Ransomware encounters climbed 275% over an 18-month stretch, according to Microsoft’s own threat protection research team. Windows still ranks as the most attacked endpoint operating system in the world, and a lot of small IT teams are running on default antivirus settings that catch commodity malware but miss human-operated attacks. Microsoft Defender for Endpoint is built to close that gap, and adoption shows it’s catching on: 6sense’s market-share tracking counted 3,292 companies running the platform worldwide as of January 2025. It’s the enterprise-grade endpoint detection and response (EDR) layer built into Windows, and by mid-2026 it covers Windows, macOS, Linux, Android, and iOS devices from one console.
This tutorial walks through a full Microsoft Defender for Endpoint rollout: picking the right license, preparing Microsoft Entra ID, onboarding your first devices, turning on attack surface reduction and tamper protection, and proving detection actually works with a safe test file. Budget about 75 minutes for a pilot group of devices. By the end, you’ll have a working, tested EDR deployment plus a script bundle you can reuse across the rest of your fleet.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is Microsoft Defender for Endpoint, and Why It Matters in 2026
Microsoft Defender for Endpoint is Microsoft’s cloud-powered endpoint detection and response platform, sitting inside the broader Microsoft Defender XDR suite. Per Microsoft’s own documentation, it’s built to help organizations prevent, detect, investigate, and respond to advanced threats on their endpoints, and it supports Windows, macOS, Linux, Android, and iOS devices from a single portal. The platform keeps shipping across every one of those platforms, too: the newest release Microsoft documents is macOS version 20.126082.12.0, published in October 2026, which followed macOS version 20.126062.9.0, and the iOS client has reached build 1.1.78290102. On Windows, Microsoft Learn’s October 2026 release notes list antivirus platform version 4.18.25100.9008 and engine version 1.1.25100.9002 as generally available. That matters for any team running a mixed fleet, since it means server admins, Mac users, and mobile device owners all show up in the same view instead of three different consoles. Linux coverage is widening as well: on October 14, 2026, Microsoft announced enterprise-grade Defender protection for Linux workstations in public preview.
The urgency behind setting this up properly is not hypothetical. Microsoft’s security research team reported a 275% increase in ransomware encounters over an 18-month period, and separate threat research from Broadcom (Symantec) found that ransomware actors claimed 4,737 attacks during 2025 via public leak sites, up from 4,701 in 2024. That 0.8% year-over-year increase doesn’t sound dramatic on its own, but Broadcom’s researchers note it’s the highest number of publicly claimed attacks ever recorded that way, which tells you the volume of attacks has not slowed down even as defenses have improved. You can read the full breakdown in Broadcom’s 2026 ransomware threat report.
Microsoft says its platform now disrupts roughly 35,000 ransomware-related incidents every month, and that a Defender for Endpoint customer’s odds of actually ending up with encrypted files fell 300% over that same 18-month window. A November 2025 Ignite update pushed the numbers further: automated disruption running at greater than 99% confidence, ransomware attacks disrupted in an average of 3 minutes, and, in the company’s words, nearly half a million compromised accounts disabled while more than 270,000 devices were saved in recent months. Those figures come straight from Microsoft’s Ignite 2025 Tech Community post. The market-share numbers back up the momentum: IDC data cited by Microsoft in an August 2025 report, and separately reported by CRN in September 2025, shows Defender for Endpoint’s modern endpoint security share climbing from 25.8% to 28.6% between 2023 and 2024, a 2.8-point gain that was still being cited into 2026, Microsoft’s Angela Hsu referenced that same 28.6% IDC figure on LinkedIn as of July 2026.
None of that matters if the rollout itself is rushed or half-finished, though. A console full of unonboarded devices or attack surface reduction rules stuck in a state nobody tested is not real protection, it’s a false sense of one. The rest of this guide is a step-by-step path through licensing, onboarding, hardening, and testing, in that order, so you end up with endpoint security that’s actually doing its job rather than just installed.
One distinction worth understanding before you start: traditional antivirus looks for known-bad files. EDR platforms like Defender for Endpoint watch behavior across an entire attack chain, which is the only way to catch what security teams call human-operated ransomware, where an attacker manually explores a network for hours or days before detonating anything. That behavioral lens keeps expanding to match how endpoints are actually used: the Microsoft Security blog reported in June 2026 that Defender for Endpoint now discovers more than 25 types of local AI agents and MCP servers running on a device, treating those as another part of the attack surface worth watching rather than a blind spot. That behavioral view is also what makes an EDR setup harder to get right than installing antivirus ever was. There are more moving parts, more places to misconfigure a policy, and more reasons to actually test what you’ve built instead of trusting a green checkmark in a dashboard.
