Defender for Endpoint: Onboard and Protect

Bringing devices into the fight

Plan 1 vs Plan 2 — what you actually get

Marcus is evaluating licensing for Oakwood Financial. The distinction between Plan 1 and Plan 2 appears on the exam regularly.

Defender for Endpoint Plan 1 vs Plan 2

Feature	Plan 1	Plan 2
Next-generation protection (antimalware)	true	true
Attack surface reduction rules	true	true
Device-based Conditional Access	true	true
Controlled folder access	true	true
Web content filtering	true	true
Endpoint Detection and Response (EDR)	false	true
Automated investigation and remediation	false	true
Threat and Vulnerability Management	false	true
Advanced hunting (KQL queries)	false	true
Sandbox detonation (deep analysis)	false	true
Endpoint Attack Notifications	false	true
Included with	Microsoft 365 E3/A3	Microsoft 365 E5/A5 Security

💡 Exam tip: Plan 1 vs Plan 2 boundary

The exam tests whether you know which capabilities require Plan 2. The key dividing line: Plan 1 is prevention-focused (ASR, antimalware, web filtering). Plan 2 adds detection and response (EDR, automated investigation, vulnerability management, advanced hunting). If a question describes investigating an alert timeline or running a KQL hunt query — that’s Plan 2 territory.

Onboarding methods — matching method to environment

Marcus needs to onboard 800 devices at Oakwood Financial. Choosing the right onboarding method is critical — the wrong approach means manual effort multiplied across every device.

Windows devices

Method	Best for	How it works
Local script	Testing, POC, small batches under 10	Download the onboarding script from Defender portal, run locally on each device
Intune (Microsoft Endpoint Manager)	Cloud-managed devices at any scale	Deploy MDE configuration profile via Intune — fully automated, zero touch
Group Policy	Domain-joined devices in on-premises AD	Deploy onboarding script via GPO — targets OUs or security groups
Configuration Manager (MECM/SCCM)	Large enterprises with existing MECM infrastructure	Use the MDE onboarding task sequence or client settings
VDI onboarding script	Non-persistent virtual desktops (AVD, Citrix)	Modified script designed for session-based environments that re-image frequently

Cross-platform support

MDE isn’t Windows-only. The exam expects you to know supported platforms and their onboarding mechanisms.

Platform	Onboarding method	Key limitation
macOS	Intune, JAMF, manual script	Requires system extensions approval and full disk access
Linux	Package manager (apt/yum), Puppet, Ansible	Supported distros: RHEL, Ubuntu, Debian, SLES, Oracle Linux, Amazon Linux, Fedora, Rocky, Alma
iOS	Intune via managed app (Microsoft Defender app)	Supervised mode recommended (enables web protection without local VPN)
Android	Intune via managed app (Microsoft Defender app)	Requires Android 10.0 or later

ℹ️ Marcus's onboarding decision at Oakwood Financial

Marcus has 800 devices: 650 Windows laptops (Intune-managed), 80 macOS devices (JAMF-managed), 50 iPads (Intune-managed), and 20 Linux servers (Ansible-managed). His onboarding plan:

• Windows laptops — Intune endpoint detection and response policy (zero touch, auto-deploys)
• macOS — JAMF integration with MDE (handles system extension approval)
• iPads — Intune app deployment (push Microsoft Defender app as required)
• Linux servers — Ansible playbook using the MDE package repository

No local scripts needed. Every method is automated and reportable. Marcus can track onboarding status from the Defender portal’s device inventory.

Endpoint security settings — the protection baseline

Once devices are onboarded, you configure four core protection capabilities.

Attack Surface Reduction (ASR) rules

ASR rules block specific behaviors that malware commonly exploits. They don’t detect threats — they prevent attack techniques from working in the first place.

Key ASR rules for the exam:

Rule	What it blocks
Block executable content from email and webmail	Stops executables, scripts, and Office macros downloaded via email from running
Block Office applications from creating child processes	Prevents Word/Excel from spawning PowerShell or cmd.exe
Block credential stealing from LSASS	Prevents processes from reading credentials from the LSASS memory
Block untrusted and unsigned processes from USB	Prevents execution of unsigned executables from removable media
Use advanced protection against ransomware	Applies heuristic checks to block files that resemble ransomware behavior

ASR rules can run in audit mode (log only) or block mode (enforce). Always deploy in audit mode first to identify false positives.

Controlled folder access

Protects designated folders (Documents, Desktop, Pictures, and any custom folders you add) from unauthorized changes. Only trusted applications can modify files in protected folders. This is the primary anti-ransomware capability — ransomware that tries to encrypt files in protected folders gets blocked.

Exploit protection

System-level and per-application mitigations against memory corruption exploits. Replaces the legacy EMET tool. Configurable via Intune, GPO, or PowerShell XML export/import. Key mitigations include DEP, ASLR, and Control Flow Guard.

