Missing devices: Verify device group assignments and check that clients can reach the Defender service endpoints.

---

Onboarding devices into Microsoft Defender for Endpoint is the first critical step in building a robust security posture. By planning a phased rollout, choosing the right method for each platform, and verifying successful deployment, you ensure that your entire estate is protected, monitored, and ready to respond to threats in real time.