MDE Deployment Roadmap

How to Read This Guide

This guide covers a complete Microsoft Defender for Endpoint deployment across five phases — from licensing through onboarding, security policy configuration, incident investigation, and advanced topics. Each section identifies the recommended tool for each task, explains the underlying behaviour, and includes the relevant scripts, KQL queries, and configuration steps.

Glossary — Key Terms

Reference definitions for the key terms and acronyms used throughout this guide.

MDE (Microsoft Defender for Endpoint)

Microsoft's security software for protecting computers and servers. It detects threats, blocks attacks, and lets security teams investigate incidents — all from a single web portal.

SENSE Service

The background Windows service that MDE installs on each computer. Its official service name is "Windows Defender Advanced Threat Protection Service." If this service is not running, the computer is not protected.

Onboarding

The process of connecting a computer to MDE so it starts sending security data to Microsoft. Until a device is onboarded, it is invisible to your security team.

NGAV (Next-Generation Antivirus)

The antivirus component of MDE. Unlike old-style antivirus that only checks known virus signatures, NGAV uses cloud intelligence and machine learning to catch brand-new threats in real time.

EDR (Endpoint Detection & Response)

The investigation layer of MDE. EDR records everything that happens on a computer — every file created, every process launched, every network connection — so analysts can reconstruct what an attacker did.

ASR (Attack Surface Reduction)

A set of rules that block specific attack techniques before they can execute. For example, one rule blocks Office applications from spawning command-line processes — a very common malware technique.

AIR (Automated Investigation & Remediation)

MDE's built-in automation that investigates alerts and, when confident, automatically removes threats without requiring a human analyst. Requires MDE Plan 2.

TVM (Threat & Vulnerability Management)

The vulnerability scanner built into MDE. It continuously checks your devices for missing patches and misconfigurations, prioritising them by real-world exploitability.

GPO (Group Policy Object)

A Windows feature that lets IT administrators push settings to many computers at once through Active Directory. Used in this guide to distribute MDE configuration to all domain-joined devices.

KQL (Kusto Query Language)

The query language used to search security data in Microsoft Defender XDR and Microsoft Sentinel. Similar to SQL but designed for large-scale log analysis. Every KQL query in this guide is explained line by line.

Network Protection

An MDE feature that blocks devices from connecting to known malicious websites and IP addresses. It works at the kernel level, meaning it catches connections before the browser even loads the page.

Tamper Protection

A lock that prevents malware (or an attacker who has gained access) from turning off Microsoft Defender. When enabled, only the Microsoft cloud can change security settings.

Passive Mode

A special state where Microsoft Defender runs on a computer that already has a third-party antivirus installed. In passive mode, Defender does not scan files for threats — but it still collects EDR telemetry so you can investigate incidents.

Live Response

A feature that lets a security analyst open a remote command line on any onboarded device — even if the user is logged off. Used for deep forensic investigation and immediate containment.

Deployment Ring

A phased rollout strategy. You deploy to a small "Ring 0" pilot group first, verify everything works, then expand to larger groups. This prevents a bad configuration from breaking every computer at once.

IoC (Indicator of Compromise)

A known-bad file hash, IP address, domain, or URL. You can upload IoCs to MDE so it automatically blocks or alerts whenever any device tries to access them.

RBAC (Role-Based Access Control)

A permission system that controls who can see or do what in the MDE portal. A Tier 1 analyst can view alerts; a Tier 2 analyst can run Live Response; only admins can change security policies.

Device Control

A feature that controls what USB devices (flash drives, printers, phones) can do on company computers. You can allow read-only access, block entirely, or require approval — all enforced by policy.

QUIC Protocol

A modern internet transport protocol used by HTTP/3. Some attack tools use QUIC to bypass traditional firewall inspection. MDE network protection can block QUIC to force connections through inspectable HTTPS.

WCF (Windows Defender Credential Guard)

A Windows feature that protects user passwords stored in memory from being stolen by malware. Recommended to enable alongside MDE for defense-in-depth.

Plan & Prerequisites

Confirm licensing, operating system compatibility, network access, and deployment ring strategy before onboarding any devices. Gaps here cause silent onboarding failures — devices that appear to complete the process but never show up in the portal.

