defender-for-endpoint

name	defender-for-endpoint
description	Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation and remediation (AIR), and live response. Covers Plan 1 vs Plan 2 selection, onboarding paths (Intune, Configuration Manager, GPO, scripts), ASR rule rollout in audit→block, EDR in block mode, tamper protection, device groups and RBAC, and response actions (isolate, restrict, live response). WHEN: Defender for Endpoint, MDE, MDE onboarding, endpoint EDR, attack surface reduction rules, ASR rules audit mode, next-gen antivirus policy, device isolation, endpoint vulnerability management, EDR block mode, tamper protection, onboard devices to Defender, live response, MDE Plan 1 vs Plan 2, security settings management, MDE for Linux, MDE for macOS, controlled folder access. DO NOT USE for non-endpoint Defender workloads (use defender-xdr for cross-workload, defender-for-cloud-hardening for Azure resources).
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0"}

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint (MDE) is the enterprise endpoint security platform providing prevention (next-gen AV, ASR), detection and response (EDR), threat & vulnerability management (Defender Vulnerability Management), and automated investigation and remediation (AIR). It feeds the endpoint pillar of Defender XDR.

When to use

Protecting Windows, macOS, Linux, iOS, and Android endpoints. This is the right skill for onboarding decisions, policy design, ASR rollout, EDR tuning, and response action scoping.

Do not use this skill for cross-workload investigation (defender-xdr), Azure resource hardening (defender-for-cloud-hardening), or identity-side detection (defender-for-identity).

Pick the plan and the onboarding path

If you need...	Plan / SKU	Notes
Next-gen AV, ASR, web/network protection, manual response	MDE Plan 1	Bundled with M365 E3 since 2022
EDR, AIR, advanced hunting, custom detections, Threat & Vuln Management	MDE Plan 2	Bundled with M365 E5 / MDE P2
Full vulnerability remediation workflows, browser extension assessments	Defender Vulnerability Management add-on	Adds to P2
Server endpoints (Windows / Linux)	MDE for Servers via Defender for Cloud	Per-server billing, includes MDE P2

Estate	Preferred onboarding path
Cloud-managed Windows (Intune-managed)	Intune + Security Settings Management
Co-managed (MECM + Intune)	Configuration Manager workload slider, then move to Intune
AD-joined only, no MDM	GPO onboarding script
Server (Windows/Linux)	Defender for Cloud auto-provisioning
macOS / Linux workstations	Intune with MDM enrollment
Air-gapped / one-off	Local script (90-day expiry)

Rule of thumb: if a device exists in Intune, onboard via Intune Security Settings Management - one place to manage AV + ASR + EDR. GPO is the legacy fallback, not the default for new builds.

Approach

1. Confirm plan + estate inventory — Inventory devices by OS, management state, and current AV. Map to plan/onboarding path table above. Verify: Get-MpComputerStatus on a sample Win11 device shows AMServiceEnabled = True; Intune shows the device as compliant.

2. Enable tamper protection everywhere first — Before any other policy. Without it, attackers (and well-meaning admins) can disable everything else. Verify: device shows tamper protection On in security.microsoft.com → Settings → Endpoints → Advanced features.

3. Onboard in waves — 100 pilot devices for 7 days, then a representative wave (1,000 or 10% of estate), then the rest. Watch the Device inventory for stuck devices (Last seen

   24h after onboarding). Verify: device count in MDE matches Intune device count within 5%.

4. Next-gen AV policy — Real-time protection on, cloud-delivered protection on (High block level for high-risk groups), PUA blocking in audit then block, tamper protection on, network protection in block, controlled folder access in audit (then block on user workstations only - servers break). Verify: Defender configuration management report shows green on these toggles for the pilot group.

5. ASR rules - audit, measure, block — Enable all rules in audit for 14 days. Use the ASR rules report to see which rules would have blocked what. Move noisy rules to a tighter scope (e.g. exclude line-of-business apps), then block the rest. Verify: ASR rules report shows zero blocks for known-good apps in audit; promote to block one rule per week.

