3.4MD-102Advanced
Est: ~15 mins•Verified: 2026-08

Defender for Endpoint: Intune EDR Onboarding

Zero-touch onboarding of Windows 10 & 11 endpoints to Microsoft Defender for Endpoint (MDE) using Intune Endpoint Detection and Response (EDR) policies and Tamper Protection.

Tags:#Defender for Endpoint#MDE#EDR#Security#Tamper Protection#MD-102
01

Overview

Microsoft Defender for Endpoint (MDE) is Microsoft's enterprise endpoint security platform providing behavioral cyber threat detection, automated investigation, vulnerability management, and incident response.

Integrating MDE with Microsoft Intune replaces manual script execution and GPO onboarding packages with cloud-native deployment:

  1. Service-to-Service Connector: Intune communicates directly with the Microsoft Defender XDR security portal (security.microsoft.com).
  2. Endpoint Detection and Response (EDR) Policy: Intune distributes the tenant-specific telemetry onboarding package silently via the built-in Windows MDM channel.
  3. OS-Level Sense Engine: The Windows kernel telemetry sensor service (Sense) starts automatically, connects to Defender cloud endpoints, and initiates continuous behavioral reporting.
  4. Device Risk Score Integration: MDE shares endpoint risk level (Low, Medium, High) back to Intune to dynamically evaluate device compliance and block compromised devices via Conditional Access.

---

02

When to Use

CapabilityRecommended ConfigurationPurpose
All Corporate Endpoints (Win 10/11)EDR Policy (Auto Onboard)Silent background onboarding without running .cmd packages or third-party agents.
Tamper ProtectionMandatory Enabled (Cloud Managed)Prevents malware or local rogue administrators from disabling antivirus/EDR services.
Device Compliance IntegrationMachine Risk Score <= Clear/LowQuarantines compromised machines from Microsoft 365 until SOC remediation.
Sample SharingAll / Safe SamplesUploads unknown suspicious binaries to Microsoft cloud sandbox for deep detonation.

---

03

Prerequisites

Tenant & Licensing Requirements:

  • Defender for Endpoint License: Microsoft 365 E5, E5 Security, Windows Enterprise E5, or MDE Plan 2.
  • Service Connector Enabled: Intune Admin Center > Endpoint security > Microsoft Defender for Endpoint > Set connection status to Available.
  • Admin Roles: Security Administrator and Intune Administrator.

Endpoint Requirements:

  • Windows 11 or Windows 10 (1709+).
  • Outbound HTTPS (443) access to:
  • *.endpoint.security.microsoft.com
  • *.events.data.microsoft.com
  • *.blob.core.windows.net

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
    ├── Microsoft Defender for Endpoint (Tenant connector)
    └── Endpoint detection and response
        └── Create Policy > Windows 10, Windows 11, and Windows Server
            └── Profile: Endpoint detection and response

---

05

Step-by-Step Implementation

Step 1: Enable the Intune-to-Defender Service Connection

  1. Navigate to Intune Admin Center > Endpoint security > Microsoft Defender for Endpoint.
  2. Under Endpoint Security Evaluation settings:
  • Set Connect Windows devices to Microsoft Defender for Endpoint: On.
  • Set Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations: On.
  1. Open Microsoft Defender XDR Portal (security.microsoft.com) > Settings > Endpoints > Advanced features:
  • Enable Microsoft Intune connection: On.
  • Enable Tamper protection: On.

Step 2: Create Intune EDR Onboarding Policy

  1. Go to Endpoint security > Endpoint detection and response > Create Policy.
  2. Platform: Windows 10, Windows 11, and Windows Server | Profile: Endpoint detection and response.
  3. Configure settings:
  • Auto populate onboarding blob: Auto populate from connector (no manual file import required).
  • Sample sharing for all files: Yes.
  • Telemetry reporting frequency: Normal (or Expedite for high-security environments).
  1. Assignments: Assign to All Corporate Windows Devices.

Step 3: Configure Device Compliance Risk Rule

  1. Go to Devices > Compliance > Create Policy > Windows 10 and later.
  2. Under Device Health:
  • Set Require the device to be at or under the machine risk score: Clear (or Low).
  1. If an endpoint encounters ransomware or an active breach, MDE flags the device risk as High, Intune marks it Non-Compliant, and Conditional Access cuts access to corporate emails and files immediately.