Prerequisites: Licenses, Devices, and Access You Need Before You Start
Get these lined up before you touch the portal. Missing any one of them is the most common reason a Microsoft Defender for Endpoint rollout stalls halfway through.
- Operating systems: Windows 11 (22H2 or later) or Windows 10 21H2 or later, Windows Server 2019, 2022, or 2025, current and two-prior macOS releases, major Linux server distributions (RHEL, CentOS, Ubuntu, SLES, Debian, Oracle Linux, Amazon Linux), Android 8.0+, and iOS 14.0+.
- Admin role: Global Administrator or Security Administrator in Microsoft Entra ID to complete initial setup. You can hand off to narrower Security Operator or Security Reader roles once the platform is running.
- License: one seat per user or device on your chosen tier (see the comparison table below).
- Network access: outbound HTTPS access from endpoints to Microsoft’s Defender cloud service endpoints. No inbound firewall rules are required.
- Local tooling: PowerShell 5.1 or PowerShell 7.x on endpoints, the Microsoft Graph PowerShell SDK on an admin workstation if you’re scripting group creation, and a current browser (Edge or Chrome) for the Defender portal at security.microsoft.com.
- A decision on existing antivirus: know in advance whether Defender will run in passive mode next to a third-party product or fully replace it, since this changes how onboarding behaves.
- Time: roughly 75 minutes for a pilot group of 5 to 25 devices, following the 12 steps below.
Licensing is where most of the confusion starts, mainly because Microsoft sells Defender for Endpoint both standalone and bundled into larger suites. Here’s how the current tiers break down.
| Tier | Best for | Platforms | How it’s sold | Core capability |
|---|---|---|---|---|
| Microsoft Defender for Business | Small and mid-size businesses, up to 300 users | Windows, macOS, iOS, Android | Standalone or via Microsoft 365 Business Premium | Next-gen antivirus, simplified EDR, automated investigation |
| Defender for Endpoint Plan 1 | Larger orgs that want foundational protection | Windows, macOS, iOS, Android | Standalone or Microsoft 365 E3 add-on | Next-gen antivirus, attack surface reduction, manual response |
| Defender for Endpoint Plan 2 | Enterprises that want full EDR and XDR | Windows, macOS, Linux, Android, iOS | Standalone, Microsoft 365 E5, or E5 Security | Full EDR, automated investigation and response, threat and vulnerability management, live response |
| Microsoft 365 E5 / E5 Security | Enterprises standardizing on the Microsoft security stack | Same as Plan 2 | Suite bundle | Includes Defender for Endpoint Plan 2 plus Defender for Office 365, Identity, and Cloud Apps |
| Microsoft 365 Business Premium | SMBs that want device and Office security in one bundle | Windows, macOS, iOS, Android | Suite bundle | Includes Defender for Business |
Microsoft still doesn’t publish one universal standalone list price for Plan 1 and Plan 2 seats on its own site, since a lot of customers buy through volume licensing or a CSP partner where pricing varies. Independent pricing trackers have converged on real numbers, though: as of April 2026, CostBench tracks the two standalone tiers at $3.00 per user/month for Plan 1 and $5.20 per user/month for Plan 2, and EDRCost’s June 2026 update confirms that same $3.00/$5.20 split, noting Plan 1 covers next-gen antivirus and attack surface reduction only, with none of Plan 2’s full EDR feature set. APIs.io had Plan 1 at that same $3.00 per user/month as of August 2026. Treat those third-party figures as a budgeting reference point, not a quote, and confirm the current cost on Microsoft’s own Microsoft 365 pricing page before you commit a rollout budget.
One more prerequisite worth handling before Step 1: network connectivity. Defender for Endpoint needs outbound access to Microsoft’s cloud service, and if your organization routes traffic through a proxy or restrictive egress firewall, sensors can report as onboarded while still failing to send telemetry. Microsoft maintains a living list of required URLs and IP ranges in its environment configuration documentation, and a separate guide for proxy and internet connectivity settings if your devices don’t have direct internet access. Run through that checklist with whoever manages your firewall before Step 5, not after a device silently fails to check in.
