How to Deploy Microsoft Defender for Endpoint via Intune

Microsoft Defender for Endpoint (MDE) is Microsoft's enterprise EDR (Endpoint Detection and Response) platform. It provides advanced threat protection, device vulnerability assessment, attack surface reduction, and security analytics - all integrated with Microsoft 365 Defender.

Deploying it through Intune means zero-touch onboarding across your entire managed Windows fleet, with no need to manually run scripts or push packages through SCCM. This guide covers the complete onboarding process.

Prerequisites

• Licence: Microsoft Defender for Endpoint Plan 1 or Plan 2 (included in M365 Business Premium, E5, or as a standalone add-on)
• Intune: Devices enrolled and managed in Intune
• MDE tenant: Activated - browse to security.microsoft.com and complete initial setup
• MDM authority: Intune set as the MDM authority in your tenant

Step 1: Enable the MDE–Intune Connection

First, connect MDE to Intune so that compliance data flows between them and you can deploy MDE settings from the Intune console.

In the MDE portal:

Back in Intune, the connector status should change to Enabled within a few minutes. You'll see the option to enforce compliance policy and create device risk-based Conditional Access policies.

Step 2: Create the Onboarding Policy

Assign this policy to your Windows device group. Once synced, Intune silently installs the MDE sensor on each device. Devices appear in the MDE portal within 1–2 hours.

Step 3: Configure Antivirus Policy

Step 4: Attack Surface Reduction Rules

Attack Surface Reduction (ASR) rules block specific behaviours commonly used in malware attacks - things like Office macros spawning child processes, credential theft from LSASS, and executable content from email clients. They are one of the most effective preventive controls available.

Key rules to enable in Block mode (after auditing):

• Block credential stealing from the Windows local security authority subsystem
• Block all Office applications from creating child processes
• Block executable content from email client and webmail
• Block JavaScript or VBScript from launching downloaded executable content
• Block execution of potentially obfuscated scripts
• Block abuse of exploited vulnerable signed drivers

Step 5: Compliance Integration

Once devices are onboarded, you can use their MDE risk score in Intune compliance policies. This means a device with active malware detections can automatically be marked as non-compliant, which in turn blocks access to corporate resources via Conditional Access.

Verify Onboarding

Check onboarded devices in the MDE portal:

Newly onboarded devices appear here within 1–2 hours of policy sync. The device shows its risk level, last seen time, sensor health, and any active alerts. A device showing Sensor status: Active is fully onboarded.