1.1 Licensing

License bundles that include MDE:

1.2 Supported Operating Systems

1.3 Network Connectivity — Required URLs

Streamlined connectivity (recommended for new deployments)

A single primary endpoint replaces many legacy domain-specific URLs. Supported on Windows 10 1809+, Windows 11, Windows Server 2019+, Linux, and macOS.

# ── Streamlined MDE URLs ── allow outbound on the ports listed ─────────────────

# Core MDE services — ALL telemetry, MAPS, C&C, sample submission
*.endpoint.security.microsoft.com      port 443

# Web and network protection
*.smartscreen-prod.microsoft.com       port 443
*.smartscreen.microsoft.com            port 443

# Security intelligence and antivirus definition updates
go.microsoft.com                       port 443
definitionupdates.microsoft.com        port 443

# Certificate revocation
crl.microsoft.com                      port 80
www.microsoft.com/pkiops/*             port 80
www.microsoft.com/pki/*                port 80

# Security Settings Management (SSM) — required if using non-enrolled device management
*.dm.microsoft.com                     port 443

Standard connectivity (for existing deployments or older Windows versions)

Required for Windows 10 versions prior to 1809, and for any tenant not yet migrated to streamlined. Add these in addition to the SmartScreen and CRL entries above.

# ── Standard MDE URLs — Command and Control (all regions, all platforms) ───────
# Add the group that matches your Microsoft 365 tenant region.

# United States
winatp-gw-cus.microsoft.com
winatp-gw-cus3.microsoft.com
winatp-gw-eus.microsoft.com
winatp-gw-eus3.microsoft.com

# Europe
winatp-gw-neu.microsoft.com
winatp-gw-neu3.microsoft.com
winatp-gw-weu.microsoft.com
winatp-gw-weu3.microsoft.com

# United Kingdom
winatp-gw-uks.microsoft.com
winatp-gw-ukw.microsoft.com

# Australia
winatp-gw-aue.microsoft.com
winatp-gw-aus.microsoft.com

# ── Additional standard connectivity URLs ──────────────────────────────────────
# Threat intelligence feeds
*.blob.core.windows.net                port 443

# NOTE: *.ods.opinsights.azure.com and *.oms.opinsights.azure.com are only required
# when onboarding Windows Server 2012 R2 or 2016 using the legacy MMA-based method.
# They are NOT needed for the modern unified solution or any other platform.

1.4 Deployment Rings

Recommended ring structure for a typical enterprise deployment:

Onboard Endpoints

Onboarding registers a device with your MDE tenant and activates the SENSE sensor, which begins streaming telemetry to the Defender portal. Until a device is onboarded it is invisible — no alerts, no timeline, no policy enforcement. MDE supports multiple deployment paths; choose based on how your devices are managed.

2.1 Choosing a Deployment Method

2.2 Onboarding via Intune (Enrolled Devices)

1. Connect Intune to MDE. In the Intune admin center, go to Endpoint security → Microsoft Defender for Endpoint and set Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations to On. Save.
2. Create an EDR policy. In the Intune admin center, go to Endpoint security → Endpoint detection and response → Create Policy. Select Platform: Windows, Profile: Endpoint detection and response.
3. Configure onboarding. In the policy settings, set Microsoft Defender for Endpoint client configuration package type to Auto from connector (recommended — pulls the onboarding blob automatically from the MDE-Intune connector). The manual Onboard option is also available if needed.
4. Assign to a device group. Assign the policy to your Ring 0 Entra ID device group. Most devices receive and apply the policy within a few minutes; in some cases it can take up to 24 hours. To force immediate check-in, trigger Sync from the Intune portal or from the device.

2.3 Security Settings Management (Non-Enrolled Devices)

1. Enable the enforcement scope. In the Defender portal, go to Settings → Endpoints → Configuration Management → Enforcement Scope. Enable the platforms you want to manage (Windows Client, Windows Server, Linux, macOS).
2. Pilot on tagged devices. Start with On tagged devices and tag pilot machines with the MDE-Management device tag. This limits the initial scope.
3. Enable the Intune connector. In the Intune admin center, go to Endpoint security → Microsoft Defender for Endpoint and set Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations to On.
4. Onboard devices. Use the onboarding package appropriate for each platform (script, GPO, Ansible, etc.). Once onboarded, each device appears in both the Defender portal and Intune admin center with Managed by: MDE.
5. Create Entra ID device groups. Create dynamic groups based on deviceOSType (Windows, Windows Server, Linux, macOS) to target policies. Use managementType eq "MicrosoftSense" to target only Security Settings Management devices.
6. Deploy endpoint security policies. From the Defender portal (Endpoints → Configuration Management → Endpoint Security Policies) or the Intune admin center (Endpoint security), create and assign policies. The same policies work for both enrolled and non-enrolled devices.