Step 1-3: Choose Your License, Prepare Microsoft Entra ID, and Open the Defender Portal
Step 1: Pick the right license tier. Match your pick to the table above. If you’re a shop under 300 seats without dedicated security staff, Defender for Business usually covers what you need without the overhead of full XDR. If you already own Microsoft 365 E5 or E5 Security, you already have Plan 2 and don’t need to buy anything extra to follow this tutorial. E3 customers now have a middle option, too: as of February 1, 2026, Microsoft’s Product Terms added a standalone Defender for Endpoint Plan 2 add-on SKU for Microsoft 365 E3, as reported by licensing tracker SAMexpert, so you can get to full EDR without upgrading the whole tenant to E5. It’s also worth counting devices before you count seats: Microsoft confirms that, as of August 2026, each Defender for Endpoint license covers up to 5 devices per user, so a 25-device pilot may only need a handful of licensed users rather than 25 separate seats.
Step 2: Prepare Microsoft Entra ID groups and roles. Before you onboard a single device, create a dedicated device group for your pilot so you can apply policies to it without touching production machines. A dynamic group that automatically pulls in devices matching a naming pattern saves you from manually managing membership later.
RBAC Roles to Assign Before You Onboard Anything
Resist the urge to just make everyone on the IT team a Global Administrator. Assign Security Administrator only to whoever is running this setup, then move day-to-day staff to Security Operator (can manage alerts and incidents) or Security Reader (view-only, useful for auditors and managers). Since February 16, 2025, Microsoft has defaulted every new Defender for Endpoint tenant to a single unified RBAC model (URBAC), so on a tenant created after that date you’re already assigning these roles through the unified permissions system rather than the older, split role model. Scoping roles correctly now avoids a painful cleanup during your next compliance review.
# Connect to Microsoft Graph with the scopes needed for group and role management
Connect-MgGraph -Scopes "Group.ReadWrite.All","RoleManagement.ReadWrite.Directory"
# Create a dynamic device group for the pilot rollout
New-MgGroup -DisplayName "MDE-Pilot-Devices" `
-MailEnabled:$false `
-MailNickname "mdepilotdevices" `
-SecurityEnabled:$true `
-GroupTypes "DynamicMembership" `
-MembershipRule "(device.displayName -startsWith `"PILOT-`")" `
-MembershipRuleProcessingState "On"Step 3: Open the Microsoft Defender portal and run the setup wizard. Sign in at security.microsoft.com with your Security Administrator account. On first login, Microsoft walks you through a short setup wizard covering your tenant’s data storage location and preview features. Pick a data center region that matches your compliance requirements since this is not something you can change later without a support ticket, and decide whether to opt into preview features (useful for testing, riskier for a production tenant).
Step 4-6: Pick an Onboarding Method and Bring Your First Devices Online
Step 4: Choose an onboarding method. The Defender portal generates a different onboarding package depending on how you manage devices. Pick the one that matches your existing tooling instead of adding a new management layer just for this rollout.
Intune vs. Group Policy vs. Local Script vs. VDI
If you already manage endpoints with Microsoft Intune, onboard through an Endpoint Detection and Response profile under Endpoint security. It’s the least manual option and applies automatically to any device that later joins the target group. If you’re running traditional on-premises Active Directory without Intune, use the Group Policy option, which deploys the onboarding script as a startup script to machines in an OU. Local script is best for a small pilot or offline testing since you literally run one command on the machine. VDI environments get a separate onboarding package built for non-persistent images, so don’t reuse a standard script there or every session will look like a brand-new device.
Step 5: Onboard your first devices. Download the onboarding package for your chosen method from Settings > Endpoints > Onboarding in the Defender portal, then deploy it to your pilot group. For a local script test, just run the downloaded .cmd file as administrator on one machine first before pushing it wider.
Step 6: Confirm sensor health and onboarding status. Give it 5 to 10 minutes, then check that the sensor (internally called “Sense”) is actually running and that the device registered as onboarded. Keep an eye on sensor versioning too: Help Net Security reported that Microsoft began rolling out the KB5005292 EDR sensor update to Windows 10 endpoints in June 2026, so a device that looks stuck can sometimes just be mid-update rather than genuinely broken.
