Defender For Endpoint

Defender for Endpoint (EDR) Onboarding

CMMC Control Mapping Matrix

NIST 800-171 Control Mapping

Because EDR onboarding is tied directly to your specific tenant's Microsoft Graph connector, it cannot be imported via an OIB JSON file. It must be created manually.

Step 1: Enable the Connection in Defender

1. Open a new tab and log in to your Microsoft Defender portal (security.microsoft.us).
2. Open System > Settings. The Settings page is a hub; select the Endpoints row.
3. In the Endpoints navigation, choose General > Optional features. Microsoft's documentation still calls this page Advanced features, and older tenants may still show that label; it is the same page.
4. Scroll down the list of features until you find Microsoft Intune connection.
5. Toggle this setting to On.
6. Click Save preferences at the bottom of the page.

1. Open a new tab and log in to your Microsoft Defender portal (security.microsoft.com).
2. Open System > Settings. The Settings page is a hub; select the Endpoints row.
3. In the Endpoints navigation, choose General > Optional features. Microsoft's documentation still calls this page Advanced features, and older tenants may still show that label; it is the same page.
4. Scroll down the list of features until you find Microsoft Intune connection.
5. Toggle this setting to On.
6. Click Save preferences at the bottom of the page.

Step 2: Enable the Connection in Intune

1. Return to the Intune tab (Endpoint security > Microsoft Defender for Endpoint).
2. Click the Refresh button at the top of the page. The connection status should change from Unavailable to Available or Enabled.
3. The blue information banner and the grayed-out settings will disappear, revealing the connector toggles.
4. Under MDM Compliance Policy Settings, turn on: Connect Windows devices version 10.0.15063 and above to Microsoft Defender for Endpoint.
5. (Optional but Recommended): Turn on Block unsupported OS versions if it is an option.
6. Click Save at the top.

Step 3: Create the EDR Policy in Intune

1. Log in to the Intune Admin Center.
2. Navigate to Endpoint Security > Endpoint detection and response.
3. Click Create policy.
4. Select Platform: Windows 10, Windows 11, and Windows Server.
5. Select Profile: Endpoint detection and response, then click Create.
6. Name the profile Win - Custom - ES - Defender for Endpoint Onboarding.
7. In the Configuration settings step, configure the following:
   • Microsoft Defender for Endpoint client configuration package type: Select Auto from connector (labeled Onboard from connector in some UI versions). This lets Intune pull the onboarding blob directly from the MDE–Intune connector enabled in Steps 1 and 2, so the package stays current if Microsoft rotates the onboarding payload. Pick plain Onboard only if the connector is unavailable, and if so, fix the connector first rather than pasting a manual blob that will drift out of date.
   • Sample Sharing: Select None (Recommended for CMMC to prevent inadvertent CUI leakage to Microsoft).
   • [Deprecated] Telemetry Reporting Frequency: Leave as Not configured (Crucial for GCC High to prevent constant error states).
8. Click Review + save and assign to your deployment rings.

1. Log in to the Intune Admin Center.
2. Navigate to Endpoint Security > Endpoint detection and response.
3. Click Create policy.
4. Select Platform: Windows 10, Windows 11, and Windows Server.
5. Select Profile: Endpoint detection and response, then click Create.
6. Name the profile Win - Custom - ES - Defender for Endpoint Onboarding.
7. In the Configuration settings step, configure the following:
   • Microsoft Defender for Endpoint client configuration package type: Select Auto from connector (labeled Onboard from connector in some UI versions). This lets Intune pull the onboarding blob directly from the MDE–Intune connector enabled in Steps 1 and 2, so the package stays current if Microsoft rotates the onboarding payload. Pick plain Onboard only if the connector is unavailable, and if so, fix the connector first rather than pasting a manual blob that will drift out of date.
   • Sample Sharing: Select None (Recommended for sensitive-data tenants to prevent inadvertent data leakage to Microsoft).
   • [Deprecated] Telemetry Reporting Frequency: Leave as Not configured (avoids persistent error states).
8. Click Review + save and assign to your deployment rings.