2.4 Onboarding Servers via Defender for Cloud

1. Enable Defender for Servers. In the Azure portal, open Microsoft Defender for Cloud → Environment settings. Select the subscription, then enable Defender for Servers Plan 1 or Plan 2.
2. Confirm MDE integration. In Settings and monitoring → Endpoint protection, confirm the status is On. Save.
3. For Windows Server 2016 / 2012 R2. These versions require the unified agent. In the Monitoring coverage column click Settings → Fix → Unified solution → Enable.
4. For Linux servers on older subscriptions. If the Linux MDE extension was not automatically deployed, click Fix → Linux machines → Enable to activate it.
5. On-premises servers. Onboard them as Azure Arc-enabled machines first. Arc registration allows Defender for Cloud to deploy the MDE extension automatically, giving full Plan 2 capability. Direct (non-Arc) onboarding of on-premises servers provides only Plan 1 features.

2.5 Onboarding via Group Policy (Legacy / Hybrid AD)

1. In the Defender portal, go to Settings → Endpoints → Onboarding. Select OS: Windows 10 and 11, Method: Group Policy. Download the onboarding package ZIP.
2. Copy the extracted files to a SYSVOL share: \\dc01\SYSVOL\domain\MDE-Onboarding\
3. Open Group Policy Management Console (gpmc.msc) on the domain controller. Create and link a GPO to the MDE-Ring0 OU.
4. Edit the GPO: Computer Configuration → Policies → Windows Settings → Scripts (Startup/Shutdown) → Startup. Add the onboarding script.
5. Devices receive the GPO at next startup or after gpupdate /force. Onboarding completes in the background; device appears in the portal within 30 minutes.

2.6 Verify Onboarding

# Confirm the MDE sensor service is running
Get-Service -Name SENSE | Select-Object Name, Status, StartType
# Expected: Status = Running, StartType = Automatic

// Devices that have checked in within the last hour
DeviceInfo
| where Timestamp > ago(1h)
| summarize LastSeen = max(Timestamp) by DeviceName, OSPlatform, ManagedBy
| order by LastSeen desc

2.7 Troubleshooting

Configure Protection

Onboarding gets the sensor installed — but that alone does not give you strong protection. Phase 3 turns on and tunes the actual security controls: cloud protection, attack surface reduction rules, network protection, tamper protection, and device control. The recommended management path is the Defender portal (security.microsoft.com) or the Intune admin center — both surface the same Endpoint Security policy engine. GPO and direct registry are noted where applicable as the legacy alternative.

3.1 Endpoint Security Policy Management

All protection settings in this phase can be managed from two equivalent interfaces that write to the same underlying policy engine:

Available policy types in both interfaces:

• Antivirus — cloud protection, real-time protection, scan schedules, exclusions
• Attack surface reduction — ASR rules, controlled folder access, network protection
• Endpoint detection & response — EDR telemetry level, sample sharing, onboarding
• Firewall — Windows Firewall profiles and rules
• Disk encryption — BitLocker configuration
• Account protection — Windows Hello, Credential Guard

3.2 Cloud Protection (NGAV)

Configure via an Antivirus endpoint security policy:

1. Go to security.microsoft.com → Endpoints → Configuration Management → Endpoint Security Policies and click Create new policy.
2. Platform: Windows 10, Windows 11, and Windows Server. Profile: Microsoft Defender Antivirus. Click Create.
3. Under Cloud protection, configure:
   — Cloud-delivered protection level: High+
   — Extended cloud check timeout: 50 seconds
   — Submit samples consent: Send safe samples automatically
4. Under Real-time protection, set Turn on real-time protection to Allowed.
5. Assign the policy to your Ring 0 Entra ID group and click Save.