# Check whether the Defender for Endpoint sensor (Sense) is running
sc query sense
# Confirm onboarding state in the registry (1 = onboarded)
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" -Name OnboardingStateSample output on a correctly onboarded device:
SERVICE_NAME: sense
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
OnboardingState : 1
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection\StatusIf OnboardingState comes back as 0 or the property doesn’t exist yet, wait a few more minutes before troubleshooting. Cloud onboarding is not instant, and jumping straight to a reinstall is a common way people waste time on what’s really just a sync delay.
Step 7-8: Turn On Attack Surface Reduction Rules and Tamper Protection
Step 7: Turn on attack surface reduction (ASR) rules, in audit mode first. ASR rules block specific behaviors commonly abused by ransomware and other malware, like Office apps spawning child processes or scripts launching downloaded executables. Deploying straight to Block mode without testing is one of the fastest ways to break a legitimate business workflow, so start every rule in audit mode and review what would have been blocked before enforcing it.
# Put ASR rules in audit mode first so you can see what would be blocked
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions AuditMode
# After reviewing audit events (Event ID 1122 in Microsoft-Windows-Windows Defender/Operational),
# switch confirmed-safe rules from AuditMode to Enabled (Block)
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions EnabledThe rule ID above (3B576869-A4EC-4529-8536-B80A7769E899) blocks Office applications from creating executable content, one of the most commonly recommended starting rules according to Microsoft’s attack surface reduction documentation. Run it in audit mode for at least a week across your pilot group before enforcing it more broadly.
Step 8: Enable tamper protection and cloud-delivered protection. Tamper protection stops malware, and local admins, from disabling Defender’s real-time protection or changing its settings outside of approved management tools. Here’s the part that trips up almost every team the first time: once tamper protection is on, you can no longer change these settings through Group Policy, Configuration Manager, or local PowerShell cmdlets. Changes have to go through the Defender portal or Intune. That’s by design, not a bug.
# Maximize cloud-delivered protection and automatic sample submission
# (Tamper protection itself must be toggled from the Defender portal or Intune, not PowerShell)
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
# Confirm current state
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, DisableTamperProtectionTurn tamper protection on from the Defender portal under Settings > Endpoints > Advanced features, or push it tenant-wide through an Intune antivirus policy if you’re managing more than a handful of machines. While you’re in that policy, it’s worth knowing Microsoft Learn documented a Defender Antivirus update in May 2026 that added scheduled signature time control through Intune and Endpoint settings, so you can pin definition updates to a maintenance window instead of letting them land whenever the cloud happens to push them. That maintenance window is worth testing against real builds, too: Microsoft Learn’s release notes show the Windows antivirus platform climbed to version 4.18.26090.9, running detection engine 1.1.26090.9, in September 2026, so pinning a schedule also gives you a chance to validate a new platform build in a pilot ring before it reaches every endpoint.
Step 9-10: Turn On Automated Investigation and Baseline Vulnerability Management
Step 9: Turn on automated investigation and response (AIR). AIR is what lets Defender for Endpoint act on its own instead of waiting for an analyst to click “remediate” at 2 a.m. Set it to full automation for your pilot group under Settings > Endpoints > Advanced features, so confirmed malicious artifacts get remediated automatically rather than just queued for approval. According to Microsoft’s automated investigations documentation, this is also the setting responsible for a lot of the sub-3-minute disruption times Microsoft has published, since nothing here waits on a human being awake and at a keyboard. Computing reported that Microsoft pushed this further in July 2026, entering automatic endpoint isolation for compromised devices into preview, so a machine showing clear signs of compromise can be cut off from the network the moment AIR confirms it rather than waiting for a responder to isolate it manually.
If your organization is more cautious, you can start with semi-automated mode, where Defender flags recommended actions but waits for approval. Just don’t leave it there indefinitely. A queue of unapproved remediations sitting for days defeats the entire point of automated response.
Step 10: Baseline threat and vulnerability management. Once your pilot devices report in, open the Threat and Vulnerability Management dashboard and note your starting exposure score. This is a single number that rolls up missing patches, risky configurations, and software with known vulnerabilities across your onboarded devices, refreshed daily as reports linked in Microsoft’s threat protection reporting docs update. That reporting got easier to act on since February 2025, when aggregated reporting for Defender for Endpoint went generally available, rolling up exposure data across multiple endpoints into a single consolidated view instead of forcing you to dig through per-device reports one at a time. Microsoft kept building on that foundation into September 2026, when custom data collection entered public preview, letting admins pull in telemetry that goes beyond the platform’s default configuration instead of being limited to whatever Microsoft gathers out of the box. Don’t chase a perfect score on day one. Just record where you’re starting so you can prove improvement to whoever signs off on your security budget.
