Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Enable Defender For Endpoint

5 October 2026Feature updateAction required+156 / −38 lines

In brief

The documentation now states that the integration can use an existing Defender for Endpoint sensor from the same tenant, adds updated platform and Linux requirements, and lists pre-deployment checks for connectivity, proxy authentication, file-system settings, and security policies.

What Defender admins need to know

Before enabling the integration, administrators must validate these prerequisites and install Python 3 on Linux servers.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Defender for Cloud integrates natively with Microsoft Defender for Endpoint to provide Defender for Endpoint and Defender Vulnerability Management capabilities in Defender for Cloud.

  • When you enable the Defender for Servers plan in Defender for Cloud, Defender for Endpoint integration is enabled by default.
  • The integration automatically deploys theor uses an existing Defender for Endpoint agentinstallation on machines.supported machines when prerequisites are met.

This article explains how to manually enable Defender for Endpoint integration if it was previously turned off or if you have a legacy subscription that requires manual opt-in.

Before you enable Defender for Endpoint integration, review these requirements.

Requirement Details
Windows support VerifyConfirm that each Windows machines are supported by Defender for Endpointmachine runs an operating system version supported by Defender for Endpoint.
Linux support For Linux servers, you must haveinstall Python installed.3. Python 3 is recommended for all distros, but is required for RHELRed Hat Enterprise Linux (RHEL) 8.x and Ubuntu 20.04 or higher. Automatic deployment of the Defender for Endpoint sensor on Linux machines might not work as expected if machines run services that use fanotifylater. Some Linux security monitoring solutions that use fanotify can affect automatic deployment of Defender for Endpoint. Manually install the Defender for Endpoint sensor on these machines.
Azure VMs Check that virtual machines (VMs)VMs can connect to the Defender for Endpoint service. If machines don't have direct access, proxy settings or firewall rules need to allow access to Defender for Endpoint URLs. Review Windows proxy and internet configuration and Linux static proxy configuration.
On-premises VMs We recommend that you onboard on-premises machines as Azure Arc-enabled VMs. If you onboard on-premises VMs directly, Defender for Servers Plan 1 features are available, but mostsome Defender for Servers Plan 2 functionality doesncapabilities aren't work.available without Azure Arc.
Azure tenant If you moved your subscription between Azure tenants, some manual preparatory steps are also required. Contact Microsoft support for details.
Existing Defender for Endpoint installationDefender for Cloud can use an existing Defender for Endpoint sensor when the device is associated with the same Defender for Endpoint organization (tenant). Defender for Cloud doesn't automatically reassign a device that is onboarded to a different organization. Offboard the device from the previous organization before you onboard it to the organization associated with Defender for Cloud.
Windows Server 2016, Windows Server 2012 R2 Unlike later versions of Windows Server, which come with the Defender for Endpoint sensor preinstalled, Defender for Cloud installs the sensor on machines running Windows Server 2016/Windows Server 2012 R2 using the unified Defender for Endpoint solution.

Pre-deployment validation

Complete these checks before you enable Defender for Endpoint integration:

  • Confirm that the machine is powered on and runs a supported operating system.
  • For Azure Arc-enabled machines, confirm that the Azure Connected Machine agent reports a healthy connection.
  • Confirm that the machine can reach the Defender for Endpoint service URLs. Don't use a test against a single URL as proof that all required service endpoints are reachable.
  • Confirm that your proxy doesn't require interactive user authentication. The Defender for Endpoint sensor connects in the system context.
  • On Linux, confirm that the distribution is supported, Python is installed, and the file system that contains /opt/microsoft/mdatp isn't mounted with noexec.
  • Review Group Policy and third-party antimalware configuration to confirm that Microsoft Defender Antivirus and the Early Launch Antimalware (ELAM) driver aren't disabled.

For a complete connectivity and sensor-readiness assessment, run the Microsoft Defender for Endpoint Client Analyzer. The analyzer tests the service endpoints and collects diagnostics in the same security context used by the sensor.

Collect Windows readiness information

The following read-only PowerShell script collects information that is commonly needed when you investigate a deployment failure. It doesn't modify the server and doesn't replace the supported operating-system check or the Client Analyzer.

$os = Get-CimInstance Win32_OperatingSystem
$disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='$($env:SystemDrive)'"
$himds = Get-Service -Name himds -ErrorAction SilentlyContinue
$senseService = Get-Service -Name Sense -ErrorAction SilentlyContinue
$defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue

[pscustomobject]@{
    ComputerName             = $env:COMPUTERNAME
    OperatingSystem          = $os.Caption
    OSVersion                = $os.Version
    SystemDriveFreeGB        = [math]::Round($disk.FreeSpace / 1GB, 2)
    AzureArcAgent            = if ($himds) { $himds.Status } else { 'Not installed' }
    SenseService             = if ($senseService) { $senseService.Status } else { 'Not present' }
    DefenderAntivirusService = if ($defenderService) { $defenderService.Status } else { 'Not present' }
    PowerShellVersion        = $PSVersionTable.PSVersion.ToString()
}

Interpret the output against the linked platform requirements. A stopped or missing service isn't, by itself, proof of the root cause because the expected service state depends on the operating system and deployment stage.

