21 docs tagged with "mde"

Defender Antivirus settings that matter in the Intune Antivirus profiles, active versus passive versus EDR in block mode, and how tamper protection locks them down on Windows and macOS.

The 19 ASR rules with GUIDs, modes and OS support, how to roll them out audit to warn to block, per-rule and global exclusions, and where to read the results.

How Cloud Discovery builds a shadow IT inventory from Defender for Endpoint, log collectors and snapshot uploads, how risk scoring and the Unsanctioned and Monitored tags turn into MDE network protection indicators, and how to verify and troubleshoot the block path.

Block USB and removable storage on Windows and macOS with Defender for Endpoint device control, allow approved devices by serial number, and prove it with the device control report and advanced hunting.

How Defender for Endpoint EDR turns sensor telemetry into alerts and incidents, what you can do about them (isolate, live response, AIR), and how to hunt the raw data with KQL and custom detections.

Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.

Every way a server can be licensed for Defender for Endpoint - Defender for Servers Plan 1 and Plan 2 through Defender for Cloud, the standalone Defender for Endpoint for Servers licence, and the Defender for Business servers add-on - with the billing model, OS support and how to enable the plan by portal, CLI and ARM.

What MDE Plan 1, Plan 2 and Defender for Business each include, which bundles carry them, how servers are licensed, how mixed tenants behave, and how to read licence state from the admin center, Graph and the Defender portal.

Install the mdatp package on supported Linux distros with the installer script, the package repo or the Defender for Cloud MDE.Linux extension, onboard it, set proxy and AV policy through mdatp_managed.json or security settings management, and tune the eBPF sensor.

Deploy Defender for Endpoint to macOS with Intune, in the right order, with the exact profiles, bundle IDs, mdatp checks and update channels that Learn documents.

Let Defender for Servers push the MDE.Windows and MDE.Linux extension to Azure VMs and Azure Arc machines, with the Endpoint protection setting, direct onboarding, multicloud connectors, verification and offboarding.

Onboard Windows Server 2012 R2 through 2025 straight to Defender for Endpoint with the unified agent, the built-in sensor, local script, Group Policy, Configuration Manager or the Defender deployment tool, without Azure or Defender for Cloud in the path.

Onboard Windows 10 and 11 to Defender for Endpoint with an Intune EDR policy, with local script and Group Policy as fallbacks, plus the detection test and offboarding.

What Defender for Endpoint is, its components, how the sensor reaches the cloud, how it fits with Defender XDR and Intune, supported platforms, and the deployment order Microsoft recommends.

How Defender for Endpoint protects servers in two models, standalone MDE onboarding with a per-device server licence or Defender for Servers through Defender for Cloud billed per server-hour, what each gives up, how direct onboarding bridges them, and a decision tree.

What Defender for Identity detects that an MDE-onboarded domain controller cannot, how the v3.x sensor rides on the MDE agent, what the classic v2.x sensor still does better, licensing, and a three-way comparison table.

Every action on a Defender portal device page, what it does, what it needs, OS support and how to undo it, then Live Response in depth with the command set, library, limits and the API.

Push Defender AV, EDR, firewall and ASR policy from Intune or the Defender portal to devices that are onboarded to MDE but not enrolled in Intune, using synthetic Entra device objects and the MDE-Management tag.

Page-by-page walk of Settings in the Defender portal, which product owns each page, which toggles reach across products, how device groups drive automation and RBAC, and how to audit who changed what.

Diagnostic workflow, tools, event IDs, error codes and fixes for Defender for Endpoint onboarding and sensor health problems on Windows, macOS and Linux.

The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.