Defender for Endpoint: Integrate & Onboard

What is Defender for Endpoint?

Integrating Intune with Defender for Endpoint

Step 1: Enable the connection

1. Microsoft Defender portal (security.microsoft.com) → Settings → Endpoints → Advanced features
2. Enable Microsoft Intune connection → Save
3. Intune admin center → Endpoint security → Microsoft Defender for Endpoint
4. Enable Connect to Microsoft Defender for Endpoint → Save

What integration enables

Feature	How It Works
Device risk score in compliance	Intune compliance policies can check MDE’s machine risk level (Clear, Low, Medium, High)
Conditional access enforcement	High-risk devices automatically blocked from M365 resources
Configuration delivery	MDE security settings can be delivered via Intune
Unified device view	See MDE alerts alongside Intune management data
Onboarding via Intune	Deploy MDE onboarding package through Intune configuration profiles

Step 2: Create compliance policies using device risk

Once connected, add device risk to compliance policies:

Setting	Value	Effect
Require the device to be at or under the machine risk score	Medium	Devices with “High” risk are marked non-compliant
Combined with CA policy	Require compliant device	High-risk devices are blocked from Exchange, SharePoint, Teams

Chen Wei at Meridian Bank sets the threshold to “Low” — even medium-risk devices are blocked from banking applications. The bank’s zero-tolerance security stance means any device flagged by Defender loses access instantly.

Onboarding devices

Windows onboarding via Intune

1. Intune admin center → Endpoint security → Endpoint detection and response → Create policy
2. Select platform: Windows 10, Windows 11, and Windows Server
3. Profile: Endpoint detection and response
4. The onboarding configuration package is delivered via Intune’s config profile mechanism
5. Assign to device groups

Multi-platform onboarding

Platform	Onboarding Method
Windows	Intune EDR policy (recommended), GPO, ConfigMgr, script
macOS	Intune config profile, manual package (.pkg), JAMF
iOS/iPadOS	Defender for Endpoint app from App Store + app config
Android	Defender for Endpoint app from Managed Google Play + app config
Linux	Script-based onboarding, Ansible/Puppet

💡 Exam tip: Defender for Endpoint licences

MDE comes in two plans:

• Plan 1 — included in Microsoft 365 E3. Core protection: ASR, next-gen AV, device control. No EDR.
• Plan 2 — included in Microsoft 365 E5. Full protection: everything in P1 + EDR, automated investigation, threat analytics, advanced hunting.

The exam may test: “What licence is needed for endpoint detection and response (EDR)?” → MDE Plan 2 or M365 E5.

For Intune integration (risk-based compliance), you need MDE Plan 2 — Plan 1 doesn’t provide the device risk score used in compliance policies.

ℹ️ Deep dive: onboarding status verification

After onboarding, verify devices are reporting to MDE:

1. Microsoft Defender portal → Device inventory → check the device appears
2. Intune admin center → Devices → select device → check “Defender for Endpoint status”
3. On the device itself: run Get-MpComputerStatus in PowerShell → check AMRunningMode is “Normal”

Common onboarding issues:

• Device doesn’t appear in Defender portal — wait 24 hours (initial sync can be slow)
• Onboarding fails — check prerequisites: .NET 4.5+, Windows telemetry enabled, proxy/firewall allows MDE URLs
• Risk score not showing in Intune — verify the Intune-MDE connection is enabled in both portals

🎬 Video walkthrough

🎬 Video coming soon

Defender for Endpoint: Integrate & Onboard — MD-102 Module 25

Defender for Endpoint: Integrate & Onboard — MD-102 Module 25

~11 min

Flashcards

Question

What does integrating Intune with Defender for Endpoint enable?

Click or press Enter to reveal answer

Answer

Device risk scores in Intune compliance policies, conditional access enforcement based on threat level, onboarding delivery via Intune, and a unified device view combining management + security data.

Click to flip back

Question

How do you onboard Windows devices to Defender for Endpoint via Intune?

Click or press Enter to reveal answer

Answer

Create an Endpoint Detection and Response (EDR) policy in Intune (Endpoint security → EDR), configure the onboarding package, and assign to device groups. The onboarding config is delivered via Intune's management channel.

Click to flip back

Question

What MDE licence is needed for risk-based compliance in Intune?

Click or press Enter to reveal answer

Answer

MDE Plan 2 (included in M365 E5). Plan 1 (included in M365 E3) provides core protection but doesn't include EDR or the device risk score that Intune compliance policies use.

Click to flip back

Knowledge Check

Knowledge Check

Chen Wei integrates Intune with Defender for Endpoint at Meridian Bank. He creates a compliance policy requiring devices to have a risk score of 'Low' or below. A banker's laptop is flagged as 'High' risk by Defender after suspicious PowerShell activity. What happens?

ANothing — compliance policies can't read Defender risk scoresBThe device is marked non-compliant, and if a CA policy requires compliance, it's blocked from M365 resourcesCDefender automatically quarantines the device from the networkDThe user receives an email warning but retains full access

Check Answer

Knowledge Check

Sam needs to onboard macOS devices to Defender for Endpoint. What's the recommended approach?

AUse Intune's EDR policy — it works for macOS just like WindowsBDeploy the Defender for Endpoint package via Intune configuration profile for macOSCInstall Defender for Endpoint manually on each Mac from the App StoreDmacOS devices can't be onboarded to Defender for Endpoint

Check Answer

---

Next up: Plan and Manage Windows Updates — update rings, feature update policies, and staged rollout strategies.