Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Architecture and deployment

Onboard servers to Microsoft Defender - Microsoft Defender for Endpoint | Microsoft Learn

20 October 2026Doc update+73 / −63 lines

In brief

The guide now distinguishes automatic onboarding, manual deployment, and servers already reporting to Defender for Endpoint. It adds prerequisites, rollout preparation guidance, antivirus coexistence considerations, and a warning that Direct onboarding has tenant-wide scope.

What Defender admins need to know

Administrators can use the updated guidance to select and plan a deployment method. Existing servers already reporting to Defender for Endpoint do not require onboarding, reinstallation, or migration.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Onboard servers throughto Microsoft Defender for Endpoint's onboarding experience - Microsoft Defender for Endpoint | Microsoft Learn

Overview

Defender for EndpointUse this guide to prepare and onboard new servers. Defender for Endpoint can help protect your organization's servers with capabilities that include posture management, threat protection, and endpoint detection and response.response, and integration with Defender for Servers.

For servers already running Defender for Endpoint, see Existing deployments. Those servers don't require onboarding, reinstallation, or migration to maintain their existing Defender for Endpoint provides your security team with deeper insight into server activities, coverage for kernel and memory attack detection, and the ability to take response actions when necessary. Defender for Endpoint also integrates with Microsoft Defender for Cloud, providing your organization with a comprehensive server protection solution.

Depending on your particular environment, you can choose from several options to onboard servers to Defender for Endpoint. This article describes available options for Windows Server and Linux, important points to consider, how to run a detection test after onboarding, and how to offboard servers.

Note

The Defender deployment tool can be used to deploy Defender endpoint security on Windows and Linux devices. The tool is a lightweight, self-updating application that streamlines the deployment process. For more information, see Deploy Microsoft Defender endpoint security to Windows devices using the Defender deployment tool and Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool (preview).protection.

Tip

For a customized experience based on your environment, you can access the Security Analyzer automated setup guide in the Microsoft 365 admin center.

Choose a deployment method

ServerMethod
Supported Azure VM or Azure Arc-enabled server in an enabled subscriptionAutomatic onboarding
Server you manage through an endpoint deployment toolManual deployment
Server already reporting to Defender for EndpointNo deployment changes required

Prerequisites

Prepare the rollout

  • Record the target servers, operating systems, responsible owners, and required protection features.
  • Agree on a change window and the method for offboarding or reinstalling endpoint software if needed.
  • For methods that support a pilot, start with representative servers. Expand after completing the onboarding checks and access checks.

Before choosing Direct onboarding, review its tenant-wide scope. You can't limit Direct onboarding to a pilot group.

Server plans

Here are a few things to keep in mind:

  • When you use Defender for Cloud to monitor servers, a Defender for Endpoint tenant is created automatically. Data collected by Defender for Endpoint is stored in the geographical location of the tenant, identified during provisioning. (For example, in the US for customers in the USA; in EU for European customers; and in the UK for customers in the United Kingdom.)
  • If you use Defender for Endpoint before using Defender for Cloud, your data is stored in the location you specified when you created your tenant, even if you integrate with Defender for Cloud at a later time.
  • Once configured, you can't change the location of where your data is stored. To move your data to another location, contact support to reset your tenant.
  • Server endpoint monitoring utilizing this integration isn't currently available for Office 365 GCC customers.

For more information, see Protect your endpoints with Defender for Endpoint integration with Defender for Cloud.

Onboard automatically

  1. Enable Defender for Servers on the subscription containing the Azure VM or Azure Arc resource.
  2. Review Defender for Endpoint integration settings and prerequisites.
  3. Allow deployment to complete, and then perform the onboarding checks.

Important information for non-Microsoft antivirus/anti-malware solutions

If you intend to use a non-Microsoft anti-malware solution, you need to run Microsoft Defender Antivirus in passive mode. Make sure to set passive mode during the installation and onboarding process. For more information, see Windows Server and passive mode.

If you're installing Defender for Endpoint on servers running McAfee Endpoint Security or VirusScan Enterprise, the McAfee platform version might need to be updated to ensure that Microsoft Defender Antivirus isn't removed or disabled. For more information on specific version numbers required, see the McAfee Knowledge Center article.

Server onboarding optionsDeploy Defender for Endpoint manually

You can choose from severalChoose the deployment methodsmethod that matches your server and tools to onboard servers, as summarizedmanagement approach. Follow the linked procedure in the following table:table to complete deployment, including downloading any required installation or onboarding packages.

Operating system Deployment method
Windows Server 2012 R2 and laterlater, Windows Server,Server version 18031803, and Azure Stack HCI OS,OS version 23H2 and later Local script (uses an onboarding package)Defender for ServersMicrosoft Configuration ManagerGroup PolicyVDI scriptsOnboarding with Defender for CloudModern, unified solution for Windows Server 2016 and 2012 R2
Linux Installer script-based deploymentAnsible-based deploymentChef-based deploymentPuppet-based deploymentSaltstack-based deploymentManual deployment (uses a local script) Direct onboarding with Defender for CloudConnect your non-Azure machines to Microsoft Defender for Cloud with Defender for EndpointDeployment guidance for Defender for Endpoint on Linux for SAP

Onboard Windows Server, version 1803, Windows Server 2019,2019 and Windows Server 2025,later, and Azure Stack HCI OS, version 23H2 and later.

Server Onboarding

OS

  1. Make sure to reviewReview the minimum requirements for Defender for Endpoint.

  2. InUse Choose a deployment method to select the Microsoft Defender portal, go to Settings > Endpoints, and then, under Device management, select Onboarding.

    appropriate onboarding method for your server.