Review the top security recommendations tied to that score and assign an owner to each of the top five. Vulnerability management only works if someone is actually accountable for closing the gaps it finds, not just watching the number.
Step 11: Run a Safe Detection Test and Confirm Alerts Actually Fire
This is the step teams skip most often, and it’s the one that actually matters. A portal showing “onboarded” tells you a device is connected. It does not tell you that an alert will reach anyone when something bad happens. Use the EICAR test file, an industry-standard text string published by the European Institute for Computer Antivirus Research specifically so IT teams can safely confirm antivirus and EDR detection. It contains no malicious code and cannot harm a system, but every major antivirus engine, Defender included, is built to recognize and flag it as if it were a real threat.
# Download the industry-standard EICAR test file (not real malware) to confirm detection
Invoke-WebRequest -Uri "https://secure.eicar.org/eicar.com.txt" -OutFile "$env:TEMP\eicar-test.txt"
# Defender should quarantine the file within seconds if real-time protection is active
Get-MpThreatDetection | Select-Object -First 1Sample output on a healthy deployment:
ThreatName : Virus:DOS/EICAR_Test_File
SeverityID : 5 (Severe)
ActionSuccess : True
Resources : file:C:\Users\Public\AppData\Local\Temp\eicar-test.txtSwitch back to the Defender portal and confirm the matching alert shows up under Incidents & alerts within a minute or two, tagged with a severity and, ideally, a MITRE ATT&CK technique reference. If the file downloads fine but no alert appears, don’t move on to production devices yet. Work through the troubleshooting table further down first, since a silent failure here means every other step in this tutorial is protecting nothing.
You can find more detail on the test file itself, including download links for different scenarios, on EICAR’s official test file page.
Step 12: Configure Alerts, Notifications, and Live Response Access
Detection without notification just means you find out about a breach when you happen to check the portal. Under Settings > Endpoints > General > Email notifications, set up a rule that sends high and medium severity alerts to a distribution list your team actually monitors, not just one person’s inbox that goes unread during vacations.
Next, enable Live Response under Advanced features, and separately enable Live Response for Servers if your fleet includes any. Live Response gives authorized responders a remote shell into an affected device straight from the portal, useful for pulling a suspicious file or running an approved script without physically touching the machine. Access is controlled by the RBAC roles you set up back in Step 2, so double check that only the people who should be able to remote into a live incident actually can.
Finally, if you run a SIEM, whether that’s Microsoft Sentinel or a self-hosted platform like Wazuh, connect Defender for Endpoint’s alert stream to it now rather than after your first real incident. Alerts sitting only in the Defender portal are invisible to anyone correlating them against firewall, identity, or network logs elsewhere.
The Complete Working Project: A 25-Device Pilot Rollout Script
Here’s everything from Steps 2 through 9 combined into one reference script. Save it, adjust the group name and rule IDs for your environment, and run it section by section rather than all at once, since Step 3 (the portal setup wizard) and the Intune or Group Policy onboarding package from Step 4 still require manual, one-time actions outside PowerShell.
# --- Defender for Endpoint pilot rollout: reference script ---
# 1) Create the pilot device group (run once, from an admin workstation)
Connect-MgGraph -Scopes "Group.ReadWrite.All","RoleManagement.ReadWrite.Directory"
New-MgGroup -DisplayName "MDE-Pilot-Devices" `
-MailEnabled:$false -MailNickname "mdepilotdevices" -SecurityEnabled:$true `
-GroupTypes "DynamicMembership" `
-MembershipRule "(device.displayName -startsWith `"PILOT-`")" `
-MembershipRuleProcessingState "On"
# 2) After onboarding a device (Steps 3-5 happen in the Defender portal),
# confirm the sensor is healthy on that device
sc query sense
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" -Name OnboardingState
# 3) Put attack surface reduction rules in audit mode
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions AuditMode
# 4) Maximize cloud-delivered protection ahead of testing
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
# 5) Run the safe detection test
Invoke-WebRequest -Uri "https://secure.eicar.org/eicar.com.txt" -OutFile "$env:TEMP\eicar-test.txt"
Get-MpThreatDetection | Select-Object -First 1
# 6) After confirming the alert in the portal, move confirmed-safe ASR rules to enforced
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions EnabledRun this against a 5 to 25 device pilot group first. Once the exposure score is trending down, alerts are landing where they should, and nobody’s line-of-business app has broken, repeat the onboarding step (Step 5) against your broader device groups in waves, not all at once. A staged rollout is slower on paper but dramatically cheaper in help desk tickets.
