Microsoft Defender for Endpoint – Onboarding with Intune Part 4

Introduction

If your Windows devices are already managed by Microsoft Intune, an Endpoint detection and response policy is the cleanest way to onboard them to Microsoft Defender for Endpoint. There are no scripts to copy around, no onboarding packages to refresh, and every new device that lands in the target group is onboarded automatically.

In Part 4 we move to the approach most organizations should standardize on: connecting Defender for Endpoint to Intune and deploying the onboarding configuration through an Endpoint security policy.

By the end of this post you will have:

• An active service-to-service connection between Defender for Endpoint and Intune
• An EDR policy that onboards Windows devices automatically
• A repeatable way to verify onboarding and troubleshoot devices that do not show up

Prerequisites

Before you create any policy, make sure the following are in place:

A quick sanity check: open the device in the Intune admin center and confirm it shows as compliant or at least checking in recently. A device that is not syncing with Intune will never receive the onboarding policy.

Step 1: Connect Defender for Endpoint with Intune

The connection between the two services is what allows Intune to pull the onboarding blob automatically. You only need to set it up once per tenant, and it has two halves.

In the Microsoft Defender portal

1. Sign in to security.microsoft.com.
2. Go to Settings –› Endpoints –› Optional features.
3. Turn on Microsoft Intune connection.
4. Select Save preferences.

In the Microsoft Intune admin center

1. Sign in to intune.microsoft.com.
2. Go to Endpoint security –› Microsoft Defender for Endpoint.
3. Under MDM Compliance Policy Settings, turn on Connect Windows devices version 10.0.15063 and above to Microsoft Defender for Endpoint.
4. Optionally enable the same setting for Android, iOS/iPadOS and macOS if you plan to onboard those platforms later.
5. Select Save.

After a few minutes, the Connection status at the top of the page should change to Enabled, with a recent last-synchronized time. If it stays on “Unavailable”, give it up to 15 minutes before troubleshooting.

Step 2: Create the EDR onboarding policy

With the connector active, the policy itself takes only a few clicks.

1. In the Intune admin center, go to Endpoint security –› Endpoint detection and response.
2. Select Create policy.
3. Set Platform to Windows and Profile to Endpoint detection and response, then select Create.
4. On Basics, give the policy a clear name (for example Microsoft Defender for Endpoint Onboarding - Windows) and a short description.
5. On Configuration settings, set the following:
   • Microsoft Defender for Endpoint client configuration package type: Auto from connector. Intune now pulls the current onboarding blob from your tenant, so you never have to download or upload a package.
   • Sample Sharing: All (recommended) or None, depending on your data-handling requirements.
6. On Scope tags, add tags if you use role-based access in Intune.
7. On Assignments, select the device or user groups to target (covered in the next step).
8. Review and select Create.

If Auto from connector is not available in the dropdown, the connector from Step 1 is not active yet. Go back and confirm the connection status before continuing; the alternative “Onboard” option requires you to paste the blob manually, which defeats the purpose of this approach.

Step 3: Assign and monitor the deployment

Start small. Assign the policy to a pilot group of 5–10 devices that represent your typical hardware and user profiles, validate them, and only then widen the scope to all managed Windows devices.

A few assignment tips:

• Prefer device groups. Onboarding is a device-level setting, so a dynamic device group keeps the logic simple and catches new devices automatically.
• Avoid overlapping EDR policies. Two EDR policies targeting the same device with different settings will result in a conflict, and the device may not onboard at all.
• Use exclusions deliberately. If certain devices (for example, servers or VDI images) must be onboarded another way, exclude them explicitly.

To track progress, open Endpoint security –› Endpoint detection and response and select the EDR Onboarding Status tab. It shows how many devices are onboarded versus not onboarded. Selecting the policy itself shows per-device status (Succeeded, Error, Conflict, Pending).

Devices pick up the policy on their next Intune sync. To speed things up during the pilot, trigger a manual sync from the device (Settings –› Accounts –› Access work or school –› Info –› Sync) or from the device page in Intune.

Step 4: Verify onboarding

A “Succeeded” status in Intune only means the policy was delivered. Confirm onboarding on the device and in the Defender portal as well.

On the device, run the following in an elevated PowerShell session:

# The Sense service should be Running
Get-Service -Name Sense
# OnboardingState should return 1
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" -Name OnboardingState

You can also check the event log under Applications and Services Logs –› Microsoft –› Windows –› SENSE –› Operational. A successful onboarding produces informational events indicating that the service started and onboarding completed.

In the Microsoft Defender portal, go to Assets –› Devices and search for the device name. It typically appears within 5–30 minutes, though it can take longer for the first sensor data to arrive. Open the device page and confirm that Onboarding status is Onboarded and Health state is Active.

For a final end-to-end test, run the detection test command from Settings –› Endpoints –› Onboarding on the pilot device. An alert should appear in the portal within a few minutes, proving that telemetry flows all the way through.

Troubleshooting common issues

Most onboarding problems fall into a handful of patterns:

Two tools save a lot of time here. The first is the MDM diagnostic log under Applications and Services Logs –› Microsoft –› Windows –› DeviceManagement-Enterprise-Diagnostics-Provider –› Admin, which shows whether the WindowsAdvancedThreatProtection CSP was processed. The second is the MDE Client Analyzer, which Microsoft provides as a downloadable script; it checks connectivity, service state and configuration in one run and produces a report you can share with support.