"Defender Endpoint P2 Device" Documentation for how to assign licenses to Devices not users

Question

Hello,

We have purchased 100+ Device based licenses for defender that are intended for our shared devices that use a shared 'generic' AD user account, these devices do not have primary users as such. Within the 365 Admin Centre, we have assigned the "Defender Endpoint P2 Device" license to a device group, however, 0 licenses have been assigned; the devices are all on-boarded into Defender via an Intune EDR policy.

The only advice we're finding is from AI results, including 'Ask Learn' where it's referencing setting up 'Mixed mode' licensing for Defender Plan 1 and Plan 2 and using device tagging, however, we're not using Plan 1, we're attempting to assign Defender "Device" licenses.

Can we please be advised as to the process of assigning "Defender Endpoint P2 Device" licenses to Devices; are we required to use the 'Mixed mode' Device tagging process within the defender admin portal, can we not assign licenses to devices groups via the 365 admin portal?

Thank you.

Answer 1

Hello @Michael O'Brien
The 0/120 assigned count does not necessarily mean that the devices are unlicensed. Standard group-based licensing in the Microsoft 365 admin center applies licenses to user members of a group, so a group containing only device objects can remain at zero. Microsoft documents direct device-group licensing for Microsoft 365 Apps, but there is no equivalent published assignment process for Defender for Endpoint device license

Since the devices are already onboarded through the Intune EDR policy and appear in the Microsoft Defender portal, no additional activation should be required on each endpoint.

Mixed mode is not relevant in this case. It is intended for tenants that own both Defender for Endpoint Plan 1 and Plan 2 and need to control which devices receive each plan’s capabilities. Device tags used in mixed mode do not assign the purchased Defender Endpoint P2 Device licenses

The device-based subscription should therefore be treated as a licensing entitlement: the organization must maintain enough licenses to cover the shared devices using Defender for Endpoint. The 0 assigned value is not an indication that onboarding failed.

Because Microsoft’s public documentation does not clearly explain the administration of this specific device-based SKU, it would also be advisable to confirm the entitlement and counting method with the Microsoft licensing provider or account representative.