Collect Linux readiness information

Run these commands to collect Linux prerequisites and health information:

cat /etc/os-release
python3 --version
findmnt -no TARGET,OPTIONS /
findmnt -T /opt -o TARGET,OPTIONS
azcmagent show
mdatp health

If Defender for Endpoint isn't installed yet, the mdatp health command isn't available. Validate the distribution and version against Defender for Endpoint on Linux prerequisites, and use the Client Analyzer after installation to validate connectivity and collect diagnostics.

Deployment and verification by platform

Windows Server 2019 and later

  • Enable Defender for Servers Plan 1 or Plan 2.
  • Verify endpoint protection is enabled in Environment settings > Endpoint protection.
  • Verify the extension state in the Azure portal: VM > Extensions > MDE.Windows > Provisioning succeeded.
  • Verify onboarding in the Microsoft Defender portal: Devices > server name.

Windows Server 2016 and Windows Server 2012 R2

Note

For legacy subscriptions created before spring 2022, follow the steps in Legacy subscriptions (created before spring-2022): Enable Defender for Endpoint unified solution on Windows Server 2016/2012 R2.

  • Enable Defender for Servers.
  • Keep the operating system and Microsoft Defender Antivirus fully updated.
  • After the unified agent is installed, make sure Defender Antivirus Update KB5005292 is approved and applied so that the EDR sensor continues to receive updates.
  • Verify the MDE.Windows extension and the device record in the Microsoft Defender portal.

Linux servers

  • Validate the supported distribution, Python requirement, file-system mount options, and outbound connectivity before deployment.
  • Verify extension state in Azure portal: VM > Extensions > MDE.Linux > Provisioning succeeded.
  • Run mdatp health and confirm that healthy and licensed are true.
  • If installation fails, follow Troubleshoot installation issues for Defender for Endpoint on Linux and apply a remediation for a similarly worded error only after you confirm the actual failure in the installation or extension logs.

Enable Defender for Endpoint integration on a subscription

To enable Defender for Endpoint integration on a subscription:

  1. Sign in to the Azure portal.

  2. Go to Microsoft Defender for Cloud > Environment settings.

  3. Select the relevant subscription.subscription containing the machines on which you want to deploy the Defender for Endpoint integration.

  4. Go to Settings and monitoring > Endpoint protection.

  5. Set statusToggle Status to On.

    Screenshot of Status toggle that enables Microsoft Defender for Endpoint.

  6. Select Continue.

  7. Select Save.

  • The Defender for Endpoint sensor is deployed to allsupported Windows and Linux machines inthat meet the selected subscription.prerequisites.

  • Onboarding might take up to an hour. Defender for Cloud detects any previousan existing Defender for Endpoint installationsinstallation and reconfigures them to integrateuses it when the device is associated with the same Defender for Cloud.Endpoint organization (tenant). A device onboarded to another organization isn't automatically reassigned.

    • Important

    If this is the first subscription that you're configuring for Defender for Endpoint integration in the tenant, onboarding can take up to 12 hours. After integration is enabled for the first time, onboarding new machines and subscriptions can take up to one hour.

    Note

    On new subscriptions, Defender for Endpoint integration is automatically enabled and covers machines running a supported Windows Server or Linux operating system. The Enable Defender for Endpoint unified solution on Windows Server 2016/2012 R2 and Enable on Linux machines sections cover one-time opt-in procedures that might be required for legacy subscriptions.

    Legacy subscriptions (created before spring-2022): Enable Defender for Endpoint unified solution on Windows Server 2016/2012 R2

    If you enabled Defender for Servers and turned on Defender for Endpoint integration in a subscription that you created before spring 2022, you might need to manually enable integration of the unified solution for machines running Windows Server 2016 or Windows Server 2012 R2 in the subscription.

    1. Sign in to the Azure portal.

    2. Go to Microsoft Defender for Cloud > Environment settings.

    3. Select the relevant subscription.

    4. Insubscription with the Monitoring coverage column of theWindows machines that you want to receive Defender for Servers plan, select Settings.Endpoint.

      The status of the Endpoint protectionsprotection component is Partial, which meansmeaning that not all parts of the component are enabled.

    5. Select Fix to see the components that aren't enabled.

      Screenshot of Fix button that enables Microsoft Defender for Endpoint support.

    6. Go to Missing components > Unified solution.

    7. SelectIn Missing components > Unified solution, select Enable.

      Screenshot of enabling the use of the Defender for Endpoint unified solution for Windows Server 2012 R2 and 2016 machines.

      The to automatically install the Defender for Endpoint agent automatically installs on Windows Server 2012 R2 and 2016 machines connected to Microsoft Defender for Cloud.

