Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Architecture and deployment

Migrate to Microsoft Defender for Endpoint - Onboard

4 September 2026Doc update+12 / −9 lines

In brief

The documentation now requires completing Phases 1 and 2 first, adds macOS and Linux prerequisites for detection tests, clarifies ForceDefenderPassiveMode usage and commands, and links to troubleshooting if antivirus remains passive after uninstalling a non-Microsoft solution.

What Defender admins need to know

Administrators get clearer migration sequencing, validation steps, platform prerequisites, and recovery guidance.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Migrate to Microsoft Defender for Endpoint - Onboard description: MoveOnboard devices to Microsoft Defender for Endpoint. Onboard devicesEndpoint, run a detection test, confirm Microsoft Defender Antivirus passive mode, get antivirus updates, and then uninstall your non-Microsoft solution. ms.service: defender-endpoint ms.subservice: onboard ms.author: painbar

  • highpri
  • tier1 ms.custom:
  • msecd-doc-authoring-10141016
  • migrationguides
  • admindeeplinkDEFENDER ms.topic: how-to ms.date: 06/17/07/02/2026 ms.reviewer: jesquive, chventou, jonix, chriggs, owtho, yongrhee appliesto:
  • Microsoft Defender for Endpoint Plan 1 |--|--|--| || |You're here! |

Welcome to Phase 3 of migrating to Defender for Endpoint. Before you begin, make sure you've completed Phase 1: Prepare and Phase 2: Set up. This migration phase includes the following steps:

  1. Onboard devices to Defender for Endpoint.
  2. Run a detection test.

Step 2: Run a detection test

To verify that your onboarded devices are properly connected to Defender for Endpoint, you can run a detection test. Before running a detection test on macOS or Linux, make sure the device meets the system requirements for macOS or Linux.

Operating system Guidance

Set Microsoft Defender Antivirus on Windows Server to passive mode manually

To setThe ForceDefenderPassiveMode registry value controls whether Microsoft Defender Antivirus tostays in passive mode on supported Windows Server versions. To set this value on Windows Server 2019 and later, Windows Server, version 1803 or later and Azure Stack HCI OS, version 23H2 and later, follow these steps:

  1. Open Registry Editor, and then navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection.

You can use other methods to set the registry key, such as the following:

Start Microsoft Defender Antivirus on Windows Server 2016

Run the following batch commands to switch to the latest Windows Defender platform folder and then enable Windows Defender:

(set "_done=" & if exist "%ProgramData%\Microsoft\Windows Defender\Platform\" (for /f "delims=" %d in ('dir "%ProgramData%\Microsoft\Windows Defender\Platform" /ad /b /o:-n 2^>nul') do if not defined _done (cd /d "%ProgramData%\Microsoft\Windows Defender\Platform\%d" & set _done=1)) else (cd /d "%ProgramFiles%\Windows Defender")) >nul 2>&1

## Step 4: Get updates for Microsoft Defender Antivirus

Keep Microsoft Defender Antivirus up to date so your devices can protect against new malware and attack methods. Updates are important even when Microsoft Defender Antivirus runs in passive mode. For more information, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md).

There are two types of updates related to keeping Microsoft Defender Antivirus up to date:


## Step 5: Uninstall your non-Microsoft solution

If, at this point you have onboarded your organization's devices to Defender for Endpoint, and Microsoft Defender Antivirus is installed and enabled, then your next step is to uninstall your non-Microsoft antivirus, antimalware, and endpoint protection solution. When you uninstall your non-Microsoft solution, Microsoft Defender Antivirus changes from passive mode to active mode. In most cases, this happens automatically.

You can monitor the state of Microsoft Defender Antivirus at scale from the Defender XDR Portal using the Device Health Report. This report highlights the state of Microsoft Defender Antivirus on devices onboarded to Defender for Endpoint, helping you to track current antivirus mode, engine version and various other details.