A lot of functionality is included with Windows 10, so it's a matter of making sure devices are enrolled into Endpoint Manager and compliance/configuration policies are rolled out. Defender for Endpoint can be integrated with Endpoint Manager so onboarding of devices happens based on policies as well, but no additional software installation is needed.
For non-Windows devices, users may need to take an extra step. For example, on macOS devices you will need to download the "Intune Company Portal" app to enroll into MDM. For such devices, you generally also have to roll out additional software like Microsoft Defender for Endpoint etc.
