Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Architecture and deployment

Onboard Devices to Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

1 October 2026Doc update+72 / −69 lines

In brief

The page received wording, formatting, capitalization, and punctuation updates, plus linked references to the Defender, Intune, and Azure portals. The introduction now notes that several device onboarding options are available.

What Defender admins need to know

Administrators have clearer onboarding and detection-test instructions to follow; no required action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Onboard devicesDevices to Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

This article describes how to onboard devices to Defender for Business.

What to do

  1. Select a tab:

    • Windows 10 and 11
    • Mac
    • Mobile (new: new capabilities are available for iOS and Android devices!)devices.
    • Servers (Windows: Windows Server or Linux Server)Server.

  2. View your onboarding options, and follow the guidance on the selected tab.

  3. View a list of onboarded devices.

  4. Run a phishing test on a device.

Note

Windows devices must be runningrun one of the following operating systems:

  • Windows 10 or 11 Business
  • Windows 10 or 11 Professional

Choose one of the following options to onboard Windows client devices to Defender for Business:

  • Local script (forscript. For onboarding devices manually in the Microsoft Defender portal)portal.
  • Group Policy (ifPolicy. If you're already using Group Policy in your organization)organization.
  • Microsoft Intune (ifIntune. If you're already using Intune)Intune.

Local script for Windows 10 and 11

RunningWhen you run the onboarding script on a Windows device takes the following actions:device, it:

  • Creates a trust with Microsoft Entra ID (ifID, if a trust doesn't already exist).exist.
  • Enrolls the device in Microsoft Intune (ifIntune, if it isn't already enrolled).enrolled.
  • Onboards the device to Defender for Business.

If you're not currently using Intune, we recommend using the script to onboard devices to Defender for Business customers.

We recommend that you onboard up to 10 devices at a time when you use the local script method.

  1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.
  2. In the navigation pane, choose Settings > Endpoints, and then under Device management, choose Onboarding.
  3. Select Windows 10 and 11.
  4. Under Connectivity type, select Streamlined.
  5. In the Deployment method section, choose Local script, and then select Download onboarding package. We recommend that you save the onboarding package to a removable drive.
  6. On a Windows device, extract the contents of the configuration package to a location, such as the Desktop folder. You should have a file named WindowsDefenderATPLocalOnboardingScript.cmd.
  7. Open a command prompt as an administrator.
  8. Type the location of the script file. For example, if you copied the file to the Desktop folder, you would type %userprofile%\Desktop\WindowsDefenderATPLocalOnboardingScript.cmd, and then press the Enter key (oror select OK).
  9. After the script runs, Run a detection test.

Group Policy for Windows 10 and 11

Intune for Windows 10 and 11

You can onboard Windows clients and other devices in Intune by using the Intune admin center (Intune admin center). There are several methods available for enrolling devices in Intune. We recommend using one of the following methods:

  • Enable Windows automatic enrollment for company-owned or company-managed devices
  • Ask users to enroll their own Windows 10/11 devices in Intune

When you set up automatic enrollment, users add their work account to the device. In the background, the device registers and joins Microsoft Entra ID and is enrolled in Intune.

  1. Go to the Azure portal (Azure portal) and sign in.
  2. Select Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune.
  3. Configure the MDM User scope and the MAM user scope.

Run a detection test on a Windows 10 or 11 device

After you onboard Windows devices to Defender for Business, you can run a detection test on the device to make sureensure that everything is working correctly.

  1. On the Windows device, create a folder: C:\test-MDATP-test.

  2. Open a Command Prompt windowswindow as an administrator, and then run the following command:

    powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe'

AfterWhen the command runs, the Command Prompt window closes automatically. If successful, the detection test is marked as completed, and a new alert appears in the Microsoft Defender portal (Microsoft Defender portal) for the newly onboarded device within about 10 minutes.

Mac

Mac

Local script for Mac

RunningWhen you run the local script on a Mac takes the following actions:Mac, it:

  • Creates a trust with Microsoft Entra ID (ifID, if a trust doesn't already exist).exist.
  • Enrolls the Mac in Microsoft Intune (ifIntune, if it isn't already enrolled).enrolled.
  • Onboards the Mac to Defender for Business.

We recommend onboarding no more than 10 Macs at a time using this method.

  1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.

  2. In the navigation pane, choose Settings > Endpoints, and then under Device management, choose Onboarding.

  3. Select macOS.

  4. Under Connectivity type, select Streamlined.

  5. On your Mac, save the installation package as wdav.pkg to a local directory.

  6. Save the onboarding package as WindowsDefenderATPOnboardingPackage.zip to the same directory you used for the installation package.

