Microsoft Defender for Endpoint: Onboarding Devices

Summary

A device that Microsoft Defender for Endpoint cannot see is a device it cannot protect. Onboarding connects each device to the service so it shows up in the inventory and starts reporting. This article covers how to choose a deployment method, how to pick a connectivity type, and how to prove each device is reporting before you widen the rollout.

Visibility Comes Before Protection

We will use A.M Finances Group as our business example. The company shipped 200 new laptops to its loan operations team on a Monday. By Friday, the security team's device inventory listed 140. The other sixty were opening email, running Office, and browsing the web, and nothing was reporting back. Nothing had gone wrong yet. The trouble was that nobody could prove it.

Microsoft Defender for Endpoint protects through a sensor on each device, so a laptop that was never onboarded has no alerts, no timeline, and no rules applied to it. That makes onboarding the first control rather than an administrative chore. Everything else Defender for Endpoint does, including attack surface reduction rules, builds on devices that are reporting.

Choose the Way In

Everything starts in the Microsoft Defender portal, under Settings, Endpoints, and Onboarding. The team picks an operating system, a connectivity type, and a deployment method, then downloads the package. Microsoft Intune suits managed Windows devices through an endpoint detection and response policy. Configuration Manager and Group Policy suit existing estates, a local script suits a handful of machines, and the Microsoft Defender deployment tool for Windows onboards a device with an access key generated in the portal. Servers have their own path, and Microsoft recommends Defender for Servers Plan 2 in Microsoft Defender for Cloud for most organizations.

The goal is the same whichever path you take: get the device connected and reporting. Microsoft notes that the deployment tool you use influences how you onboard endpoints, so the method should follow how each device is already managed. That is why onboarding is not one-size-fits-all.

One Domain or Many

Connectivity is the other choice, and it describes how devices talk back to the service. Standard connectivity uses the service URLs Defender for Endpoint has always used. Streamlined connectivity sends core traffic through one consolidated domain, or static IP ranges when network devices cannot handle wildcards, which shrinks the firewall allow list. It changes nothing about features or the user experience, and Microsoft has no plans to retire the standard URLs.

Two cautions apply. Devices that still use the Microsoft Monitoring Agent must stay on standard connectivity, and traffic inspection is not supported, because inspecting Defender for Endpoint traffic can interfere with the sensor's connection to the service. A.M Finances Group chose streamlined for its new laptops.

Prove It Worked

Running a package is not proof. Microsoft calls verifying that a device was added to the service a critical step in the whole deployment. On the first ring, the team checked three things: the device appeared in the device inventory, it was reporting to the service, and a detection test raised an alert in the portal.

The detection test is a command from Microsoft's documentation that you run in an elevated Command Prompt on a recently onboarded device. It simulates a malicious download-and-execute pattern so that Defender for Endpoint can detect it. The window closes on its own, and if the device is reporting correctly, a new alert for that device appears in the Defender portal in about ten minutes. If all three checks pass, the device is onboarded in practice and not only on paper.

Roll Out in Rings

Microsoft's example rollout uses rings, starting with about 50 devices to evaluate, then the next 50 to 100 as a pilot, then the rest of the environment in larger steps. Each ring earns the next one. Microsoft's example exit criteria include devices showing up in the inventory, alerts appearing in the dashboard, a detection test, and a simulated attack on a device. Make sure the first group is healthy before inviting everyone else in.

The first ring at A.M Finances Group looked clean, so the team pushed the package to the rest. By the following Friday, the inventory showed all 200 laptops. With every device reporting, the team could finally move on to controlling what attackers can do on them, which is the job of attack surface reduction rules.

Conclusion

Onboarding is the first control in Microsoft Defender for Endpoint. Choose the deployment method your team already manages, pick the connectivity type your network can support, and prove every device with the inventory and a detection test. Then widen the rollout in rings. A.M Finances Group went from 140 visible laptops to 200, and with every device reporting, it is ready to start reducing what attackers can do on them.