Defender for Endpoint Integration and Onboarding

What it is

Microsoft Defender for Endpoint is the endpoint detection and response service. Intune and Defender for Endpoint work together: Intune onboards devices and deploys security policies, and Defender reports each device's risk level, which Intune compliance and Conditional Access can act on. Analysts then investigate threats and triage incidents in the Defender portal.

How it works

Connecting Intune and Defender

Enable the connection once per tenant.

1. In the Microsoft Defender portal, go to Settings, Endpoints, General, Advanced features, and turn on Microsoft Intune connection.
2. In the Intune admin center, go to Tenant administration, Connectors and tokens, Microsoft Defender for Endpoint and connect. The status becomes Enabled (up to 15 minutes).
3. Set the connector options, such as enabling compliance policy evaluation for the platforms you use (Windows, Android, iOS).

You need the Endpoint Security Manager role (or a custom role) in Intune, and the Security Administrator role in Entra ID or Defender. The integration needs a Defender for Endpoint subscription and Intune.

Onboarding devices

Onboard Windows devices with an Endpoint detection and response (EDR) policy under Endpoint security, Endpoint detection and response. Choose the onboarding package source: Auto from connector (recommended) takes the latest package from Defender, with no download. A preconfigured EDR Onboarding Status policy deploys with recommended settings once the connector is active. Alternatives are a local script, Group Policy or Configuration Manager, and for non enrolled devices security settings management can onboard devices without Intune enrollment.

An EDR policy also sets sample sharing, telemetry reporting frequency and, on some versions, device tags. Devices appear in the Defender device inventory after onboarding, and the EDR Onboarding Status tab shows whether each device has onboarded.

Mobile devices use the Microsoft Defender app (iOS, Android), deployed as an app and configured with an app configuration policy and, for MAM, an app protection policy.

Using device risk in compliance

A compliance policy has a Microsoft Defender for Endpoint section with Require the device to be at or under the machine risk score.

Devices that exceed the level become noncompliant, and a Conditional Access policy that requires a compliant device then blocks them. Intune no longer creates classic Conditional Access policies for the connector, so delete any old ones. Windows devices must be Entra registered, enrolled in Intune and onboarded to Defender for this to work.

Investigating threats and triaging incidents

Analysts use the Microsoft Defender portal (security.microsoft.com).

• Incidents group related alerts into one story, and show the affected devices, users and a timeline.
• Device inventory and device page show alerts, the timeline, software inventory and vulnerabilities.
• Actions on a device include isolate device, run antivirus scan, collect investigation package and restrict app execution. Live response opens a remote shell.
• Automated investigation and remediation examines alerts and can fix them, subject to the device group's automation level.
• Triage means setting the status (New, In progress, Resolved), the classification (true or false positive) and assigning an owner.
• Threat and vulnerability management lists weaknesses. The Vulnerability Remediation Agent (covered later) can prioritise them, and Intune can remediate through security tasks.

Intune surfaces the same data in Endpoint security, Defender for Endpoint with the connection status and compliance evaluation toggles, and in Devices, Monitor.

A worked scenario

A company wants only low risk devices to reach SharePoint. The admin enables the connector in both portals, deploys an EDR policy that uses the connector's onboarding package, and adds Require the device to be at or under the machine risk score: Low to the Windows compliance policy. A Conditional Access policy requires a compliant device. When a laptop shows a medium alert, Intune marks it noncompliant, access is blocked, and a Defender analyst isolates it and resolves the incident.