Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Each onboarded device adds an additional endpoint detection and response (EDR) sensor and increases visibility over breach activity in your network. Onboarding also ensures that a device can be checked for vulnerable components, for security configuration issues, and can receive critical remediation actions during attacks.
Defender for Endpoint supports multiple onboarding methods. For cloud-native and Intune-managed environments, Microsoft Intune is the recommended approach.
Before you begin, review the following prerequisites in the Intune documentation:
- Review licensing and platform requirements for the Intune-Defender integration, including supported platforms and enrollment requirements
- Ensure you have the necessary permissions. The required roles are Endpoint Security Manager in Intune and Security Administrator in Microsoft Entra ID.
Discover and track unprotected devices
On the Device configuration management page in the Microsoft Defender portal at https://security.microsoft.com/configuration_management, the Onboarded via Intune card provides a high-level view of your onboarding rate. The card compares the number of Intune-managed Windows devices onboarded to Defender for Endpoint with the total number of Intune-managed Windows devices.
Note
If you used Configuration Manager, the onboarding script, or other onboarding methods that don't use Intune profiles, you might encounter data discrepancies. To resolve these discrepancies, create a corresponding Intune configuration profile for Defender for Endpoint onboarding and assign that profile to your devices.
Onboard more devices with Intune policies
Selecting Onboard more devices on the card opens the Endpoint security | Microsoft Defender for Endpoint page in the Microsoft Intune admin center at https://intune.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/atp. This page controls the service-to-service connection between Intune and Defender for Endpoint and determines which device platforms participate in the integration. Deploying policies to onboard devices is a separate step done elsewhere in Intune.
To configure this connection and deploy onboarding policies, see Configure Microsoft Defender for Endpoint with Intune and onboard devices (opens in a new tab in the Intune documentation).