Get-MpComputerStatus | Select-Object `
  RealTimeProtectionEnabled,   # Should be True
  IoavProtectionEnabled,       # Should be True (scans downloaded files and email attachments)
  AntispywareEnabled,          # Should be True
  AntivirusEnabled             # Should be True

3.3 Attack Surface Reduction (ASR) Rules

Configure via an Attack surface reduction endpoint security policy:

1. Go to Endpoint Security Policies → Create new policy. Platform: Windows 10, Windows 11, and Windows Server. Profile: Attack surface reduction rules.
2. Set each of the following rules to Audit mode initially:
   — Block credential stealing from the Windows local security authority subsystem (LSASS)
   — Block Office applications from creating executable content
   — Block Office applications from injecting code into other processes
   — Block all Office applications from creating child processes
   — Block JavaScript or VBScript from launching downloaded executable content
   — Block execution of potentially obfuscated scripts
   — Block Win32 API calls from Office macros
   — Block executable content from email client and webmail
   — Block untrusted and unsigned processes that run from USB
   — Block persistence through WMI event subscription
3. Assign to Ring 0 group. After 7–14 days, review events at Reports → Attack surface reduction and switch confirmed-safe rules to Block.

Read the current rule configuration from a device:

# Returns the rule GUIDs and their corresponding action values
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions
# Action values: 0 = Disabled, 1 = Block, 2 = Audit, 6 = Warn

3.4 Network Protection

Network protection is configured in Intune via the Antivirus policy (Microsoft Defender Antivirus profile) or a Device configuration profile — not in the Attack surface reduction policy:

1. In Intune, go to Endpoint security → Antivirus, create or edit a Microsoft Defender Antivirus profile, and set Enable network protection to Audit mode.
2. After 1–2 weeks, review events under Reports → Network protection, then change the setting to Enabled.
3. Optionally block QUIC to force all traffic through inspectable HTTPS — add a Firewall policy rule blocking UDP/443 outbound.

Get-MpPreference | Select-Object EnableNetworkProtection
# 0 = Disabled  |  1 = Enabled  |  2 = AuditMode

3.5 Tamper Protection

Enable from the Defender portal (tamper protection requires the cloud policy — it cannot be fully enforced via local PowerShell or GPO alone):

1. Go to security.microsoft.com → Settings → Endpoints → Advanced features.
2. Find Tamper protection and toggle it On.
3. Click Save preferences.
4. Verify on a device: Get-MpComputerStatus | Select-Object IsTamperProtected — should return True.

3.6 Device Control — Managing Removable Media

Deploy device control via OMA-URI in an Intune configuration profile, or through the Attack surface reduction policy. The policy requires two XML files — one defining device groups, one defining access rules:

<!-- DeviceControlGroups.xml — Define which devices to target -->
<Groups>
  <Group Id="{6b2e2ec9-8b73-4f34-a4a8-aeb7b3b0c95d}" Type="Device">
    <Name>All Removable Storage</Name>
    <MatchType>MatchAny</MatchType>
    <DescriptorIdList>
      <PrimaryId>RemovableMediaDevices</PrimaryId>
    </DescriptorIdList>
  </Group>
</Groups>

<!-- DeviceControlPolicyRules.xml — Define what to DO with matched devices -->
<PolicyRules>
  <PolicyRule Id="{c544a991-5786-4402-949e-a032cb790d0e}">
    <Name>Block All Removable Storage</Name>
    <IncludedIdList>
      <GroupId>{6b2e2ec9-8b73-4f34-a4a8-aeb7b3b0c95d}</GroupId>
    </IncludedIdList>
    <ExcludedIdList/>
    <Entry Id="{1ecfde36-1a49-4d11-9ece-e8ee6e4e5b56}">
      <Type>Deny</Type>
      <AccessMask>63</AccessMask>
      <Options>0</Options>
    </Entry>
  </PolicyRule>
</PolicyRules>

Investigate & Respond

Protection prevents most attacks, but no system blocks everything. Phase 4 teaches you how to investigate an incident when one occurs — how to read an alert, how to use Advanced Hunting to trace what happened, and how to contain and remediate a threat using Live Response and isolation. This phase also includes a full ransomware investigation walkthrough.

