Every way a server can be licensed for Defender for Endpoint - Defender for Servers Plan 1 and Plan 2 through Defender for Cloud, the standalone Defender for Endpoint for Servers licence, and the Defender for Business servers add-on - with the billing model, OS support and how to enable the plan by portal, CLI and ARM.
Install the mdatp package on supported Linux distros with the installer script, the package repo or the Defender for Cloud MDE.Linux extension, onboard it, set proxy and AV policy through mdatp_managed.json or security settings management, and tune the eBPF sensor.
Let Defender for Servers push the MDE.Windows and MDE.Linux extension to Azure VMs and Azure Arc machines, with the Endpoint protection setting, direct onboarding, multicloud connectors, verification and offboarding.
How Defender for Endpoint protects servers in two models, standalone MDE onboarding with a per-device server licence or Defender for Servers through Defender for Cloud billed per server-hour, what each gives up, how direct onboarding bridges them, and a decision tree.
What you only get by running servers through Defender for Cloud on Plan 2, how each piece works, where the toggles are, and how to prove it is doing something.
Every action on a Defender portal device page, what it does, what it needs, OS support and how to undo it, then Live Response in depth with the command set, library, limits and the API.
Push Defender AV, EDR, firewall and ASR policy from Intune or the Defender portal to devices that are onboarded to MDE but not enrolled in Intune, using synthetic Entra device objects and the MDE-Management tag.