If your Windows devices are already in Intune, the cleanest way to onboard Defender for Endpoint is from Intune itself. You connect the two services once, deploy an endpoint detection and response (EDR) policy, and every managed device starts reporting to the Microsoft Defender portal. No scripts, no Group Policy, no packages to copy around.
This guide shows how to onboard Defender for Endpoint with Intune step by step, what licensing you need, how to confirm it worked, and the settings to configure right after onboarding so you get real protection rather than just a device list.
What onboarding does and does not do
Onboarding configures a device to send security telemetry to your Defender for Endpoint tenant. The onboarding package tells the built-in Defender sensor in Windows which tenant it belongs to and how to talk to the service. Once onboarded, the device appears in the Defender portal device inventory and you get detection, investigation and response capabilities.
What onboarding does not do is configure your protection settings. Antivirus behavior, attack surface reduction rules, firewall, and tamper protection are separate policies. A device can be onboarded and still have weak settings. That is why this guide covers both.
Licensing check
Before you start, confirm which Defender plan your users have:
License
Defender endpoint plan included
Microsoft 365 Business Premium
Microsoft Defender for Business
Microsoft 365 E3
Defender for Endpoint Plan 1
Microsoft 365 E5 or E5 Security add-on
Defender for Endpoint Plan 2
All three can onboard through Intune. Plan 2 adds capabilities like advanced hunting and automated investigation. If you are weighing an upgrade, our E5 vs E3 calculator helps you see whether the security uplift is worth it for your headcount.
You also need the right admin roles. The account that connects the services needs Security Administrator (or equivalent) rights in both Intune and Defender, and the account that creates policies needs the Intune Endpoint Security Manager role or equivalent.
Step 1: Connect Defender for Endpoint and Intune
The service-to-service connection lets Intune pull the onboarding package automatically and lets Defender send device risk back to Intune.
In the Microsoft Defender portal, go to Settings > Endpoints > Advanced features and turn on Microsoft Intune connection. Save.
In the Intune admin center, go to Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint.
Turn on the connection options for the platforms you manage. For Windows, enable the option to connect Windows devices to Defender for Endpoint. Turn on mobile platforms now too if you plan to use Defender on iOS and Android.
Save and wait for the connection status to show Connected. Microsoft notes this can take up to 15 minutes.
Step 2: Deploy the EDR onboarding policy
Intune gives you two ways to create the onboarding policy.
Option A: Preconfigured policy (fastest)
Go to Endpoint security > Endpoint detection and response and open the EDR Onboarding Status tab. Select Deploy preconfigured policy. This creates a policy for all Windows devices using the onboarding package from the connector. It is the right choice for most small businesses that want every device covered.
Option B: Custom policy (more control)
If you want a pilot group first, or different settings for different devices, create the policy yourself:
Go to Endpoint security > Endpoint detection and response > Create Policy.
Platform: Windows. Profile: Endpoint detection and response.
Set Microsoft Defender for Endpoint client configuration package type to Auto from connector.
Set Sample Sharing to All unless you have a specific data handling reason not to. Turning it off reduces detection quality.
Assign to a pilot group, then widen to all devices once you confirm onboarding.
Use one onboarding method per device. If an older device configuration profile or a script also onboards devices, you can create conflicts. Remove the old method once the EDR policy is in place.
Step 3: Confirm devices are onboarded
Give devices a check-in cycle, then confirm from both sides:
Intune: The EDR Onboarding Status tab shows onboarded and not-onboarded devices with a reason for each.
Defender portal: Devices appear under Assets > Devices with a sensor health state of active.
On the device: In an elevated prompt, sc query sense should show the Sense service running.
If a device does not appear, check that it is actually receiving the policy, that it can reach the Defender service URLs through any proxy or firewall, and that another antivirus is not still installed and active.
Step 4: Configure the protection that onboarding does not
With devices onboarded, configure these endpoint security policies in Intune. This is the minimum set I deploy for clients:
Antivirus policy (Endpoint security > Antivirus, profile Microsoft Defender Antivirus): real-time protection on, cloud-delivered protection on with a high block level, automatic sample submission, PUA protection in block mode, and network protection enabled.
Windows Security experience profile in the same Antivirus area: turn tamper protection on so the settings above cannot be switched off locally.
Attack surface reduction rules: standard protection rules in block, the rest in audit, then enforce over a few weeks.
Firewall policy: firewall on for domain, private and public profiles.
Compliance policy: add the Defender for Endpoint machine risk score setting so a compromised device loses access through Conditional Access.
Avoid configuring the same Defender settings in both a security baseline and an endpoint security policy. Conflicting values mean neither applies.
Step 5: Onboard the other platforms
Windows is usually first, but Defender for Endpoint also covers macOS, iOS, iPadOS and Android, and Intune handles all of them:
macOS: deploy the Defender app plus the required configuration profiles (system extensions, full disk access, network filter) and an EDR onboarding policy for macOS.
iOS and Android: deploy the Microsoft Defender app from Intune. On mobile it provides web protection and device risk signals that feed compliance and app protection policies.
