Daily Intune News
Aboutmerill.net
Microsoft Configuration Manager
Device security

Defender Advanced Threat Protection

9 November 2026Doc update+62 / −56 lines

In brief

The page received grammar, wording, and formatting updates, a new metadata date, and clearer descriptions of supported operating systems and onboarding paths for MDE Client, MMA, and Windows 8.1 devices.

What Intune admins need to know

Administrators should use the revised guidance when planning or performing Defender for Endpoint onboarding; no required action is stated.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • hugowu
  • qiani description: Learn how to manage and monitor Microsoft Defender for Endpoint, a new service that helps enterprises respond to advanced attacks. ms.date: 2024-12-16T00:2026-10-29T00:00:00.0000000Z ms.subservice: protect ms.topic: article ms.collection: tier3

Applies to: Configuration Manager (current branch)

Use Endpoint Protection can helpto manage and monitor Microsoft Defender for Endpoint. Microsoft Defender for Endpoint helps enterprises detect, investigate, and respond to advanced attacks on their networks. Use Configuration Manager policies can help youto onboard and monitor Windows 10 or later clients.

Microsoft Defender Security Center is Microsoft Defender for Endpoint's cloud-based portal is Microsoft Defender Security Center.portal. By adding and deploying a client onboarding configuration file, Configuration Manager can monitor deployment status and Microsoft Defender for Endpoint agent health. Microsoft Defender for Endpoint is supported on PCs running the Configuration Manager client or managed by Microsoft Intune. support Microsoft Defender for Endpoint.

Prerequisites

  • Subscription to Microsoft Defender for Endpoint
  • ClientsClient computers running the Configuration Manager client
  • Clients using an OSoperating system listed in the supported client operating systems section below.section.
  • Your administrative user account needs the Endpoint Protection Manager security role.

Supported client operating systems

You canUse Configuration Manager to onboard the following operating systems using Configuration Manager:systems:

  • Windows 11
  • Windows 10, version 1709 or newer

Important

Operating systems that have reached the end of their product lifecycle arentypically don't typically supported forsupport onboarding unless they have been're enrolled intoin the Extended Security Updates (ESU) program. For more information about supported operating systems and capabilities with Microsoft Defender for Endpoint, see Minimum requirements for Microsoft Defender for Endpoint.

Instructions tofor Onboarding to Microsoft Defender for Endpoint with Configuration Manager 2207 and later versionsversions.

Instructions tofor Updating onboarding information for Microsoft Defender for Endpoint devices with Configuration ManagerManager.

Onboarding to Microsoft Defender for Endpoint with Configuration Manager 2207 and later versions

Different operating systems have different needs for onboarding to Microsoft Defender for Endpoint. Up-level devices, such as Windows Server version 1803, need the onboarding configuration file. Starting in Current Branch 2207, Forfor down-level server operating system devices, you can choose between Microsoft Defender for Endpoint (MDE) Client (recommended) or Microsoft Monitoring Agent (MMA) (legacy) in the Client Settings. For Windows 8.1 devices, you need to use Microsoft Monitoring Agent (MMA) (legacy) in the Client Settings.

Screenshot of Client Settings for Endpoint Protection.

When you onboard devices to Microsoft Defender for Endpoint with Configuration Manager, you deploy the Defender policy to a target collection or multiple collections. Sometimes the target collection contains devices running any number of the supported operating systems. The instructions for onboarding these devices vary based on if you're targeting a collection containing devices with operating systems that are only up-level and devices that support MDE Client or if the collection also includes down-level clients that require MMA.

  • If your collection contains only up-level devices and/orand down-level server operating system devices that require MDE Client (basedbased on the client settings),settings, then you can use the onboarding instructions using Microsoft Defender for Endpoint Client (recommended).
  • If your target collection contains down-level server operating system devices that require MMA (basedMMA, based on the client settings)settings, or Windows 8.1 devices, then use the instructions to onboard devices using Microsoft Monitoring Agent.

Warning

If your target collection contains down-level devices that require MMA, and you use the instructions for onboarding using MDE Client, then the down-level devices wonaren't be onboarded. The optional Workspace key and Workspace ID fields are used for onboarding down-level devices that require MMA, but if they aren't included then the policy will failfails on down-level clients that require MMA.

Onboard devices by using MDE Client to Microsoft Defender for Endpoint (recommended)

Up-level clients require an onboarding configuration file for onboardingto onboard to Microsoft Defender for Endpoint. Up-level operating systems include:

  • Windows 11
  • Windows 10, version 1607 and later
Prerequisites for Windows Server 2012 R2

If you have fully updatedupdate your machines with the latest monthly rollup package, there are no additional prerequisites.

