Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Prepare your organization to migrate to Defender for Endpoint by updating devices, confirming licenses, configuring portal access, reviewing connectivity, and capturing baseline performance data before onboarding.
Phase 1: Prepare
 Phase 1: Prepare |
 Phase 2: Set up |
 Phase 3: Onboard |
|---|---|---|
| You're here! |
Welcome to the Prepare phase of migrating to Defender for Endpoint.
In this phase, you prepare your environment before you set up and onboard Defender for Endpoint.
This migration phase includes the following steps:
- Update your organization's devices.
- Get Microsoft Defender for Endpoint Plan 1 or Plan 2.
- Grant access to the Microsoft Defender portal.
- Review device proxy and internet connectivity settings.
- Capture endpoint performance baseline data.
Important
If you want to run multiple security solutions side by side, see Considerations for performance, configuration, and support.
You might have already configured mutual security exclusions for devices onboarded to Microsoft Defender for Endpoint. If you still need to set mutual exclusions to avoid conflicts, see Add Microsoft Defender for Endpoint to the exclusion list for your existing solution.
Step 1: Update your organization's devices
Before migration, update your existing endpoint protection solution, operating systems, and apps. Current software and security updates can help prevent compatibility and deployment problems when you introduce Microsoft Defender Antivirus.
Update your existing security solution
Install the latest updates for your existing endpoint protection solution. Review your solution provider's documentation for update requirements and procedures.
Update your organization's devices
Use the following resources to update operating systems:
| OS | Resource |
|---|---|
| Windows | Microsoft Update |
| macOS | How to update the software on your macOS devices |
| iOS | Update your iPhone, iPad, or iPod touch |
| Android | Check & update your Android version |
| Linux | Linux 101: Updating Your System |
Step 2: Get Microsoft Defender for Endpoint Plan 1 or Plan 2
Get Defender for Endpoint, assign the required licenses, and verify that the service is provisioned.
Buy or try Defender for Endpoint today. Start a free trial or request a quote. For current licensing information, see Microsoft Defender for Endpoint licensing guidance.
Verify that your licenses are provisioned. See Check your license state.
Set up your dedicated cloud instance of Defender for Endpoint. See Defender for Endpoint setup: Tenant configuration.
If any devices in your organization use a proxy to access the internet, follow the guidance in Defender for Endpoint setup: Network configuration.
After you provision licenses and configure your Defender for Endpoint organization, grant your security administrators and security operators access to the Microsoft Defender portal.
Step 3: Grant access to the Microsoft Defender portal
The Microsoft Defender portal is where you and your security team access and configure features and capabilities of Defender for Endpoint. For an overview of portal features and navigation, see Overview of the Microsoft Defender portal.
Use Microsoft Defender unified role-based access control (RBAC) to provide centralized, granular permissions to the Microsoft Defender portal.
Important
Starting February 16, 2025, new Microsoft Defender for Endpoint customers have access only to Unified Role-Based Access Control (URBAC). Existing customers retain their current roles and permissions. For more information, see Microsoft Defender unified role-based access control.
To grant portal access, complete the steps that apply to your organization's permissions model:
Plan the roles and permissions for your security administrators and security operators. See Role-based access control.
Configure access to the Microsoft Defender portal:
- If your organization uses unified RBAC, on the Permissions and roles page in the Microsoft Defender portal at https://security.microsoft.com/mtp_roles, create custom roles, assign the roles to users or Microsoft Entra security groups, and activate the applicable Defender workloads.
- If your organization retains the Defender for Endpoint RBAC model, see Manage portal access using role-based access control.
Step 4: Review device proxy and internet connectivity settings
Your devices might require proxy or internet settings to communicate with Defender for Endpoint. Use the following resources for each operating system and subscription:
* Windows Server 2016 and Windows Server 2012 R2 require the modern unified solution. For more information, see Onboard Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender for Endpoint.
Important
The standalone versions of Defender for Endpoint Plan 1 and Plan 2 don't include server licenses. To onboard servers, you need a server license, such as Microsoft Defender for Servers Plan 1 or Plan 2. For more information, see Defender for Endpoint onboarding Windows Server.
Step 5: Capture endpoint performance baseline data
Before migration, capture baseline performance data from endpoints that will run Defender for Endpoint. Comparing performance before and after onboarding helps you distinguish existing resource usage from changes that might be associated with Microsoft Defender Antivirus.
Collect the process list, aggregate CPU usage, memory usage, and available disk space on all mounted partitions.
Use Windows Performance Monitor (perfmon) to collect a performance baseline on Windows client devices or Windows Server. For instructions, see Set up local Performance Monitor on a Windows client or Windows Server.
Next steps
Congratulations! You've completed the Prepare phase of migrating to Defender for Endpoint.