---

06

PowerShell Automation

Verify MDE Sense Service Status Locally on Endpoint:

PowerShell
# Check state of Windows Defender Advanced Threat Protection Service (Sense)
Get-Service -Name "Sense" | Select-Object Name, DisplayName, Status, StartType

# Query onboarding registry status
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" |
    Select-Object OnboardingState, OrgId

(OnboardingState 1 indicates fully onboarded).

Run Official Microsoft Defender for Endpoint Detection Test:

PowerShell
# Triggers a benign simulation alert to verify end-to-end cloud pipeline
# Run in elevated Command Prompt (cmd.exe)
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-WDATP-test\\invoice.exe');Start-Process 'C:\\test-WDATP-test\\invoice.exe'

Within 5 minutes, an active alert named "Suspicious file created" should appear in security.microsoft.com.

---

07

Microsoft Graph Automation

Check Tenant MDE Onboarding Settings via Graph:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"

# Inspect Microsoft Defender for Endpoint connector settings
Get-MgDeviceManagementWindowsDefenderAtpStatus | 
    Select-Object lastConnectionDateTime, state, windows10EnterpriseEditionHealth, isConfigurationSettingsEnforced

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/6 (0%)
Microsoft Defender connector status displays Available with green status in Intune.
Endpoint Sense service is in Running status with Automatic startup type.
Registry key HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status has OnboardingState = 1.
Device appears in the Device Inventory at security.microsoft.com.
Tamper Protection toggle is locked and cannot be disabled locally via PowerShell or Registry.
Test detection alert successfully generates an incident in Microsoft Defender XDR.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
Sense Operational Event LogApplications and Services Logs > Microsoft > Windows > SENSE > OperationalLogs cloud connection failures, telemetry buffering, and certificate validation.
MDE Client Analyzer ToolMDEClientAnalyzer.cmd (Downloadable diagnostic utility)Deep diagnostic script validating URLs, proxy settings, certificates, and OS prerequisites.
Windows Defender OperationalMicrosoft-Windows-Windows Defender/OperationalLogs real-time AV protection events, signature updates, and blocked threats.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Event ID 5: Cloud handshake failedEndpoint cannot reach Microsoft cloud telemetry URLs due to SSL inspection or proxy.Bypass SSL inspection/decryption for *.endpoint.security.microsoft.com on corporate proxy/firewall.
Sense service stops immediatelyMachine is running non-supported OS edition (Windows Home edition does not support MDE).Upgrade endpoint to Windows 10/11 Pro, Enterprise, or Education.
OnboardingState = 0The EDR profile has not synced from Intune or has failed to apply.Run Sync in Company Portal. Check Device Configuration profile status in Intune console.
Tamper Protection Disabled LocallyTenant-level tamper protection is not toggled, or device is managed by conflicting GPO.Ensure Tamper Protection is enabled in Defender Security portal and no legacy GPO disables it.

---

11

Production Best Practices

Production Best Practice

Enable Automated Investigation and Remediation (AIR):

In Defender portal settings, set your device groups remediation level to Full - remediate threats automatically. This allows MDE to quarantine malware and kill malicious processes without waiting for manual SOC approval.

Security Caution

Never Intercept MDE TLS Traffic:

Microsoft Defender telemetry relies on mutual TLS authentication and certificate pinning. Deep packet inspection (SSL Decryption) by firewalls (Palo Alto, Fortinet, Zscaler) will break the Sense engine connection.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Automated Onboarding: When creating an EDR policy in Intune, you do not need to upload the manual onboarding package file; select Auto populate from connector.
  2. Tamper Protection Priority: Tamper Protection overrides local registry keys and Group Policies that attempt to disable real-time protection.
  3. Machine Risk Score: The machine risk score is calculated in MDE and ingested by Intune Compliance Policies, which then trigger Conditional Access.

---

13

Official Documentation

PREVIOUS TOPIC3.3 Attack Surface Reduction (ASR) Rules & Exploit ProtectionNEXT TOPIC3.5 Windows Firewall & Network Protection via Intune