4.1 Understanding Alerts — How to Read What MDE Is Telling You

Use this KQL query in Advanced Hunting to get a summary of recent alerts on your environment:

// Summary of all alerts in the past 7 days, grouped by severity
// Run this in: security.microsoft.com → Hunting → Advanced Hunting
AlertInfo
| where Timestamp > ago(7d)              // Look at the last 7 days
| summarize AlertCount = count()          // Count the number of alerts
    by Severity,                          // Group by severity level (High, Medium, Low)
       Category,                          // Group by attack category (e.g. Malware, Ransomware)
       DetectionSource                    // Which engine generated the alert
| order by case(                          // Sort so High severity appears at top
    Severity == "High", 1,
    Severity == "Medium", 2,
    Severity == "Low", 3,
    4), AlertCount desc

4.2 Advanced Hunting — Searching for Threats with KQL

Here are the most important hunting queries, with each line explained:

// HUNT 1: Find all devices that ran a specific suspicious file hash
// Replace the SHA256 hash below with the hash of the file you are investigating
DeviceFileEvents
| where Timestamp > ago(30d)              // Search the last 30 days of data
| where SHA256 == "REPLACE_WITH_FILE_HASH_HERE"  // Match this specific file
| project                                 // Show only these columns (cleaner output)
    Timestamp,                            // When the event happened
    DeviceName,                           // Which computer
    FileName,                             // What the file was named
    FolderPath,                           // Where it was located
    InitiatingProcessFileName,            // What process created or accessed the file
    InitiatingProcessCommandLine          // The full command line that ran it

// HUNT 2: Find PowerShell commands that look suspicious (encoded or download commands)
// Attackers often use -EncodedCommand or download cradles to hide malicious scripts
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")  // Match PowerShell (case-insensitive)
| where ProcessCommandLine has_any (                  // Look for these suspicious patterns
    "-EncodedCommand",    // Base64-encoded command — common obfuscation technique
    "-enc",               // Short form of -EncodedCommand
    "IEX",                // Invoke-Expression — runs a string as code
    "Invoke-Expression",  // Same as above, spelled out
    "DownloadString",     // Downloads content from the internet and runs it
    "WebClient"           // Creates a web connection — often used to download malware
  )
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// HUNT 3: Network connections to unusual ports or IPs — signs of C2 communication
// Command-and-control (C2) traffic is how malware calls home to the attacker
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"             // Only successful connections
| where RemotePort !in (80, 443, 53, 25, 587, 8080)  // Filter out common legitimate ports
| where RemoteIPType != "Private"                     // Ignore internal network traffic
| summarize                                           // Aggregate to find patterns
    ConnectionCount = count(),
    Devices = dcount(DeviceName)                      // How many unique devices connected
    by RemoteIP, RemotePort, RemoteUrl
| where ConnectionCount > 5                           // Focus on repeated connections
| order by ConnectionCount desc

4.3 Device Isolation — Containing a Compromised Machine

Isolate a device via the Defender portal OR via the REST API (useful for automation):

# Isolate a device using the Microsoft Defender for Endpoint REST API
# Use this in a SOAR playbook or when you need to isolate many devices at once

# Step 1: Get an authentication token from Microsoft Entra ID
# Replace the values below with your actual tenant and app registration details
$TenantId  = "YOUR-TENANT-ID"         # Your Microsoft 365 tenant ID (GUID)
$ClientId  = "YOUR-APP-CLIENT-ID"     # App registration client ID from Entra ID
$ClientSecret = "YOUR-CLIENT-SECRET"  # Client secret from the app registration

# Request an OAuth2 token from Microsoft identity platform
$TokenResponse = Invoke-RestMethod `
  -Method POST `
  -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" `
  -Body @{
    client_id     = $ClientId
    client_secret = $ClientSecret
    scope         = "https://api.securitycenter.microsoft.com/.default"
    grant_type    = "client_credentials"  # Machine-to-machine auth (no user login)
  }

$AccessToken = $TokenResponse.access_token  # Extract the bearer token

# Step 2: Send the isolation request for the target device
$DeviceId = "DEVICE_ID_FROM_MDE_PORTAL"  # Find this in: Assets → Devices → click device

Invoke-RestMethod `
  -Method POST `
  -Uri "https://api.securitycenter.microsoft.com/api/machines/$DeviceId/isolate" `
  -Headers @{ Authorization = "Bearer $AccessToken"; "Content-Type" = "application/json" } `
  -Body (@{
    Comment       = "Isolating suspected ransomware infection - incident 1234"  # Required field
    IsolationType = "Full"  # Full = all traffic blocked except MDE portal
                            # Selective = allows Outlook and Microsoft Teams through
  } | ConvertTo-Json)

Write-Host "Isolation request sent. Device will appear as Isolated in the portal within 2 minutes."