The installer package will checkchecks if the following components haveare already been installed viaduring an update:

Prerequisites for Windows Server 2016
  • TheInstall the Servicing Stack Update (SSU) from September 14, 2021 or later must be installed.later.
  • TheInstall the Latest Cumulative Update (LCU) from September 20, 2018 or later must be installed. It is recommended to installlater. Install the latest available SSU and LCU on the server. - The Microsoft Defender Antivirus feature must be enabled/installed andinstalled, up to date. You can downloaddate, and enabled. Download and install the latest platform version by using Windows Update. Alternatively, download the update package manually from the Microsoft Update Catalog or from MMPC.

Get an onboarding configuration file for up-level devices

  1. Go to the Microsoft Defender Security Center and sign in.

  2. Select Settings, and then select Onboarding under the Endpoint heading.

  3. For the operating system, select Windows 10 and 11.

  4. Choose Microsoft Endpoint Configuration Manager current branch and later for the deployment method.

  5. Select Download package.

  6. Download the compressed archive (.zip) file and extract the contents.

    Note

    The steps have you download the onboarding file for Windows 10 and 11 but this file is also used for up-level Server operating systems.

Important

  • The Microsoft Defender for Endpoint configuration file contains sensitive information which you should be keptkeep secure.
  • If your target collection contains down-level devices that require MMA, and you use the instructions for onboarding by using MDE Client, then the down-level devices wonaren't be onboarded. TheUse the optional Workspace key and Workspace ID fields are used for onboarding down-level devices, but if they arenyou don't included theninclude them, the policy will failfails on down-level clients.

Onboard the up-level devices

  1. In the Configuration Manager console, navigatego to Administration > Client Settings.

  2. Create custom Client Device Settings or go to the properties of the required client setting and select Endpoint Protection.

  3. For Microsoft Defender for Endpoint Client on Windows Server 2012 R2 and Windows Server 2016 setting, Thechange the default value is set asfrom Microsoft Monitoring Agent (legacy) which needs to be changed to MDE Client (recommended).

    Screenshot of Client Settings for Endpoint Protection showing different options for down-level server operating system devices.

  4. In the Configuration Manager console, navigatego to Assets and Compliance > Endpoint Protection > Microsoft Defender ATP Policies and select Create Microsoft Defender ATP Policy. The policy wizard opens.

  5. Type the Name and Description for the Microsoft Defender for Endpoint policy and select Onboarding.

  6. Browse to the configuration file you extracted from the downloaded .zip file.

  7. Specify the file samples that are collected and shared from managed devices for analysis.

    • None
    • All file types

  8. Review the summary and complete the wizard.

  9. Right-click on the policy you created, and then select Deploy to target the Microsoft Defender for Endpoint policy to clients.

Onboard devices with MDE Client and MMA to Microsoft Defender for Endpoint

Get the configuration file, workspace ID, and workspace key

  1. Go to the Microsoft Defender for Endpoint online service and sign in.

  2. Select Settings, and then select Onboarding under the Endpoints heading.

  3. For the operating system, select Windows 10 and 11.

  4. Choose Microsoft Endpoint Configuration Manager current branch and later for the deployment method.

  5. Select Download package.

    Screenshot of onboarding configuration file download.

  6. Download the compressed archive (.zip) file and extract the contents.

  7. Select Settings, and then select Onboarding under the Device management heading.

  8. For the operating system, select either Windows 7 SP1 and 8.1 or Windows Server 2008 R2 Sp1, 2012 R2 and 2016 from the list.

    • The Workspace key and Workspace ID will beare the same regardless of which of these options you choose.

  9. Copy the values for the Workspace key and Workspace ID from the Configure connection section.

    Important

    The Microsoft Defender for Endpoint configuration file contains sensitive information which should be keptinformation. Keep it secure.

Onboard the devices

  1. In the Configuration Manager console, navigatego to Administration > Client Settings.

  2. Create custom Client Device Settings or go to the properties of the required client setting and select Endpoint Protection.

  3. For Microsoft Defender for Endpoint Client on Windows Server 2012 R2 and Windows Server 2016 setting, ensure the value is set as Microsoft Monitoring Agent (legacy).

  4. In the Configuration Manager console, navigatego to Assets and Compliance > Endpoint Protection > Microsoft Defender ATP Policies.