  3. InIf you're deploying Defender for Endpoint manually, follow Deploy Defender for Endpoint manually for the Select operating system to start onboarding process list, select Windows Server 2019, 2022, and 2025.

    Screenshot showing the onboarding screen for Windows Server 2019 and later in Defender for Endpoint.

    selected method.

  4. Under Connectivity type, select either Streamlined or Standard. (See prerequisites for streamlined connectivity.)

  5. Under Deployment method, select an option, and then downloadComplete the onboarding package.

  6. Follow the instructions in one of the following articles for your deployment method:

    checks after deployment.

Onboard Windows Server 2016 and Windows Server 2012 R2

An illustration of onboarding flow for Windows Servers and Windows 10 devices.

  1. Make sure to reviewReview the minimum requirements for Defender for Endpoint and Prerequisitesthe prerequisites for Windows Server 2016 and Windows Server 2012 R2.

  2. InUse Choose a deployment method to select the Microsoft Defender portal, go to Settings > Endpoints, and then, under Device management, select Onboarding.

    appropriate onboarding method for your server.

  3. InIf you're deploying Defender for Endpoint manually, follow Deploy Defender for Endpoint manually for the Select operating system to startselected method.

  4. Complete the onboarding process list, select checks after deployment.

Note

The installation package for Windows Server 2016 and Windows Server 2012 R2.

Screenshot showing the device onboarding page in Defender for Endpoint.

  • Under Connectivity type, select either Streamlined or Standard. (See prerequisites for streamlined connectivity.)

  • Under Deployment method, select an option, and then download the installation package and onboarding package.

    Note

    The installation package is updated monthly. Be sure toIf your deployment method requires the installation package, download the latest package before usage.deployment. To update after installation, you don't have to run the installer package again. If you do, the installer asks you to offboard first as thatbecause offboarding is a requirementrequired for uninstallation. See Update packages for Defender for Endpoint on Windows Server 2012 R2 and 2016.

  • FollowIf you're migrating from the instructions in one of the following articles for your deployment method:previous Microsoft Monitoring Agent (MMA)-based solution, see Migrate servers from Microsoft Monitoring Agent to the modern unified solution.

    • Prerequisites for Windows Server 2016 and 2012 R2

    • It's recommended to install the latest available Servicing Stack Update (SSU) and Latest Cumulative Update (LCU) on the server.
    • The SSU from September 14, 2021 or later must be installed.
    • Download and install the latest platform version using Windows Update. Alternatively, download the update package manually from the Microsoft Update Catalog or from MMPC.
    • On Windows Server 2016, Microsoft Defender Antivirus must be installed as a feature and fully updated before installation.

    Update packages for Windows Server 2016 or Windows Server 2012 R2

    To receive regular product improvements and fixes for the Defender for Endpoint component, ensure Windows Update KB5005292 gets applied or approved. In addition, to keep protection components updated, see Manage Microsoft Defender Antivirus updates and apply baselines.

    If you're using Windows Server Update Services (WSUS) and/or Microsoft Configuration Manager, this new "Microsoft Defender for Endpoint update for EDR Sensor" is available under the category "Microsoft Defender for Endpoint."

    Functionality in the modern unified solution for Windows Server 2016 and Windows Server 2012 R2

    The previous implementation (before April 2022) of onboarding Windows Server 2016 and Windows Server 2012 R2 required the use of Microsoft Monitoring Agent (MMA). The modern, unified solution package makes it easier to onboard servers by removing dependencies and installation steps. It also provides a much expanded feature set. For more information, see the following resources:

    | Windows Server 2016 | Built-in | Yes | | Windows Server 2019 and later | Built-in | Built-in |

    Known issues and limitations in the modern unified solution

    The following points apply to Windows Server 2016 and Windows Server 2012 R2:

    - [Deployment guidance for Defender for Endpoint on Linux for SAP](mde-linux-deployment-on-sap)
    1. Configure your capabilities. See Configure security settings in Microsoft Defender for Endpoint on Linux.

    Run a detection test to verifyAssociate non-Azure servers by using Direct onboarding

    AfterIf manually onboarded on-premises servers need Defender for Servers coverage, follow Direct onboarding. Review who is affected before enabling it.

    Direct onboarding isn't required merely to keep an existing Defender for Endpoint deployment operating.

    Verify onboarding

    1. Check local agent health using the device, you can choose to run a detection test toinstructions for the selected method.

    2. Find the server in the Microsoft Defender device inventory. Check its identity, sensor health, and recent activity.

    3. Run an approved detection test and confirm that the alert arrives.

    4. If Defender for Servers is required, verify that a device is properly onboarded to the service. For more information, see Run a detection test on a newly onboarded Defender for Endpoint device.its plan and subscription association in Defender for Cloud.

      Note

      Running Microsoft Defender Antivirus isn't required but it's recommended. If another antivirus vendor product is the primary endpoint protection solution, you can run Defender Antivirus in Passive mode. You can only confirm that passive mode is on after verifying that Defender for Endpoint sensor (SENSE) is running.

      1. On Windows Server devices that should have Microsoft Defender Antivirus installed in active mode, run the following command:

        sc.exe query Windefend

        If the result is, "The specified service doesn't exist as an installed service," then you need to install Microsoft Defender Antivirus.

      2. Run the following command to verify that Defender for Endpoint is running:

        sc.exe query sense

      Offboard Windows servers

      For automatic Azure offboarding, manual endpoint offboarding, and separate software-removal checks, see Offboard servers from Microsoft Defender.

      You can manually offboard Windows servers by using the same methods that are available for Windows client devices: