Onboard devices to Microsoft Defender for Endpoint
- Go to the Microsoft 365 Defender portal (https://security.microsoft.com) and sign in.
- Choose Settings > Endpoints > Onboarding (under Device management).
- In the Select operating system to start onboarding process list, select an operating system.
- Under Deployment method, select an option. Follow the links and prompts to onboard your organization’s devices. Need help? See Onboarding methods (in this article).
Note
If something goes wrong while onboarding, see Troubleshoot Microsoft Defender for Endpoint onboarding issues. That article describes how to resolve onboarding issues and common errors on endpoints.
Onboarding methods
Important
If you are using Microsoft Defender for Cloud, see Integration with Microsoft Defender for Cloud.
Deployment methods vary, depending on operating system and preferred methods. The following table lists resources to help you onboard to Defender for Endpoint:
| Operating systems | Methods |
|---|---|
| Windows 10 or later
Windows Server 2019 or later Windows Server, version 1803 or later Windows Server 2012 R2 and 2016[1] |
Local script (up to 10 devices)
Microsoft Endpoint Configuration Manager Microsoft Endpoint Manager/ Mobile Device Management (Intune) NOTE: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. |
| Windows Server 2008 R2 SP1 | Microsoft Monitoring Agent (MMA) or Microsoft Defender for Cloud
NOTE: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see Log Analytics agent overview. |
| Windows 8.1 Enterprise
Windows 8.1 Pro Windows 7 SP1 Pro Windows 7 SP1 |
Microsoft Monitoring Agent (MMA)
NOTE: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see Log Analytics agent overview. |
| macOS (see System requirements | Local script |
| Linux (see System requirements) | Local script |
| iOS | Microsoft Endpoint Manager |
| Android | Microsoft Endpoint Manager |
(1) Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in Onboard Windows servers.
Run a detection test
To verify that your onboarded devices are properly connected to Defender for Endpoint, you can run a detection test.
| Operating system | Guidance |
|---|---|
| Windows 10 or later
Windows Server 2022 Windows Server 2019 Windows Server, version 1803, or later Windows Server 2016 Windows Server 2012 R2 |
See Run a detection test.
Visit the Defender for Endpoint demo scenarios site (https://demo.wd.microsoft.com) and try one or more of the scenarios. For example, try the Cloud-delivered protection demo scenario. |
| macOS (see System requirements | Download and use the DIY app at https://aka.ms/mdatpmacosdiy.
For more information, see Defender for Endpoint on macOS. |
| Linux (see System requirements) | 1. Run the following command, and look for a result of 1: mdatp health --field real_time_protection_enabled.
2. Open a Terminal window, and run the following command: 3. Run the following command to list any detected threats: For more information, see Defender for Endpoint on Linux. |
Confirm that Microsoft Defender Antivirus is in passive mode on your endpoints
Now that your endpoints have been onboarded to Defender for Endpoint, your next step is to make sure Microsoft Defender Antivirus is running in passive mode. You can use one of several methods, as described in the following table:
| Method | What to do |
|---|---|
| Command Prompt | 1. On a Windows device, open Command Prompt.
2. Type 3. Review the results to confirm that Microsoft Defender Antivirus is running in passive mode. |
| PowerShell | 1. On a Windows device, open Windows PowerShell as an administrator.
2. Run following PowerShell cmdlet: 3. Review the results. You should see Passive mode. |
| Windows Security app | 1. On a Windows device, open the Windows Security app.
2. Select Virus & threat protection. 3. Under Who’s protecting me? select Manage providers. 4. On the Security providers page, under Antivirus, look for Microsoft Defender Antivirus is turned on. |
| Task Manager | 1. On a Windows device, open the Task Manager app.
2. Select the Details tab. Look for MsMpEng.exe in the list. |
Note
You might see Windows Defender Antivirus instead of Microsoft Defender Antivirus in some versions of Windows. To learn more about passive mode and active mode, see More details about Microsoft Defender Antivirus states.
Set Microsoft Defender Antivirus on Windows Server to passive mode manually
To set Microsoft Defender Antivirus to passive mode on Windows Server, version 1803 or newer, or Windows Server 2019, or Windows Server 2022, follow these steps:
- Open Registry Editor, and then navigate to:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection. - Edit (or create) a DWORD entry called ForceDefenderPassiveMode, and specify the following settings:
- Set the DWORD’s value to 1.
- Under Base, select Hexadecimal.
Note
You can use other methods to set the registry key, such as the following:
Start Microsoft Defender Antivirus on Windows Server 2016
If you are using Windows Server 2016, you might have to start Microsoft Defender Antivirus manually. You can perform this task by using the PowerShell cmdlet mpcmdrun.exe -wdenable on the device.
Get updates for Microsoft Defender Antivirus
Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques, even if Microsoft Defender Antivirus is running in passive mode. (See Microsoft Defender Antivirus compatibility.)
There are two types of updates related to keeping Microsoft Defender Antivirus up to date:
- Security intelligence updates
- Product updates
To get your updates, follow the guidance in Manage Microsoft Defender Antivirus updates and apply baselines.
Uninstall your non-Microsoft solution
If at this point you have:
- Onboarded your organization’s devices to Defender for Endpoint, and
- Microsoft Defender Antivirus is installed and enabled,
Then your next step is to uninstall your non-Microsoft antivirus, antimalware, and endpoint protection solution. When you uninstall your non-Microsoft solution, Microsoft Defender Antivirus switches from passive mode to active mode. In most cases, this happens automatically.
To get help with uninstalling your non-Microsoft solution, contact their technical support team.
Make sure Defender for Endpoint is working correctly
Now that you have onboarded to Defender for Endpoint, and you have uninstalled your former non-Microsoft solution, your next step is to make sure that Defender for Endpoint working correctly. One good way to perform this task is by visiting the Defender for Endpoint demo scenarios site (https://demo.wd.microsoft.com). Try one or more of the demo scenarios on that page, including at least the following:
- Cloud-delivered protection
- Potentially Unwanted Applications (PUA)
- Network Protection (NP)