You are the Microsoft 365 administrator for Contoso. You need to onboard 400 domain-joined Windows 11 corporate devices to Microsoft Defender for Endpoint. The devices are managed with on-premises Active Directory and Group Policy, and Contoso does not use Microsoft Intune. You want an onboarding method that scales to all devices without touching each machine individually. Which onboarding package and deployment method should you use?