5 Common Pitfalls That Break a Defender for Endpoint Rollout
- Enforcing ASR rules in Block mode on day one. Skipping the audit period is the single fastest way to break a line-of-business app and generate a wave of help desk tickets before lunch.
- Not knowing tamper protection blocks Group Policy and PowerShell by design. Teams burn hours debugging settings that “won’t stick,” not realizing Defender is intentionally rejecting changes made outside the portal or Intune.
- Onboarding devices before defining device groups or tags. Without groups in place first, applying different policies to servers, workstations, and pilot machines later means untangling a flat list of hundreds of devices.
- Running two active EDR or antivirus agents on the same machine. Defender needs to be explicitly set to passive mode when a third-party EDR is the primary agent, otherwise you get resource conflicts and, worse, blind spots where neither product has full visibility.
- Skipping the detection test in Step 11. Teams assume onboarding succeeded because the portal shows a green “onboarded” status, then never confirm an alert actually reaches a human being. That’s the gap that turns a real incident into a surprise.
- Leaving every IT staffer as Global Administrator. It’s convenient during setup and a liability during your next security audit. Scope roles down once the rollout stabilizes.
Troubleshooting: 8 Defender for Endpoint Setup Problems and Fixes
Most onboarding problems fall into a small set of repeat offenders. Work through this table before opening a support ticket.
| Problem | Likely cause | Fix |
|---|---|---|
| Device stuck on “Can be onboarded” for hours | Sensor service (Sense) not started, or blocked by a firewall or proxy | Run sc query sense, confirm outbound access to Microsoft’s Defender cloud endpoints, then re-run the onboarding script |
| Onboarding script runs with no errors, but the registry key never updates | A legacy antivirus or management client is still installed and conflicting | Uninstall the legacy client, reboot, then re-run the onboarding script |
| Tamper protection setting reverts every reboot | The change was attempted through Group Policy or local PowerShell, which tamper protection blocks by design | Change the setting only from the Defender portal or an Intune policy |
| An ASR rule blocks a legitimate line-of-business macro | The rule was deployed straight to Block instead of Audit | Redeploy in Audit mode, review Event ID 1122 in the Windows Defender operational log, add a targeted exclusion, then re-enable Block |
| Duplicate device entries appear after reimaging machines | The old sensor identity persisted through the imaging process | Exclude the Defender sensor state from your golden image, or run the official offboarding script before capturing a new image |
| New analyst gets “Access Denied” in the portal | Missing role assignment, or the account only has Security Reader instead of Security Operator | Assign the correct RBAC role scoped to the right device group |
| Live Response session won’t start on a server | Live Response for Servers is a separate toggle from the standard Live Response setting | Enable Live Response for Servers under Advanced features |
| EICAR test file never triggers an alert | Real-time protection is off, an exclusion covers the temp folder, or cloud-delivered protection is disabled | Confirm Get-MpComputerStatus shows RealTimeProtectionEnabled as True, remove conflicting exclusions, then re-run the test |
| Exposure score doesn’t move after remediation | The recommendation was marked complete, but affected devices haven’t checked in with their updated state yet | Force a policy sync on affected devices or wait for the next daily threat and vulnerability management data refresh |
If none of these match what you’re seeing, Microsoft’s own troubleshooting flow inside the portal (Settings > Endpoints > Device health) will usually flag the specific onboarding step that failed, which is faster than guessing from the outside.
Advanced Tips: Hardening Your Deployment Beyond the Defaults
Getting onboarded and passing the EICAR test is the floor, not the ceiling. Once your pilot is stable, these are the moves that separate a checkbox EDR setup from real Windows endpoint security hardening.
- Tier your ASR rule rollout by device group. Move from pilot, to early adopters, to the full fleet in stages instead of one big-bang enforcement. Each stage should run in audit mode for at least a few days before you flip it to Block.
- Track exposure score and secure score weekly, not just at setup. A number you check once during onboarding and never again isn’t a metric, it’s a screenshot for a slide deck. Assign an owner to your top five recommendations and review progress on a recurring basis.
- Forward alerts into a SIEM you already run. Whether that’s Microsoft Sentinel or a self-hosted platform, correlating Defender for Endpoint alerts against network and identity logs catches attack chains that look unremarkable from the endpoint alone.
