Microsoft Defender for Endpoint: Configuration and

Overview

Microsoft Defender for Endpoint (MDE) is an enterprise endpoint security platform that prevents, detects, investigates, and responds to advanced threats. It integrates with Microsoft 365 Defender to provide unified XDR capabilities across endpoints, identity, email, and cloud apps.

Who Should Use This Guide:

• Security engineers deploying endpoint protection
• IT administrators managing Windows devices
• SOC analysts configuring detection capabilities
• Organizations replacing third-party EDR solutions

Defender for Endpoint Capabilities:

Plan Comparison:

Requirements

Licensing:

System Requirements:

Network Requirements:

Architecture

┌─────────────────────────────────────────────────────────────────┐
│              Microsoft Defender for Endpoint                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌──────────────┐                    ┌───────────────────────┐  │
│  │   Endpoints  │                    │ Microsoft 365 Defender│  │
│  │              │                    │       Portal          │  │
│  │  ┌────────┐  │                    │ ┌───────────────────┐ │  │
│  │  │Windows │  │    ┌─────────┐     │ │ Incidents & Alerts│ │  │
│  │  │ 10/11  │──┼───▶│  Cloud  │────▶│ ├───────────────────┤ │  │
│  │  └────────┘  │    │ Service │     │ │    Device List    │ │  │
│  │  ┌────────┐  │    └─────────┘     │ ├───────────────────┤ │  │
│  │  │ macOS  │──┤                    │ │   Threat & Vuln   │ │  │
│  │  └────────┘  │                    │ ├───────────────────┤ │  │
│  │  ┌────────┐  │                    │ │  Advanced Hunting │ │  │
│  │  │ Linux  │──┤                    │ └───────────────────┘ │  │
│  │  └────────┘  │                    └───────────────────────┘  │
│  │  ┌────────┐  │                                               │
│  │  │Server  │──┘                    ┌───────────────────────┐  │
│  │  │2016+   │                       │      Intune MDM       │  │
│  │  └────────┘                       │    Configuration      │  │
│  └──────────────┘                    └───────────────────────┘  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Process

Step 1: Enable Defender for Endpoint Service

Activate MDE in your Microsoft 365 tenant.

Navigate to: Microsoft 365 Defender portal (security.microsoft.com)

Initial Setup:

1. Go to Settings → Endpoints → Onboarding
2. Accept the Microsoft Defender for Endpoint license terms
3. Select data storage location (cannot be changed later):
   • US
   • EU
   • UK
4. Click Continue to provision the service

Configure General Settings:

Navigate to: Settings → Endpoints → General

Verification: Service status shows "Active" in Settings → Endpoints.

Step 2: Configure Onboarding via Intune

Deploy MDE sensor to Windows devices using Microsoft Intune.

Create Onboarding Configuration Profile:

1. Navigate to Microsoft Intune admin center
2. Go to Endpoint security → Endpoint detection and response
3. Click Create policy
4. Select:
   • Platform: Windows 10 and later
   • Profile type: Endpoint detection and response

Configure Settings:

Assignments:

• Assign to All devices or target security groups
• Exclude any devices that shouldn't be onboarded

Alternative: Manual Onboarding Package:

1. Navigate to security.microsoft.com → Settings → Endpoints → Onboarding
2. Select deployment method:
   • Group Policy
   • Microsoft Endpoint Configuration Manager
   • Local script
   • VDI onboarding scripts
3. Download the package
4. Deploy via your chosen method

PowerShell Onboarding (Local Script):

# Download onboarding script from portal, then run:
.\WindowsDefenderATPLocalOnboardingScript.cmd
 
# Verify onboarding
Get-MpComputerStatus | Select-Object AMRunningMode, OnboardingState

Step 3: Configure Attack Surface Reduction Rules

ASR rules block common attack techniques at the endpoint level.