  7. Use Finder to navigate to wdav.pkg you saved, and then open it.

  8. Select Continue, agree withto the license terms, and then enter your password when prompted.

  9. You're prompted to allow installation of a driver from Microsoft (eitherMicrosoft, System Extension Blocked or Installation is on hold, or both).both. You must allow the driver installation. Select Open Security Preferences or Open System Preferences > Security & Privacy, and then select Allow.

  10. Use the following Bash command to run the onboarding package:

/usr/bin/unzip WindowsDefenderATPOnboardingPackage.zip \
&& /bin/chmod +x MicrosoftDefenderATPOnboardingMacOs.sh \
&& Sudo bash -x MicrosoftDefenderATPOnboardingMacOs.sh

After the Mac is enrolled in Intune, you can add it to a device group. Learn more about device groups in Defender for Business.

Intune for Mac

If you already have Intune, you can enroll Mac computers by using the Intune admin center (Intune admin center). There are several methods available for enrolling Mac in Intune. We recommend one of the following methods:

  • Choose an option for company-owned Mac
  • Ask users to enroll their own Mac in Intune
Option Description
Apple Automated Device Enrollment Use this method to automate enrollment on devices purchased through Apple Business Manager or Apple School Manager. Automated device enrollment deploys the enrollment profile "over the air,"air, so you don't need to have physical access to devices. For more information, see Automatically enroll Mac with the Apple Business Manager or Apple School Manager.
Device enrollment manager (DEM) Use this method for large-scale deployments and when there are multiple people in your organization who can help with enrollment setup. Someone with device enrollment manager (DEM) permissions can enroll up to 1,000 devices with a single Microsoft Entra account. This method uses the Company Portal app or Microsoft Intune app to enroll devices. You can't use a DEM account to enroll devices viaby using Automated Device Enrollment. For more information, see Enroll devices in Intune by using a device enrollment manager account.
Direct enrollment Direct enrollment enrolls devices with no user affinity, so this method is best for devices that aren't associated with a single user. This method requires you to have physical access to the Macs you're enrolling. For more information, see Use Direct Enrollment for Mac.

Ask users to enroll their own Mac in Intune

If your business prefers to have userusers enroll devices in Intune, direct usersthem to follow these steps:

  1. Go to the Company Portal website (Company Portal website) and sign in.
  2. Follow the instructions on the Company Portal website to add the device.
  3. Install the Company Portal app at Company Portal app, and follow the instructions in the app.

Confirm that a Mac is onboarded

  1. To confirm that the device is associated with your company, use the following Python command in Bash:

    mdatp health --field org_id.

  2. If you're using macOS 10.15 (Catalina) or later, grant Defender for Business consent to protect your device. Go to System Preferences > Security & Privacy > Privacy > Full Disk Access. Select the lock icon at the bottom of the dialog to make changes, and then select Microsoft Defender for Business (or, or Defender for Endpoint, if that's what you see).see.

  3. To verify that the device is onboarded, use the following command in Bash:

    mdatp health --field real_time_protection_enabled

After you enroll a device is enrolled in Intune, you can add it to a device group. Learn more about device groups in Defender for Business.

Mobile devices

Mobile devices

You can useUse the following methods to onboard mobile devices, such as Android and iOS devices:

  • Use the Microsoft Defender app
  • Use Microsoft Intune

Use the Microsoft Defender app

Mobile threat defense capabilities are available in Defender for Business. With these capabilities, you can now onboard mobile devices (suchdevices, such as Android and iOS)iOS, by using the Microsoft Defender app. With this method, users download the app from Google Play or the Apple App Store, sign in, and complete onboarding steps.

Important

Make sureEnsure that Defender for Business finishedfinishes provisioning: In the Microsoft Defender portal, go to Assets > Devices.

  • If you see the message, "Hang on! We're preparing new spaces for your data and connecting them,"them, Defender for Business isn't finished provisioning. This process is happening now, and it can take up to 24 hours to complete.
  • If you see a list of devices, or you're prompted to onboard devices, it means Defender for Business provisioning is complete.

Users can use the following procedures to onboard mobile devices using the Microsoft Defender app:

  • Android:Android:

    1. If you didn't sign in and register your device in the Microsoft Authenticator app, follow these steps on the device:

      1. Install the Microsoft Authenticator app from the Google Play store.
      2. In the Microsoft Authenticator app, sign in and register your device using your Microsoft 365 work or school account.

    2. Install the Microsoft Defender: Antivirus app from the Google Play store on your device.

    3. Open the Microsoft Defender app, sign in, and complete the onboarding process.

  • iOS/iPadOS:iPadOS:

    1. If you didn't sign in and register your device in the Microsoft Authenticator app, follow these steps on the device:

      1. Install the Microsoft Authenticator app from the Apple App Store.
      2. In the Microsoft Authenticator app, sign in and register your device using your Microsoft 365 work or school account.