  5. Select Create Microsoft Defender ATP Policy to open the policy wizard.

  6. Type the Name and Description for the Microsoft Defender for Endpoint policy and select Onboarding.

  7. Browse to the configuration file you extracted from the downloaded .zip file.

  8. Supply the Workspace key and Workspace ID then select Next.

    • Verify that the Workspace key and Workspace ID are in the correct fields. The order in the console maycan vary from the order in Microsoft Defender for Endpoint online service. Screenshot of Microsoft Defender for Endpoint policy configuration wizard.

    Screenshot of Microsoft Defender for Endpoint policy configuration wizard.

  9. Specify the file samples that are collected and shared from managed devices for analysis.

    • None
    • All file types

  10. Review the summary and complete the wizard.

  11. Right-click on the policy you created, and then select Deploy to target the Microsoft Defender for Endpoint policy to clients.

Monitor

  1. In the Configuration Manager console, navigatego to Monitoring > Security and then select Microsoft Defender ATP.

  2. Review the Microsoft Defender for Endpoint dashboard.

    • Microsoft Defender ATP Agent Onboarding Status: The number and percentage of eligible managed client computers with active Microsoft Defender for Endpoint policy onboarded

    • Microsoft Defender ATP Agent Health: Percentage of computer clients reportingthat report status for their Microsoft Defender for Endpoint agent

      • Healthy -: Working properly
      • Inactive -: No data sent to service during time period
      • Agent state -: The system service for the agent in Windows isn't running
      • Not onboarded -: Policy was applied but the agent hasn't reported policy onboard

Create an offboarding configuration file

  1. Sign in to the Microsoft Defender Security Center.

  2. Select Settings, and then select Offboarding under the Endpoint heading.

  3. Select Windows 10 and 11 for the operating system and Microsoft Endpoint Configuration Manager current branch and later for the deployment method.

    • UsingBy using the Windows 10 and 11 option ensuresoption, you ensure that all devices in the collection are off boardedoffboarded and the MMA is uninstalleduninstalls when needed.

  4. Download the compressed archive (.zip) file and extract the contents. Offboarding files are valid for 30 days.

  5. In the Configuration Manager console, navigatego to Assets and Compliance > Endpoint Protection > Microsoft Defender ATP Policies and select Create Microsoft Defender ATP Policy. The policy wizard opens.

  6. Type the Name and Description for the Microsoft Defender for Endpoint policy and select Offboarding.

  7. Browse to the configuration file you extracted from the downloaded .zip file.

  8. Review the summary and complete the wizard.

Important

The Microsoft Defender for Endpoint configuration filesfile contains sensitive information which should be keptinformation. Keep it secure.

Updating the onboarding information for existing devices

Organizations maymight need to update the onboarding information on a device viaby using Microsoft Configuration Manager.

This can be necessary dueYou might need to a change inupdate this information when the onboarding payload for Microsoft Defender for Endpoint,Endpoint changes or when directed by Microsoft support.support directs you to do so.

UpdatingWhen you update the onboarding information willinformation, you direct the device to start utilizingusing the new onboarding payload at the next Restart.

This process compromises of actions to updateinvolves updating the existing onboarding policy,policy and executing a one one-time action on all existing devices to update the onboarding payload. UtilizeUse the Group Policy onboarding script to perform a one one-time uplift of devices from the old payload to the new payload.

Note

This information will notdoesn't necessarily move a device between tenants without fully offboarding the device from the original tenant. For options migrating devices between Microsoft Defender for Endpoint organizations, engagecontact Microsoft Support.

Validate the new onboarding payload

  1. Download the Group Policy onboarding package from the Microsoft Defender for Endpoint portal.
  2. Create a collection for validation ofto validate the new onboarding payloadpayload.
  3. Exclude this collection from the existing Microsoft Defender for Endpoint collection targeted with the onboarding payload.
  4. Deploy the Group Policy onboarding script to the test collection.
  5. Validate the devices are utilizingusing the new onboarding payload.

Migrate to the new onboarding payload

  1. Download the Microsoft Configuration Manager onboarding package from the Microsoft Defender for Endpoint portal.
  2. Update the existing Microsoft Defender for Endpoint onboarding policy with the new onboarding payload.
  3. Deploy the script from Validate the new onboarding payload to the existing target collection for the Microsoft Defender for Endpoint onboarding policy.
  4. Validate the devices are utilizingusing the new onboarding payload and successfully consuming the payload from the scriptscript.

Note

Once\ No newline at end of file After you migrate all devices are migrateddevices, you can remove the script and validation collections from your environment, using the onboarding policy moving forward. \ No newline at end of file \ No newline at end of file

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…