4.4 Ransomware Investigation Walkthrough

// RANSOMWARE HUNT: Find mass file encryption activity
// Ransomware renames or overwrites thousands of files very quickly
// This query looks for processes that modified an unusually high number of files
DeviceFileEvents
| where Timestamp > ago(1h)               // Focus on the last hour (active incident)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize
    FilesModified = count(),              // Total files touched
    UniqueExtensions = dcount(FileName),  // How many different file types
    SampleFiles = make_set(FileName, 5)   // Show up to 5 example file names
    by DeviceName, InitiatingProcessFileName, InitiatingProcessId
| where FilesModified > 100              // Flag processes that touched 100+ files
| order by FilesModified desc

// RANSOMWARE HUNT: Look for shadow copy deletion (a ransomware signature)
// Ransomware deletes backup copies (shadow copies) to prevent recovery
// vssadmin.exe delete shadows is the most common command used
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (
    "vssadmin delete shadows",    // Most common shadow copy deletion command
    "wmic shadowcopy delete",     // Alternative WMI-based method
    "bcdedit /set recoveryenabled no",  // Disables Windows Recovery
    "wbadmin delete catalog"      // Deletes Windows backup catalog
  )
| project Timestamp, DeviceName, ProcessCommandLine, AccountName, InitiatingProcessFileName
| order by Timestamp desc

4.5 Live Response — Remote Forensics and Remediation

To start a Live Response session: go to security.microsoft.com → Assets → Devices → click the device → Initiate Live Response Session. Then use these commands:

# Common Live Response commands
# These are run inside the Live Response terminal in the Defender portal

# List running processes — look for suspicious process names or unsigned binaries
processes

# List files in a directory
dir C:\Users\Public\

# Download a suspicious file for analysis (saves to your portal Files library)
getfile "C:\Users\Public\suspicious.exe"

# Run a script from your portal library on the remote device
run ForensicCollect.ps1

# Remove a malicious file from the device (use -auto to skip confirmation)
remediate file "C:\ProgramData\malware.exe" -auto

Coexistence & Advanced Topics

Most organisations already have an antivirus product installed before deploying MDE. This phase explains how to handle that transition safely — and covers advanced topics including RBAC setup, automated investigation, and continuous vulnerability management.

5.1 Running MDE Alongside Another Antivirus

# Check current Microsoft Defender operating mode
Get-MpComputerStatus | Select-Object AMRunningMode
# Possible values:
#   Normal         = Active mode (Defender is the primary AV)
#   Passive         = Passive mode (third-party AV detected)
#   EDR Block       = EDR Block mode (enabled manually)
#   SxS Passive     = Side-by-side passive (limited periodic scanning mode)

# Enable EDR Block mode when a third-party AV is installed
# This allows Defender to block threats it detects even in passive mode
# Note: third-party AV must still be the primary real-time scanner
Set-MpPreference -ForceDefenderPassiveMode $false  # Must be false for EDR Block to work
# Then enable EDR Block via registry:
Set-ItemProperty `
  -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" `
  -Name "ForceDefenderPassiveMode" `
  -Value 0  # 0 = allow EDR Block mode; 1 = force passive (no blocking)

5.2 Role-Based Access Control — Who Can Do What in the Portal

Create custom roles in the portal: go to Settings → Endpoints → Roles → Add item. Assign roles to Entra ID security groups for easy management.

5.3 Automated Investigation & Remediation (AIR)

Set the automation level in the portal: Settings → Endpoints → Device groups → Edit device group → Automation level. Start with "Semi — require approval for all remediations" and move to Full automation after you have observed AIR's decisions for 4–8 weeks.

5.4 Threat & Vulnerability Management (TVM)

// Find the top 10 most critical vulnerabilities across your estate
// Prioritised by exploit availability and device exposure
DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel == "Critical"        // Only Critical CVEs
| summarize
    ExposedDevices = dcount(DeviceId),                   // How many devices are affected
    DeviceList     = make_set(DeviceName, 5)             // Sample affected device names
    by CveId,                                            // Group by CVE identifier
       SoftwareName,                                     // What software has the vulnerability
       SoftwareVersion,                                  // Specific version
       RecommendedSecurityUpdate                         // What patch fixes it
| order by ExposedDevices desc                           // Prioritise by most affected devices
| take 10                                               // Show top 10

Deployment Checklist

Use this checklist to track your deployment progress. Work through each phase in order — each item corresponds to a section in this guide.