Navigate to: Intune → Endpoint security → Attack surface reduction

Create ASR Policy:

1. Click Create policy
2. Select:
   • Platform: Windows 10 and later
   • Profile: Attack Surface Reduction Rules

Recommended ASR Rules (Audit First):

Implementation Strategy:

PowerShell Configuration:

# Set ASR rules to Audit mode
$rules = @{
    "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550" = 2  # Audit
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" = 2
    "3B576869-A4EC-4529-8536-B80A7769E899" = 2
    "D3E037E1-3EB8-44C8-A917-57927947596D" = 2
}
 
foreach ($rule in $rules.GetEnumerator()) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key -AttackSurfaceReductionRules_Actions $rule.Value
}
 
# View current ASR configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

Step 4: Configure Network Protection

Block connections to malicious domains and IP addresses.

Navigate to: Intune → Endpoint security → Attack surface reduction

Create Network Protection Policy:

1. Click Create policy
2. Select profile: Device control or use Settings Catalog
3. Configure:
   • Enable network protection: Enabled (Block mode)

Settings Catalog Configuration:

1. Go to Devices → Configuration profiles → Create profile
2. Select Settings catalog
3. Add: Defender → Enable Network Protection
4. Set to: Enabled (block mode) or Audit mode

Group Policy Alternative:

Computer Configuration → Administrative Templates →
Windows Components → Microsoft Defender Antivirus →
Microsoft Defender Exploit Guard → Network Protection
 
Enable Network Protection: Enabled
Mode: Block (or Audit)

PowerShell Configuration:

# Enable Network Protection in Block mode
Set-MpPreference -EnableNetworkProtection Enabled
 
# Enable in Audit mode first
Set-MpPreference -EnableNetworkProtection AuditMode
 
# Verify status
Get-MpPreference | Select-Object EnableNetworkProtection

Step 5: Configure Web Content Filtering

Block access to malicious or inappropriate web categories.

Navigate to: security.microsoft.com → Settings → Endpoints → Web content filtering

Create Web Content Filtering Policy:

1. Click + Add policy
2. Configure:
   • Policy name: Block-Malicious-Categories
   • Categories to block:

Assign to Device Groups:

• Select target device groups
• Or apply to all devices

PowerShell Alternative:

# Web Content Filtering requires Defender for Endpoint Plan 2
# Configuration is done through the security portal
 
# Verify SmartScreen is enabled
Get-MpPreference | Select-Object *SmartScreen*

Step 6: Enable EDR in Block Mode

EDR in Block Mode provides post-breach protection even when Microsoft Defender AV isn't the primary AV.

Requirements:

• Defender for Endpoint Plan 2
• Windows 10 1903+ or Windows Server 2016+
• Defender AV in passive mode (non-primary AV) or active mode

Enable via Settings:

1. Navigate to security.microsoft.com → Settings → Endpoints
2. Go to General → Advanced features
3. Enable: EDR in block mode

What EDR Block Mode Does:

Verify EDR Block Mode:

# Check if EDR block mode is active
Get-MpComputerStatus | Select-Object AMRunningMode, IsTamperProtected
 
# Review blocked threats
Get-MpThreat | Where-Object {$_.ThreatStatusID -eq 1}

Step 7: Configure Automated Investigation and Response

Enable automated remediation for detected threats.

Navigate to: security.microsoft.com → Settings → Endpoints → General

Configure Automation Settings:

Automation Levels:

Create Device Groups with Automation:

1. Go to Settings → Endpoints → Device groups
2. Create group with automation level:

Group name: High-Value-Servers
Automation level: Semi-automated
Matching rules:
  - Tag: HighValue
  - OR Device name contains: SRV

Review Automated Investigations:

Navigate to: Incidents & alerts → Automated investigations

Step 8: Configure Custom Detection Rules

Create custom detection rules using KQL queries.

Navigate to: security.microsoft.com → Hunting → Custom detection rules

Create Custom Detection:

1. Click + New detection rule
2. Write KQL query:

// Detect PowerShell with encoded commands
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "-e ", "-ec ")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine

Configure Rule Settings:

Example Detection Queries:

// Detect LSASS credential access
DeviceProcessEvents
| where FileName in~ ("procdump.exe", "mimikatz.exe", "comsvcs.dll")
    or ProcessCommandLine has "sekurlsa"
    or ProcessCommandLine has "lsass"
 
// Detect suspicious WMI activity
DeviceProcessEvents
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName in~ ("powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, ProcessCommandLine

Step 9: Configure Exclusions

Add necessary exclusions for business applications.