      Screenshot of enabling the use of the Defender for Endpoint unified solution for Windows Server 2012 R2 and 2016 machines.

    8. Select Save.

    9. In Settings and monitoring, select Continue.

    Enabling Defender for Endpoint integration on Windows Server 2012 R2 and Windows Server 2016 machines is a one-time action. If you disable the Defender for Servers plan and then re-enable it, integration stays enabled.

    Legacy subscriptions (created before summer-2021): Enable on Linux machines (plan/integration enabled)

    If Defender for Servers is already enabled and Defender for Endpoint integration is on in a subscription that existed before summer 2021, you might need to manually enable the integration for Linux machines.

    1. Sign in to the Azure portal.

    2. Go to Microsoft Defender for Cloud > Environment settings.

    3. Select the relevant subscription.

    4. Insubscription with the Monitoring coverage column of theLinux machines that you want to receive Defender for Servers plan, select Settings.Endpoint.

      The status of the Endpoint protectionsprotection component is Partial, meaning that not all parts of the component are enabled.

    5. Select Fix to see the components that aren't enabled.

      Screenshot of Fix button that enables Microsoft Defender for Endpoint support.

    6. In Missing components > Linux machines, select Enable.

      Screenshot of enabling the integration between Defender for Cloud and Microsoft's EDR solution, Microsoft Defender for Endpoint for Linux.

    7. Select Save. to save your settings.

    8. In Settings and monitoring, select Continue.

      • Defender for Cloud onboards Linux machines to Defender for Endpoint.

    The settings WDATP_UNIFIED_SOLUTION and WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW are relevant for legacy subscriptions. These settings apply to subscriptions that already have the Defender for Endpoint integration enabled when these features were introduced in August 2021 and Spring 2022.

    Troubleshoot extension deployment

    Use the following sequence instead of retrying the deployment without first identifying the failure stage.

    SymptomWhat to checkNext action
    The MDE.Windows or MDE.Linux extension doesn't appearConfirm that Defender for Servers and endpoint protection are enabled, the machine is powered on, and the operating system is supported. If the machine is connected through Azure Arc, verify that the Azure Connected Machine agent is healthy.Resolve the missing prerequisite, and then allow the normal provisioning window to complete.
    The extension remains in Creating or reports Provisioning failedOpen the extension in the Azure portal and select View detailed status. Review the platform logs listed later in this section.Run the Client Analyzer and address the reported connectivity, policy, package, or service issue before retrying.
    The extension succeeds, but the device doesn't appear in the Microsoft Defender portalVerify onboarding status, connectivity, and that the device is associated with the intended Defender for Endpoint organization (tenant).Allow up to 12 hours for the first subscription in a tenant or up to one hour for later machines. If the device belongs to another tenant, offboard it from that tenant before onboarding it to the intended tenant.
    The device appears, but reports unhealthy or unlicensedReview sensor health and licensing output rather than reinstalling the extension immediately.Use the platform-specific Defender for Endpoint troubleshooting guidance and collect diagnostics if the issue continues.

    Windows diagnostics

    Linux diagnostics

    • Azure portal: VM > Extensions > MDE.Linux > View detailed status
    • Extension logs: /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux/
    • Installation log: /var/log/microsoft/mdatp/install.log
    • Installation journal: sudo journalctl --no-pager | grep 'microsoft-mdatp'
    • Sensor health: mdatp health
    • If the machine is Azure Arc-enabled: azcmagent show
    • Diagnostic package: sudo mdatp diagnostic create
    • Follow Troubleshoot installation issues for Defender for Endpoint on Linux for dependency, service-account, systemd, SELinux, and noexec issues.

    Important

    Don't disable Group Policy, SELinux, mount protections, or another security control as a generic first action. Confirm the root cause and follow your organization's change-control process. If a troubleshooting procedure temporarily changes a security control, restore the control immediately after the test.

    Track Defender for Endpoint deployment status

    You can use the Defender for Endpoint deployment status workbook to track the Defender for Endpoint deployment status on your Azure VMs and Azure Arc-enabled VMs. The interactive workbook provides an overview of machines in your environment showing their Defender for Endpoint extension deployment status.

    To remove the Defender for Endpoint solution from your machines:

    1. To disableSign in to the integration, inAzure portal.
    2. Go to Microsoft Defender for Cloud, go toCloud > Environment settings, thenand select the subscription with the relevant machines.subscription.
    3. In the Defender plans page, selectGo to Settings & Monitoringand monitoring > Endpoint protection.
    4. In the status of theToggle Endpoint protection component, selectto Off to disable the integration with Defender for Endpoint for the subscription..
    5. Select Continue and.
    6. Select Save to save your settings..
    7. Remove the MDE.Windows or MDE.Linux extension from the machine.
    8. Offboard the device from the Microsoft Defender for Endpoint service.

    Remove Defender for Endpoint integration tags