- Use device tags to separate servers, workstations, and unmanaged or BYOD devices. This keeps a policy change meant for laptops from accidentally hitting a production server.
- Schedule a recurring attack simulation, not just the one-time test in this guide. The Defender portal includes built-in simulation scenarios under Tutorials & simulations. Run one quarterly so new hires and new devices get tested the same way your pilot group did.
- Review and prune antivirus and ASR exclusions every quarter. Stale exclusions added to fix a one-off compatibility issue two years ago are one of the most common ways real ransomware slips past an otherwise well-configured EDR.
Microsoft Defender for Endpoint vs Other EDR Tools: A Quick Comparison
Defender for Endpoint isn’t the only EDR platform worth knowing about, and it won’t fit every environment. Here’s how it stacks up against other established options at a structural level.
| Platform | Vendor | Deployment model | Standout strength | Notable recognition |
|---|---|---|---|---|
| Microsoft Defender for Endpoint | Microsoft | Built into Windows, managed via security.microsoft.com | Native OS integration, no separate agent needed on Windows | Named a Leader, 2025 Gartner Magic Quadrant for Endpoint Protection Platforms |
| CrowdStrike Falcon | CrowdStrike | Lightweight cloud-native agent | Deep threat-hunting and identity-protection add-ons | Long-running Gartner EPP Leader |
| SentinelOne Singularity | SentinelOne | Autonomous agent with on-device AI | Automated rollback of ransomware-encrypted files | Regular participant in independent MITRE ATT&CK evaluations |
| Palo Alto Cortex XDR | Palo Alto Networks | Agent plus network and firewall telemetry correlation | Strong network-to-endpoint correlation for hybrid environments | Broad integration across Palo Alto’s wider XDR and SASE platform |
| Sophos Intercept X | Sophos | Agent with an optional managed detection and response service | Built-in MDR staffing option for teams without a 24/7 SOC | Long-standing endpoint protection vendor with a managed service tier |
If you’re specifically weighing Defender against CrowdStrike and SentinelOne on pricing and MITRE evaluation results, our dedicated CrowdStrike vs Defender vs SentinelOne comparison goes deeper on the numbers than this tutorial has room for. The short version for most Windows-heavy shops: if you’re already paying for Microsoft 365 E5, Defender for Endpoint is close to free to turn on, which is a hard value proposition for a third-party agent to beat even when it wins on a specific benchmark. That value math only improved through 2026, since the same E5 licensing underpins Microsoft Purview’s Endpoint Data Loss Prevention, which Microsoft extended to Arm64 devices by August 2026, paired that same month with sturdier OCR-based image classification for DLP that Microsoft says cuts down on failed scans, and added file-origin tracking so DLP alerts can trace a sensitive file back to the specific process or website that produced it.
How to Tell Whether the Rollout Actually Worked
A finished setup and a working one are not the same thing. Before you call this project done, check these numbers at the 30-day and 90-day marks and report them to whoever signed off on the license spend.
- Percentage of devices reporting healthy sensor status. Anything under 95% in the Device health section means part of your fleet is running blind, license paid for or not.
- Exposure score trend, not just the current number. A score that’s flat or climbing after 30 days means your top recommendations from Step 10 aren’t getting fixed, regardless of what the initial baseline looked like.
- Mean time to acknowledge an alert. Automated investigation and response handles a lot on its own, but someone still needs to review what it did. If alerts sit unacknowledged for days, the notification routing from Step 12 needs another look.
- Number of ASR audit events reviewed versus ignored. Audit mode is only useful if a human is reading the results before rules move to Block. A growing backlog of unreviewed audit events is a sign the rollout is being treated as finished when it isn’t.
- How long it’s been since your last detection test. The EICAR test from Step 11 isn’t a one-time checkbox. Re-run it, or a full attack simulation from the Advanced Tips section, after any change to onboarding tooling, network topology, or third-party security software.
None of these require a dashboard you have to build yourself. They’re all visible in the Defender portal’s existing reports, which is arguably the platform’s biggest advantage over cobbling together the same visibility from five different tools. If you’re still gathering these numbers manually every month, that’s usually a sign it’s time to route Defender for Endpoint’s data into whatever SIEM or reporting stack the rest of your security stack already feeds.
Frequently Asked Questions
Is Microsoft Defender for Endpoint free?