Navigate to: Intune → Endpoint security → Antivirus

Create Antivirus Exclusion Policy:

1. Click Create policy
2. Select Microsoft Defender Antivirus exclusions

Common Exclusions:

Important: Minimize exclusions to reduce attack surface.

PowerShell Exclusion Management:

# Add path exclusion
Add-MpPreference -ExclusionPath "C:\CustomApp\Data"
 
# Add process exclusion
Add-MpPreference -ExclusionProcess "CustomApp.exe"
 
# Add extension exclusion (use sparingly)
Add-MpPreference -ExclusionExtension ".log"
 
# View current exclusions
Get-MpPreference | Select-Object Exclusion*

Step 10: Verify Onboarding and Test Detection

Confirm devices are properly protected and detections work.

Verify Device Onboarding:

# Check MDE sensor status
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled,
    OnboardingState, RealTimeProtectionEnabled
 
# Verify connectivity
Test-NetConnection -ComputerName wdcp.microsoft.com -Port 443
Test-NetConnection -ComputerName events.data.microsoft.com -Port 443

Run EICAR Test File:

# Download EICAR test file (will be detected and blocked)
Invoke-WebRequest -Uri "https://www.eicar.org/download/eicar.com.txt" -OutFile "C:\Test\eicar.com"
 
# This should trigger a detection in the portal

Run MDE Detection Test:

# Official MDE detection test command
# This generates a benign alert in the portal
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-WDATP-test\\invoice.exe');Start-Process 'C:\\test-WDATP-test\\invoice.exe'

Portal Verification:

1. Navigate to security.microsoft.com → Assets → Devices
2. Find test device
3. Verify:
   • Onboarding status: Onboarded
   • Sensor health: Active
   • Risk level: Low (after test)

Troubleshooting

Common Issues:

Diagnostic Commands:

# Check Defender service status
Get-Service WinDefend, Sense
 
# Run Defender connectivity test
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection
 
# Check cloud protection status
Get-MpComputerStatus | Select-Object *Cloud*, *Map*
 
# View recent Defender events
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" -MaxEvents 20
 
# Generate MDE client analyzer report
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -GetFiles

Collect Diagnostic Package:

# Create diagnostic package for support
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -GetFiles
# Output: C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab

Security Considerations

Tamper Protection:

Enable tamper protection to prevent unauthorized changes:

1. Navigate to security.microsoft.com → Settings → Endpoints
2. Enable: Tamper protection

Cloud Protection Level:

Recommended Baseline:

# Set cloud protection to High
Set-MpPreference -CloudBlockLevel High
 
# Set cloud extended timeout
Set-MpPreference -CloudExtendedTimeout 50
 
# Enable all protection features
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
Set-MpPreference -DisableScriptScanning $false

Verification Checklist

Onboarding:

• MDE service activated in tenant
• Onboarding policy deployed via Intune
• Test device shows as onboarded
• Sensor health shows "Active"

Protection Configuration:

• Real-time protection enabled
• Cloud protection enabled (High level)
• ASR rules configured (audit mode initially)
• Network protection enabled
• EDR in Block mode enabled

Detection Testing:

• EICAR test file detected
• MDE test alert generated
• Custom detection rules created
• Automated investigation configured

Operations:

• Device groups configured
• Alert notifications configured
• Exclusions documented and minimal
• SOC team trained on portal

Next Steps

After deploying Defender for Endpoint:

1. Integrate with Microsoft Sentinel - Centralized SIEM analysis
2. Enable Threat Analytics - Threat intelligence reports
3. Configure Attack Simulations - Test detection capabilities
4. Deploy to macOS/Linux - Cross-platform protection

References

• Microsoft Defender for Endpoint Documentation
• Attack Surface Reduction Rules Reference
• Advanced Hunting Queries
• Network Requirements

Last Updated: February 2026