6. EDR in block mode — Enable even if Defender AV is primary. If a non-Microsoft AV is primary, EDR in block mode is mandatory - it's the only way EDR detections result in automatic remediation. Verify: Device health page shows EDR block mode = On.

7. Device groups & RBAC — Build device groups by risk tier (workstation, server, tier-0 admin workstation, kiosk). Scope response actions (isolate, live response) per group. Tier-0 admin devices = tightest policy, fewest analysts with response rights.

8. Vulnerability management — Prioritise by exposure score + threat insight, not raw CVE count. Push remediation tasks to Intune via the integration.

9. AIR — Configure remediation level per device group. Workstations = Full, servers = Semi (require analyst approval). Review pending actions in the Action Center daily.

Guardrails

• Tamper protection before anything else. Without it, every other control is a suggestion.
• Always pilot ASR rules in audit mode. Some rules (e.g. Block Office from creating child processes) break legitimate macro workflows. 14 days minimum in audit.
• EDR in block mode is mandatory with third-party AV. Without it, EDR alerts fire but no automatic remediation happens.
• Don't grant Live Response broadly. It executes arbitrary commands on endpoints. Scope via RBAC to a small response team, audit every session.
• Device groups drive policy and response. Build them by risk tier, not by department.
• Don't run dual AV with both active. Either Defender is primary (recommended) or set Defender to passive mode + EDR block mode on.
• Server onboarding flows through Defender for Cloud. Don't dual-onboard servers via both MDE direct and DfC - causes telemetry duplication.

Common anti-patterns

• "Tamper protection off because admins need to manage AV locally" - Local management is the threat model. Centralise via Intune; tamper protection on.
• "All ASR rules to block on day one" - Will break Office macros, legitimate scripts, and installers. Audit 14 days, tune, then block.
• "We use third-party AV and skipped EDR block mode" - Detections fire but nothing happens. Enable EDR block mode.
• "Live Response for all SOC analysts" - Live Response = remote shell. Tier-3 only, with audit review.
• "Onboarded servers via Intune script instead of Defender for Cloud" - Loses Defender for Servers billing/management integration. Always DfC for server onboarding.
• "Vuln management ranked by CVE count" - 5,000 informational CVEs hide the 3 exploited ones. Sort by exposure score + active threat campaigns.
• "Controlled folder access on servers" - Breaks application file writes. CFA is for user workstations only.

Example prompts

• Plan MDE Plan 1 vs Plan 2 for a 10,000-user M365 E3 tenant - what do we lose without P2?
• Onboard 5,000 Intune-managed Windows 11 devices to MDE with security settings management.
• Roll out ASR rules safely - audit first, then block. Which rules are safe to block immediately?
• Enable EDR in block mode with CrowdStrike as primary AV.
• Design MDE device groups for a 3-tier estate: workstations, servers, tier-0 admin devices.
• Configure AIR remediation levels - workstations vs servers.
• Prioritise vulnerability remediation using exposure score and threat insight.
• Scope Live Response to a 5-person response team with audit logging.

Microsoft Learn

• Overview: https://learn.microsoft.com/defender-endpoint/microsoft-defender-endpoint
• MDE Plan 1 overview: https://learn.microsoft.com/defender-endpoint/defender-endpoint-plan-1
• Onboarding: https://learn.microsoft.com/defender-endpoint/onboarding
• ASR rules: https://learn.microsoft.com/defender-endpoint/attack-surface-reduction
• ASR rules reference: https://learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-reference
• EDR in block mode: https://learn.microsoft.com/defender-endpoint/edr-in-block-mode
• Tamper protection: https://learn.microsoft.com/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection
• Device groups: https://learn.microsoft.com/defender-endpoint/machine-groups
• Vulnerability management: https://learn.microsoft.com/defender-vulnerability-management/defender-vulnerability-management
• Live response: https://learn.microsoft.com/defender-endpoint/live-response