No. The free Microsoft Defender Antivirus that ships with every copy of Windows handles baseline signature and behavior-based protection. Microsoft Defender for Endpoint is the paid EDR and XDR layer on top of it, licensed through Plan 1, Plan 2, Defender for Business, or bundled into Microsoft 365 E5 and E5 Security. Check Microsoft’s current Microsoft 365 pricing page for exact cost, since standalone pricing isn’t always published and varies by licensing channel.
What’s the difference between Defender Antivirus and Defender for Endpoint?
Defender Antivirus is the built-in engine every Windows device already has. Defender for Endpoint adds the cloud console, attack surface reduction rules, automated investigation and response, threat and vulnerability management, and live response on top of it. Antivirus is a component, Defender for Endpoint is the management and detection layer wrapped around it.
Can it protect macOS and Linux devices, not just Windows?
Yes. As of Microsoft’s mid-2026 documentation, Defender for Endpoint covers Windows, macOS, Linux, Android, and iOS from the same portal, so a mixed fleet doesn’t need a separate console for non-Windows machines. Linux coverage kept expanding too: Microsoft announced Linux workstation protection in public preview on October 14, 2026, extending beyond the server distributions that were already supported, and Microsoft documents Linux version 30.126032.0000.0 as released in October 2026, while in August 2026 Microsoft made the eBPF sensor the default supplementary event provider on Linux, its documented path toward better kernel-level visibility on that platform. One date worth flagging if you run older cloud infrastructure: Microsoft will retire Defender support for Amazon Linux 2 on ARM64 on October 31, 2026, with version 101.25122.0004 as the final supported release, so any pilot device on that specific combination needs a migration plan before then. Microsoft also upgraded the Linux Defender client to libcurl 8.22.0 in October 2026 to address CVE-2026-9546, which is one more reason to keep Linux agents on current builds.
How long does a rollout really take for a small business?
A pilot group of 5 to 25 devices following the 12 steps in this tutorial takes about 75 minutes of hands-on time. Rolling out across an entire mid-size fleet, with a proper audit period for ASR rules, usually stretches over 2 to 4 weeks so you catch application compatibility issues before enforcing Block mode everywhere.
Does turning this on replace the need for a SIEM?
No. Defender for Endpoint detects and responds at the endpoint. Most teams still forward its alerts into a SIEM, whether that’s Microsoft Sentinel or a self-hosted option, for longer retention, correlation with network and identity logs, and compliance reporting.
What happens if a device already has third-party antivirus installed?
Defender for Endpoint automatically drops into passive mode alongside most third-party antivirus products, still feeding EDR telemetry to the portal without duplicating real-time scanning. You can also fully replace the third-party product and run Defender as the primary antivirus. Decide which model fits before onboarding so you’re not troubleshooting conflicts afterward.
Is the EICAR test file safe to run in production?
Yes. EICAR is not malware. It’s a standard text string published by the European Institute for Computer Antivirus Research specifically so IT teams can confirm antivirus and EDR detection without touching real malicious code. Every major antivirus engine, Defender included, is built to recognize it.
Do I need Microsoft Sentinel to get value from Defender for Endpoint?
No. Defender for Endpoint is fully functional as a standalone EDR through its own portal. Sentinel, or another SIEM, is an optional add-on for teams that want centralized log retention and correlation across more than just endpoints.
Does onboarding Linux and macOS devices work the same way as Windows?
The concept is identical, but the mechanics differ. Linux servers are onboarded through a package manager script rather than the Windows onboarding executable, and macOS devices typically go through Intune, JAMF, or a shell script rather than Group Policy. Check Microsoft’s Linux onboarding documentation and macOS platform updates before assuming a Windows-focused runbook will translate directly. macOS admins in particular should know Microsoft moved offline security-intelligence updates into preview back in August 2025, which matters for any Mac that’s air-gapped or otherwise can’t reach the cloud directly, since it can still pull refreshed threat definitions without a live internet connection.
Will enabling attack surface reduction rules slow down every machine?
Not noticeably for most rules. ASR works by blocking specific risky behaviors, like Office spawning a shell process, rather than scanning every file continuously. The performance cost that actually annoys users almost always comes from an overly broad rule shipped straight to Block mode without an audit period, not from the feature itself. That’s the whole reason Step 7 has you test in audit mode first.
For more ransomware and endpoint security coverage, browse the full cybersecurity section on Tech Insider.
