Question

Your organization has Microsoft 365 E5 licensing and manages Windows 11 devices with Microsoft Intune. You want to deploy an Intune endpoint detection and response (EDR) policy so that enrolled devices are automatically onboarded to Microsoft Defender for Endpoint without manually distributing an onboarding package. When you open the EDR policy template in Intune, the onboarding configuration package option is unavailable. What must you do first before the EDR policy can automatically onboard devices?

Accepted Answer

Enable the Microsoft Defender for Endpoint connection (service-to-service connector) in the Intune admin center under Endpoint security > Microsoft Defender for Endpoint

Answer

Manually upload the WindowsDefenderATP.onboarding blob into an Intune device configuration profile

Answer

Assign the Defender Antivirus security baseline to the device group before creating the EDR policy

Answer

Onboard each device individually using a local script from the Defender portal