This blog will help you understand step-by-step process for onboarding cloud native Win10 PCs to Microsoft Defender for Endpoint seamlessly.

Planning for Microsoft Defender for Endpoint?

If you’re planning to move to Microsoft Defender for Endpoint, you will need to start with your organization’s architecture. The deployment tools you are going to use for onboarding devices to Microsoft Defender for Endpoint will depend on the type of architecture you have.

In this blog, we are going to be restricted to onboarding cloud native Windows10 devices to Microsoft Defender for Endpoint with the help of Microsoft Endpoint Manager tool.

Identify architecture

You can use Microsoft Defender for Endpoint in your environment in different ways to meet your needs. The first step is to classify how your company is structured. Choose the architecture that best maps to your needs.

Cloud-native

You should choose a cloud-native architecture if your organization's devices are based in the cloud. For example, if all devices are managed by Microsoft Endpoint Manager, or if your organization would like to move to them in the future to be managed by Microsoft Endpoint Manager.

Co-management

Choose co-management if you have a blended architecture, with devices managed by Microsoft Endpoint Manager and an on-premises configuration management solution.

On-premises

Choose an on-premises architecture if all your devices are using either Configuration Manager or Active Directory Domain Services. Your organization can still benefit from using the power of the cloud-based Microsoft Defender for Endpoint.

Select onboarding tools

Once you've identified your organization's architecture, you can identify the tools you'll use to onboard devices to Microsoft Defender for Endpoint. Each architecture type has a selection of tools to use for onboarding:

Onboarding Cloud-native Windows10 devices to Microsoft Defender for Endpoint using Microsoft Endpoint Manager

In this section, we will focus on the steps to be performed for seamless onboarding of cloud-native windows10 devices to MDE using MEM.

Establish communication between Microsoft Defender for Endpoint & Microsoft Endpoint Manager portal

It is recommended to establish communication between Microsoft Defender for Endpoint & Microsoft Endpoint Manager. Follow the steps below:

\n
1. Login to http://security.microsoft.com/ and browse to Settings>Endpoints>Advanced Features and enable “Microsoft Intune Connection” and save preferences as shown below:
\n

This is required as it connects MDE to Microsoft Intune to enable sharing of device information and enhanced policy enforcement. Intune provides additional information about managed devices for secure score.

\n
1. Login to http://endpoint.microsoft.com/ and browse to Endpoint Security>Setup>Microsoft Defender for Endpoint and enable “Connect Windows devices to Microsoft Defender for Endpoint” and save changes as shown below:
\n

When on, compliance policies using the Device Threat Level rule will evaluate devices including data from this connector.

Create a group in Microsoft Endpoint Manager

Its advisable to create a group for your pilot devices to apply desired configurations. Browse to Groups>New Group and create a group relevant to your requirement.

Create Device Configuration Profile in MEM

For creating Configuration Profile follow the steps mentioned below:                                                                                            

\n
1. Login to http://endpoint.microsoft.com/ and browse to Devices>Configuration Profiles>Create Profile and select the platform you want to choose & profile type “Templates” and select “Microsoft Defender for Endpoint (desktop devices running Windows 10 or later)” as shown below:
\n

\n
1. Click on Create and enter details. Ensure you choose the group that was created for MDE Onboarding as shown below:
\n

You can add the devices you wish to onboard to MDE in this group and the devices will get onboarded seamlessly

\n
1. Once the configuration profile is created, go to properties and you will find Microsoft Defender for configuration package type is set to Onboard.
\n

Steps to onboard devices

Once the configuration profile is created, you are all set to onboard your first device to Microsoft Defender for Endpoint. All you need to do is to open the group and add Members to the group as shown below:

It will take few minutes and the devices will get onboarded to Microsoft Defender for Endpoint automatically.

Additionally, you can check the progress in Device Status tab. Browse to Devices>Configuration Profile (which you created for onboarding)>Device Status as shown below:

Planning for Microsoft Defender for Endpoint?

If you’re planning to move to Microsoft Defender for Endpoint, you will need to start with your organization’s architecture. The deployment tools you are going to use for onboarding devices to Microsoft Defender for Endpoint will depend on the type of architecture you have.

In this blog, we are going to be restricted to onboarding cloud native Windows10 devices to Microsoft Defender for Endpoint with the help of Microsoft Endpoint Manager tool.

Identify architecture

You can use Microsoft Defender for Endpoint in your environment in different ways to meet your needs. The first step is to classify how your company is structured. Choose the architecture that best maps to your needs.