    2. Install the Microsoft Defender: Security app from the Apple App Store on your device.

    3. Allow the Microsoft Defender app to set up a VPN connection and add VPN configurations.

    4. Choose whether to allow notifications (suchnotifications, such as alerts).alerts.

Tip

Use Microsoft Intune

If your subscription includes Microsoft Intune, you can use it to onboard mobile devices, such as Android and iOS/iOS or iPadOS devices. See the following resources to get help enrolling these devices into Intune:

After you enroll a device is enrolled in Intune, you can add it to a device group. Learn more about device groups in Defender for Business.

Servers

Servers

Note

If you're planning toTo onboard an instance of Windows Server or Linux Server, you need an extra license, such as Microsoft Defender for Business servers.

Choose the operating system for your server:

Important

Make sure that you meet the following requirements beforeBefore you onboard a Windows Server endpoint:endpoint, ensure you meet the following requirements:

  • You have a Microsoft Defender for Business servers license. (ForFor more information, see How to get Microsoft Defender for Business servers.)
  • The enforcement scope for Windows Server is turned on. Go to Settings > Endpoints > Configuration management > Enforcement scope. Select Use MDE to enforce security configuration settings from MEM, select Windows Server, and then select Save.

You can onboard an instance of Windows Server to Defender for Business by using a local script.

Local script for Windows Server

  1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.

  2. In the navigation pane, choose Settings > Endpoints, and then under Device management, choose Onboarding.

  3. Select an operating system, such as Windows Server 1803, 2019, and 2022, and then in the Deployment method section, choose Local script.

    If you select Windows Server 2012 R2 and 2016, you have two packages to download and run: an installation package and an onboarding package. The installation package contains an MSI file that installs the Defender for Business agent. The onboarding package contains the script to onboard your Windows Server endpoint to Defender for Business.

  4. Select Download onboarding package. We recommend that you save the onboarding package to a removable drive.

    If you selectedselect Windows Server 2012 R2 and 2016, also select Download installation package, and save the package to a removable drivedrive.

  5. On your Windows Server endpoint, extract the contents of the installation/installation and onboarding packagepackages to a location such as the Desktop folder. You should have a file named WindowsDefenderATPLocalOnboardingScript.cmd.

    If you're onboarding Windows Server 2012 R2 or Windows Server 2016, extract the installation package first.

  6. Open a command prompt as an administrator and docomplete the following steps:

    • Windows Server 2012R22012 R2 or Windows Server 2016: Run the following commands:

      Msiexec.exe /i md4ws.msi /quiet

      Run the WindowsDefenderATPLocalOnboardingScript.cmd. For example, if you copied the file to the Desktop folder, run the following command:

      %userprofile%\Desktop\WindowsDefenderATPLocalOnboardingScript.cmd

    • Windows Server 1803, 2019, or 2022: Run the WindowsDefenderATPLocalOnboardingScript.cmd. For example, if you copied the file to the Desktop folder, run the following command:

      %userprofile%\Desktop\WindowsDefenderATPLocalOnboardingScript.cmd

  7. Go to the Run a detection test on Windows Server section.

Run a detection test on Windows Server

After you onboard your Windows Server endpoint to Defender for Business, you can run a detection test to make sureensure that everything is working correctly:

  1. On the Windows Server device, create a folder: C:\test-MDATP-test.

  2. Open Command Prompt as an administrator, and run the following commands:

    powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference = 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-MDATP-test\\invoice.exe');Start-Process 'C:\\test-MDATP-test\\invoice.exe'

AfterWhen the command runs, the Command Prompt window closes automatically. If successful, the detection test is marked as completed, and a new alert appears in the Microsoft Defender portal (Microsoft Defender portal) for the newly onboarded device within about 10 minutes.

Linux Server

Important

Make sureEnsure that you meet the following requirements before you onboard a Linux Server endpoint:

Onboard Linux Server endpoints

You can useUse the following methods to onboard an instance ofa Linux Server instance to Defender for Business:

View a list of onboarded devices

  1. Go to the Microsoft Defender portal (Microsoft Defender portal), and sign in.
  2. In the navigation pane, go to Assets > Devices. The Device inventory view opens.

Run a phishing test on a device

After you onboard a device, you can run a quick phishing test to make sureensure the device is connected and thatgenerates alerts are generated as expected.

  1. On a device, go to https://smartscreentestratings2.net. Defender for Business should block that URL on the user's device.
  2. As a member of your organization's security team, go to the Microsoft Defender portal (Microsoft Defender portal) and sign in.
  3. In the navigation pane, go to Incidents. You should see an informational alert that indicates a device tried to access a phishing site. \ No newline at end of file