Device Health Attestation & Defender Sensor Onboarding

Configure TPM-based Device Health Attestation (DHA), integrate Microsoft Defender for Endpoint with Intune, and enforce machine-risk compliance baselines.

Tags:#Health Attestation#Defender for Endpoint#DHA#Risk Score#Zero Trust#MD-102

Overview

Device Health Attestation (DHA) utilizes hardware-backed TPM measurements taken during the Windows Measured Boot process to cryptographically prove that security features (Secure Boot, BitLocker, Early Launch Anti-Malware [ELAM], and Virtualization-Based Security [VBS]) are active and uncompromised.

When coupled with Microsoft Defender for Endpoint (MDE), Intune evaluates real-time Machine Risk Scores (Clear, Low, Medium, High). If Defender detects malware or active credential theft, Intune instantly flips the device compliance state to Non-compliant, triggering Conditional Access to quarantine the machine.

---

When to Use

Scenario	Recommendation	Technical Rationale
Real-Time Zero Trust Quarantine	Mandatory	Instantly cut off access to Microsoft 365 when active ransomware or malware is detected.
Tamper-Proof Boot Verification	Highly Recommended	Uses hardware TPM chips to prevent rootkits from spoofing security status to Intune.

---

Prerequisites

Licenses: Microsoft Defender for Endpoint Plan 2 or Microsoft 365 E5 / E5 Security.
Hardware: Endpoints must have TPM 2.0 enabled and support UEFI Secure Boot.
Service-to-Service Connector: Intune and Defender for Endpoint connection toggled On.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
    └── Microsoft Defender for Endpoint
        └── Connect Windows devices to Microsoft Defender for Endpoint (Toggle: On)

---

Step-by-Step Implementation

Step 1: Enable the Service Connector

Go to Intune Admin Center > Endpoint security > Microsoft Defender for Endpoint.
Set Connect Windows devices to Microsoft Defender for Endpoint: On.
Set Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations: On.

Step 2: Deploy Defender Onboarding Profile

Navigate to Endpoint security > Endpoint detection and response (EDR) > Create Policy.
Platform: Windows 10, Windows 11, and Windows Server | Profile: Endpoint detection and response.
Set Auto Populate Onboarding Blob: Yes (Intune pulls package directly from Defender portal).
Set Sample Sharing: All | Set Frequency of telemetry reporting: Normal.
Assign to: All Devices.

Step 3: Enforce Defender Machine Risk Score in Compliance Policy

Navigate to Devices > Compliance > Policies > Edit Windows Compliance Policy.
Go to Microsoft Defender for Endpoint section:

Require the device to be at or under the machine risk score: Clear (or Low).

If an endpoint reaches Medium or High risk score, Intune marks it Non-compliant immediately.

---

PowerShell Commands

Verify Defender for Endpoint Service & Sense Engine Locally:

PowerShell

# Verify Sense service (Defender for Endpoint EDR engine) is running
Get-Service -Name "Sense" | Select-Object Name, Status, StartType

# Check Defender health and signature versions
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, FullScanAge, QuickScanAge

Trigger EDR Test Detection to Confirm Sensor Reporting:

PowerShell

# Microsoft official safe EDR detection script
powershell.exe -NoExit -ExecutionPolicy Bypass -Command "& {$TestCmd = 'C:\TestFolder\test.exe'; New-Item -ItemType File -Force -Path $TestCmd; Start-Process -FilePath $TestCmd}"

---

Troubleshooting Matrix

Error / Symptom	Root Cause	Exact Resolution
Sense Service Stopped	Onboarding package was not deployed, or licensing expired.	Check `C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp`. Re-deploy EDR onboarding profile.
Risk Score Not Syncing	The service-to-service connector between Defender Security Center and Intune is disconnected.	Open Microsoft Defender Security Center (`security.microsoft.com`) > Settings > Endpoints > Advanced features > Ensure Microsoft Intune connection is toggled On.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Traps:

Risk Score Thresholds: In compliance policies, the 4 risk levels are Clear, Low, Medium, and High. Selecting Clear provides the strictest security.
Auto-Populate Onboarding Blob: In modern Intune, administrators do not manually extract and upload the .onboarding script; toggling Auto Populate handles client deployment automatically.

PREVIOUS TOPIC2.2 Conditional Access: Require Compliant Device NEXT TOPIC2.4 Device Identity: Entra Joined vs Hybrid vs Registered