Cloud-native

You should choose a cloud-native architecture if your organization's devices are based in the cloud. For example, if all devices are managed by Microsoft Endpoint Manager, or if your organization would like to move to them in the future to be managed by Microsoft Endpoint Manager.

Co-management

Choose co-management if you have a blended architecture, with devices managed by Microsoft Endpoint Manager and an on-premises configuration management solution.

On-premises

Choose an on-premises architecture if all your devices are using either Configuration Manager or Active Directory Domain Services. Your organization can still benefit from using the power of the cloud-based Microsoft Defender for Endpoint.

Select onboarding tools

Once you've identified your organization's architecture, you can identify the tools you'll use to onboard devices to Microsoft Defender for Endpoint. Each architecture type has a selection of tools to use for onboarding:

Onboarding Cloud-native Windows10 devices to Microsoft Defender for Endpoint using Microsoft Endpoint Manager

In this section, we will focus on the steps to be performed for seamless onboarding of cloud-native windows10 devices to MDE using MEM.

Establish communication between Microsoft Defender for Endpoint & Microsoft Endpoint Manager portal

It is recommended to establish communication between Microsoft Defender for Endpoint & Microsoft Endpoint Manager. Follow the steps below:

\n
1. Login to http://security.microsoft.com/ and browse to Settings>Endpoints>Advanced Features and enable “Microsoft Intune Connection” and save preferences as shown below:
\n

This is required as it connects MDE to Microsoft Intune to enable sharing of device information and enhanced policy enforcement. Intune provides additional information about managed devices for secure score.

\n
1. Login to http://endpoint.microsoft.com/ and browse to Endpoint Security>Setup>Microsoft Defender for Endpoint and enable “Connect Windows devices to Microsoft Defender for Endpoint” and save changes as shown below:
\n

When on, compliance policies using the Device Threat Level rule will evaluate devices including data from this connector.

Create a group in Microsoft Endpoint Manager

Its advisable to create a group for your pilot devices to apply desired configurations. Browse to Groups>New Group and create a group relevant to your requirement.

Create Device Configuration Profile in MEM

For creating Configuration Profile follow the steps mentioned below:                                                                                            

\n
1. Login to http://endpoint.microsoft.com/ and browse to Devices>Configuration Profiles>Create Profile and select the platform you want to choose & profile type “Templates” and select “Microsoft Defender for Endpoint (desktop devices running Windows 10 or later)” as shown below:
\n

\n
1. Click on Create and enter details. Ensure you choose the group that was created for MDE Onboarding as shown below:
\n

You can add the devices you wish to onboard to MDE in this group and the devices will get onboarded seamlessly

\n
1. Once the configuration profile is created, go to properties and you will find Microsoft Defender for configuration package type is set to Onboard.
\n

Steps to onboard devices

Once the configuration profile is created, you are all set to onboard your first device to Microsoft Defender for Endpoint. All you need to do is to open the group and add Members to the group as shown below:

It will take few minutes and the devices will get onboarded to Microsoft Defender for Endpoint automatically.

Additionally, you can check the progress in Device Status tab. Browse to Devices>Configuration Profile (which you created for onboarding)>Device Status as shown below:

This blog will help you understand step-by-step process for onboarding cloud native Win10 PCs to Microsoft Defender for Endpoint seamlessly.

awesome information greatly appreciated 

Thanks aexlz I removed the config policy and the conflict is gone. 

KrisDeb Deploying EDR-Profile AND the EDR-Policy can cause conflicts. Check out \"Onboard Windows devices\" (Configure Microsoft Defender for Endpoint in Microsoft Intune | Microsoft Docs)

\"After you connect Intune and Microsoft Defender for Endpoint, Intune receives an onboarding configuration package from Microsoft Defender for Endpoint. You use a device configuration profile for Microsoft Defender for Endpoint to deploy the package to your Windows devices. [....]

You can also onboard devices using:

• Endpoint detection and response (EDR) policy. Intune EDR policy is part of endpoint security in Intune. Use EDR policies to configure device security without the overhead of the larger body of settings found in device configuration profiles\"

Can we manage the ASR rules for the servers which have been onboarded using MDE-MEM Integration (using Enforcement Scope) option ?

absharan thanks but it doesn't answer my question... I am asking someone who has had some actual hands-on experience.

Hi KrisDeb , here's our documentation on managing conflicts https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-policy#manage-conflicts

It's onboarding but creates a conflict with 'Endpoint detection and response' policy. Should we create MDE onboard configuration policy manually or leave EDR policy and just wait? Or should we delete one of them - if yes, then which one, MDE or EDR policy? What do you think?