Do I need to install an agent to onboard Defender for Endpoint on Windows?
No. The Defender sensor is built into Windows 10 and Windows 11. The Intune EDR policy delivers the onboarding configuration that activates it for your tenant.
How long does it take for onboarded devices to appear in the Defender portal?
Usually within a few hours of the device receiving the policy, after its first telemetry upload. If a device is still missing after a day, check policy status and network access to the Defender service.
Can I onboard Defender for Endpoint with Business Premium?
Yes. Business Premium includes Microsoft Defender for Business and Intune, and onboarding through an Intune EDR policy works the same way.
Not sure whether all your devices are actually onboarded and protected? Book a free Microsoft 365 security assessment and we will check your Defender coverage device by device.
If your Windows devices are already in Intune, the cleanest way to onboard Defender for Endpoint is from Intune itself. You connect the two services once, deploy an endpoint detection and response (EDR) policy, and every managed device starts reporting to the Microsoft Defender portal. No scripts, no Group Policy, no packages to copy around.
This guide shows how to onboard Defender for Endpoint with Intune step by step, what licensing you need, how to confirm it worked, and the settings to configure right after onboarding so you get real protection rather than just a device list.
What onboarding does and does not do
Onboarding configures a device to send security telemetry to your Defender for Endpoint tenant. The onboarding package tells the built-in Defender sensor in Windows which tenant it belongs to and how to talk to the service. Once onboarded, the device appears in the Defender portal device inventory and you get detection, investigation and response capabilities.
What onboarding does not do is configure your protection settings. Antivirus behavior, attack surface reduction rules, firewall, and tamper protection are separate policies. A device can be onboarded and still have weak settings. That is why this guide covers both.
Licensing check
Before you start, confirm which Defender plan your users have:
All three can onboard through Intune. Plan 2 adds capabilities like advanced hunting and automated investigation. If you are weighing an upgrade, our E5 vs E3 calculator helps you see whether the security uplift is worth it for your headcount.
You also need the right admin roles. The account that connects the services needs Security Administrator (or equivalent) rights in both Intune and Defender, and the account that creates policies needs the Intune Endpoint Security Manager role or equivalent.
Step 1: Connect Defender for Endpoint and Intune
The service-to-service connection lets Intune pull the onboarding package automatically and lets Defender send device risk back to Intune.
Settings > Endpoints > Advanced featuresand turn on Microsoft Intune connection. Save.Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint.Step 2: Deploy the EDR onboarding policy
Intune gives you two ways to create the onboarding policy.
Option A: Preconfigured policy (fastest)
Go to
Endpoint security > Endpoint detection and responseand open the EDR Onboarding Status tab. Select Deploy preconfigured policy. This creates a policy for all Windows devices using the onboarding package from the connector. It is the right choice for most small businesses that want every device covered.Option B: Custom policy (more control)
If you want a pilot group first, or different settings for different devices, create the policy yourself:
Endpoint security > Endpoint detection and response > Create Policy.Use one onboarding method per device. If an older device configuration profile or a script also onboards devices, you can create conflicts. Remove the old method once the EDR policy is in place.
Step 3: Confirm devices are onboarded
Give devices a check-in cycle, then confirm from both sides:
Assets > Deviceswith a sensor health state of active.sc query senseshould show the Sense service running.If a device does not appear, check that it is actually receiving the policy, that it can reach the Defender service URLs through any proxy or firewall, and that another antivirus is not still installed and active.
Step 4: Configure the protection that onboarding does not
With devices onboarded, configure these endpoint security policies in Intune. This is the minimum set I deploy for clients:
Endpoint security > Antivirus, profile Microsoft Defender Antivirus): real-time protection on, cloud-delivered protection on with a high block level, automatic sample submission, PUA protection in block mode, and network protection enabled.Avoid configuring the same Defender settings in both a security baseline and an endpoint security policy. Conflicting values mean neither applies.
Step 5: Onboard the other platforms
Windows is usually first, but Defender for Endpoint also covers macOS, iOS, iPadOS and Android, and Intune handles all of them:
We cover the mobile side in more depth on our Intune for macOS and Intune for Android pages.
A quick onboarding checklist
If you want this done for you, our Defender for Endpoint deployment service covers onboarding, policy tuning and handover. Microsoft’s documentation for the EDR policy is here: Deploy endpoint detection and response policy with Intune.
Frequently asked questions
Do I need to install an agent to onboard Defender for Endpoint on Windows?
No. The Defender sensor is built into Windows 10 and Windows 11. The Intune EDR policy delivers the onboarding configuration that activates it for your tenant.
How long does it take for onboarded devices to appear in the Defender portal?
Usually within a few hours of the device receiving the policy, after its first telemetry upload. If a device is still missing after a day, check policy status and network access to the Defender service.
Can I onboard Defender for Endpoint with Business Premium?
Yes. Business Premium includes Microsoft Defender for Business and Intune, and onboarding through an Intune EDR policy works the same way.
Not sure whether all your devices are actually onboarded and protected? Book a free Microsoft 365 security assessment and we will check your Defender coverage device by device.