Overview: direct onboarding vs Defender for Cloud
How Defender for Endpoint protects servers in two models, standalone MDE onboarding with a per-device server licence or Defender for Servers through Defender for Cloud billed per server-hour, what each gives up, how direct onboarding bridges them, and a decision tree.
Licensing: Plan 1, Plan 2 and standalone server licences
Every way a server can be licensed for Defender for Endpoint - Defender for Servers Plan 1 and Plan 2 through Defender for Cloud, the standalone Defender for Endpoint for Servers licence, and the Defender for Business servers add-on - with the billing model, OS support and how to enable the plan by portal, CLI and ARM.
Onboarding Windows Server directly (no Defender for Cloud)
Onboard Windows Server 2012 R2 through 2025 straight to Defender for Endpoint with the unified agent, the built-in sensor, local script, Group Policy, Configuration Manager or the Defender deployment tool, without Azure or Defender for Cloud in the path.
Onboarding through Defender for Cloud and Azure Arc
Let Defender for Servers push the MDE.Windows and MDE.Linux extension to Azure VMs and Azure Arc machines, with the Endpoint protection setting, direct onboarding, multicloud connectors, verification and offboarding.
Onboarding Linux servers
Install the mdatp package on supported Linux distros with the installer script, the package repo or the Defender for Cloud MDE.Linux extension, onboard it, set proxy and AV policy through mdatp_managed.json or security settings management, and tune the eBPF sensor.
Plan 2 extras: agentless scanning, JIT, FIM, vulnerability management
What you only get by running servers through Defender for Cloud on Plan 2, how each piece works, where the toggles are, and how to prove it is doing something.
Response actions and Live Response, every option explained
Every action on a Defender portal device page, what it does, what it needs, OS support and how to undo it, then Live Response in depth with the command set, library, limits and the API.
Defender for SQL on machines and Azure SQL
The two Defender for SQL plans in Defender for Cloud, what vulnerability assessment and Advanced Threat Protection give you on Azure SQL and on SQL Server on VMs or Arc, how the enhanced agent collects data, and how to enable, verify and troubleshoot both plans.