Network protection

Extends SmartScreen protection beyond the browser to all HTTP/HTTPS traffic on the device. Blocks connections to known-malicious domains and IP addresses. Works at the network layer — catches threats that web filtering alone would miss.

Question

What is the primary anti-ransomware feature in Defender for Endpoint?

Click or press Enter to reveal answer

Answer

Controlled folder access. It prevents unauthorized applications from modifying files in protected folders (Documents, Desktop, Pictures, and any custom paths). When ransomware attempts to encrypt these files, the modification is blocked. The feature must be enabled — it's off by default.

Click to flip back

Question

What mode should you use when first deploying ASR rules?

Click or press Enter to reveal answer

Answer

Audit mode. This logs what the rule WOULD have blocked without actually enforcing it. Review the audit logs to identify false positives (legitimate applications that trigger the rule), then add exclusions before switching to Block mode. Deploying directly in Block mode risks breaking line-of-business applications.

Click to flip back

Question

How does Intune-based onboarding work for Windows devices?

Click or press Enter to reveal answer

Answer

Create an endpoint detection and response configuration profile in Intune. This profile contains the onboarding package from your MDE tenant. Assign the profile to a device group. Intune pushes the configuration to targeted devices automatically — no user interaction or local scripts needed. Onboarding status is visible in both Intune and the Defender portal.

Click to flip back

Question

What is the difference between network protection and web content filtering?

Click or press Enter to reveal answer

Answer

Web content filtering blocks access to websites based on category (gambling, adult content, etc.) at the URL level. Network protection blocks connections to known-malicious domains and IPs at the network layer — it extends SmartScreen beyond the browser to catch malicious connections from any process on the device, not just browser traffic.

Click to flip back

Device groups and role-based access

In the Defender portal, device groups let you segment your fleet for targeted policies and assign investigation responsibilities to specific security teams.

Marcus creates device groups at Oakwood Financial:

Device group	Criteria	Assigned team
Executive devices	Device tag: “VIP”	Tier 2 analysts
Finance workstations	AD domain group membership	Tier 1 analysts, Finance IT
BYOD mobile	OS: iOS, Android	Mobile security team
Servers	OS: Windows Server, Linux	Infrastructure security

Device groups control:

• Automated remediation level — which device groups allow full auto-remediation vs requiring analyst approval
• Role-based access — security analysts only see devices in groups assigned to their role
• Policy targeting — ASR rules, antivirus settings, and other configurations can target specific groups

💡 Exam tip: Automated remediation levels

Each device group has a remediation level: No automated response, Semi (require approval for core folders), or Full (auto-remediate everything). The exam tests whether you understand that newly onboarded devices fall into the default device group — and whatever remediation level is set there applies until you move devices to a custom group. Configure your default group conservatively.

Question

What happens to newly onboarded devices before you assign them to a custom device group?

Click or press Enter to reveal answer

Answer

They land in the default device group. The automated remediation level set on this default group applies to all new devices until an admin moves them to a custom group. Best practice: set the default group to Semi-automated remediation to avoid unintended automatic actions on unclassified devices.

Click to flip back

Knowledge check

Knowledge Check

Marcus onboards Oakwood Financial's 650 Windows laptops to Defender for Endpoint via Intune. A week later, the security team reports they cannot see EDR alert timelines or run advanced hunting queries — they only see basic antivirus detections. What is the most likely cause?

AThe Intune onboarding profile was configured incorrectlyBOakwood Financial is licensed for Defender for Endpoint Plan 1 — EDR and advanced hunting require Plan 2CThe devices need to be rebooted after onboarding to activate EDRDAdvanced hunting requires enabling audit mode on ASR rules first

Check Answer

Knowledge Check

Elena is configuring ASR rules for MedGuard Health's clinical workstations. The medical records application requires Microsoft Word to launch a helper process (child process) for document generation. Elena enables the 'Block Office applications from creating child processes' ASR rule. What should she do to prevent disruption?

ADisable the ASR rule entirely since it conflicts with business requirementsBDeploy the rule in audit mode first, identify the medical records application path in the logs, add a per-rule exclusion for that path, then switch to block modeCAdd the medical records application to the Controlled Folder Access trusted apps listDConfigure the ASR rule with a Group Policy exception for the clinical workstations OU

Check Answer

Knowledge Check

Priya is planning MDE onboarding for GlobalReach Corp's 200 macOS devices managed by JAMF. Which additional step is required for macOS onboarding that is NOT needed for Windows?

ADownloading the onboarding package from the Defender portalBApproving system extensions and granting full disk access via an MDM configuration profileCInstalling the Microsoft Defender application from the App StoreDEnabling real-time protection in the MDE portal settings

Check Answer

🎬 Video coming soon

---

Next up: Vulnerability Management — use the TVM dashboard to find and fix weaknesses before attackers exploit them.