This video demonstrates the onboarding wizard in Microsoft
Defender ATP—which simplifies how you get clients
on board—plus how to onboard clients by using Microsoft
Intune.
You can onboard any version of Windows
that Microsoft Defender ATP supports.
However, you must have a Windows 10 Enterprise E5 or Microsoft
365 Enterprise E5 license.
You can also onboard devices running macOS, Linux, iOS,
and Android.
That support is provided by Microsoft partners,
like Bitdefender, Lookout, SentinelOne and Ziften.
Check their documentation to see which versions
and distributions they support.
While you can onboard all these, this video
focuses on Windows 10.
Next up, I’ll describe additional requirements
for Windows 10.
Microsoft Defender ATP has some requirements Windows 10 devices
need to meet.
Most of them are easy, since you’d have to go out
of your way not to meet them.
Regardless, here they are—just in case.
First, Microsoft Defender ATP requires the Diag Track service
to be running in order to report cyber data.
That’s the default Windows configuration,
so just double-check that you haven’t turned it off.
Of course, Microsoft Defender ATP
requires an Internet connection.
Its sensor can use about 5 megabytes each day
to talk to the cloud service, plus additional bandwidth
for files and investigation packages
(which are sent only if you request them).
Last, even if Windows Defender Antivirus isn’t the primary
antimalware product, Microsoft Defender ATP relies on its
passive mode to scan and provide information about files.
Windows Defender Antivirus does not conflict
with third-party antivirus products,
so ensure no policy or script disables it.
Most will meet these requirements with no effort.
Onboarding clients to Microsoft Defender ATP
is only slightly more time consuming.
Next.
There are various ways to onboard clients
to Microsoft Defender ATP, depending on the operating
system and deployment method.
The onboarding wizard guides you through the process
by providing package files and instructions.
In this example, I’m onboarding Windows 10 devices,
and since we use System Center Configuration Manager,
I’ll choose that and then download the package file.
The wizard also provides a link to deployment instructions
for the downloaded package file.
In most cases, those instructions are quite simple.
Extracting the ZIP file reveals the configuration profile
required to create a Microsoft Defender ATP policy
in Configuration Manager.
The only thing easier might be onboarding Windows 10 devices
by using Microsoft Intune.
You learn about that in the next segment.
Connecting Microsoft Defender ATP and Microsoft Intune
enables scenarios like conditional access based
on threat levels, and it also streamlines the onboarding
process, since you don’t have to manually upload an onboarding
package.
You turn that connection on in both places.
First, enable the Microsoft Intune connection
in Microsoft Defender Security Center settings.
Second, turn on the Microsoft Defender ATP
connection in Microsoft Intune.
That control is in Device compliance, Microsoft Defender
ATP.
Once you’ve connected Microsoft Defender ATP and Microsoft
Intune, create a device configuration profile
for Windows 10 or later that’s based on the Microsoft Defender
ATP profile type.
There are only two settings to configure
here, since Microsoft Defender ATP automatically provides
the onboarding package.
In this example, I’ll enable both, save my settings,
and create the policy.
Then, assign the profile to the devices you want to target.
In my example, that’ll be all devices.
Once you’ve deployed the device configuration profile,
monitoring uptake is easy.
The Microsoft Defender ATP compliance chart
indicates how many devices have the agent and how many do not.
This chart is in Device compliance,
under Microsoft Defender ATP.