Overview and architecture
What Defender for Endpoint is, its components, how the sensor reaches the cloud, how it fits with Defender XDR and Intune, supported platforms, and the deployment order Microsoft recommends.
Licensing: Plan 1, Plan 2, Business
What MDE Plan 1, Plan 2 and Defender for Business each include, which bundles carry them, how servers are licensed, how mixed tenants behave, and how to read licence state from the admin center, Graph and the Defender portal.
Onboarding Windows via Intune
Onboard Windows 10 and 11 to Defender for Endpoint with an Intune EDR policy, with local script and Group Policy as fallbacks, plus the detection test and offboarding.
Onboarding macOS via Intune
Deploy Defender for Endpoint to macOS with Intune, in the right order, with the exact profiles, bundle IDs, mdatp checks and update channels that Learn documents.
Security settings management (MDE-attach)
Push Defender AV, EDR, firewall and ASR policy from Intune or the Defender portal to devices that are onboarded to MDE but not enrolled in Intune, using synthetic Entra device objects and the MDE-Management tag.
Antivirus and tamper protection
Defender Antivirus settings that matter in the Intune Antivirus profiles, active versus passive versus EDR in block mode, and how tamper protection locks them down on Windows and macOS.
Attack surface reduction rules
The 19 ASR rules with GUIDs, modes and OS support, how to roll them out audit to warn to block, per-rule and global exclusions, and where to read the results.
Device control: USB and removable media
Block USB and removable storage on Windows and macOS with Defender for Endpoint device control, allow approved devices by serial number, and prove it with the device control report and advanced hunting.
EDR, alerts and Advanced Hunting
How Defender for Endpoint EDR turns sensor telemetry into alerts and incidents, what you can do about them (isolate, live response, AIR), and how to hunt the raw data with KQL and custom detections.
Troubleshooting onboarding and sensor health
Diagnostic workflow, tools, event IDs, error codes and fixes for Defender for Endpoint onboarding and sensor health problems on Windows, macOS and Linux.