Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Use Direct onboarding for on-premises servers - Microsoft Defender for Cloud | Microsoft Learn

20 October 2026Feature updateAction required+49 / −55 lines

In brief

The procedure now states that direct onboarding affects all eligible existing and future non-Azure servers in the same Microsoft Entra tenant. Individual-server or pilot-group selection isn't supported, and prerequisites include healthy Defender for Endpoint telemetry, a matching tenant, and specific roles.

What Defender admins need to know

Review the full affected population, including Azure Arc-connected servers, and verify prerequisites before enabling the setting.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Onboard Non-Azure Servers with DefenderUse Direct onboarding for Endpointon-premises servers - Microsoft Defender for Cloud | Microsoft Learn

MicrosoftUse this procedure only when you choose to associate eligible servers already reporting to Defender for Cloud lets you onboard on-premises and multicloud servers through MicrosoftEndpoint with Defender for Endpoint. This setup protects non-Servers through an Azure machines withoutsubscription. Direct onboarding doesn't install the needendpoint agent and isn't required to continue using an existing Defender for any additional agents and shows all servers, Azure and non-Azure, in one unified security view.Endpoint deployment.

Note

To connect your non-Azure machines via Azure Arc, see Connect on-premises servers to Defender for Servers.

How it worksWho is affected

Direct onboarding is a native integration between Defender for Endpoint and Defender for Cloud. When enabled, non-Azure servers with Defender for Endpoint appear in Defender for Cloud under the selected subscription.Important

Defender for Cloud uses the selected subscription for licensing, billing, alerts, and security insights. This subscription doesn’t support Azure management capabilities such as Azure Policy or Guest Configuration. Use other toolsThe setting applies to manage security settings, such as antivirus policies, attack surface reduction rules, and updates.

Manage security settings

Server typeManagement options
Windows ServerDefender for Endpoint security settings managementConfiguration ManagerGroup PolicyPowerShellWMI
Linux ServerDefender for Endpoint security settings managementConfigure security settings in Defender for Endpoint on Linux

Availability

This capability is generally available (GA) and supports on-premises servers and multicloud VMs.

Supported operating systems include all Windows Server and Linux server versions supported by Defender for Endpoint. For OS-specific requirements, see:

This capability works with both:

  • Defender for Servers Plan 1 (P1)
  • Defender for Servers Plan 2 (P2) (with limitations)

Enable direct onboarding

When you enable direct onboarding, Defender for Cloud applies the setting to both existing and newfuture eligible non-Azure servers onboarded to Defender for Endpoint in the same Microsoft Entra tenant. After you enable it, yourYou can't select individual servers appear underor limit it to a pilot group.

Review the full affected population before enabling the setting, including servers with an existing Azure Arc connection.

Prerequisites

  • Servers meet Defender for Endpoint requirements and report healthy telemetry.
  • The selected Azure subscription and Defender for Endpoint use the same Microsoft Entra tenant.
  • You have the Owner role on the selected subscription,Azure subscription and their alerts, vulnerability data, and inventory integrate with Defender for Cloud.

    Before you begin:

    the Security Administrator role or a higher-privileged role in Microsoft Entra ID.
  • Required features are available through this connection. Review feature limits before choosing a plan.

Important

If you have both Microsoft Defender for Endpoint for Servers licenses and Defender for Servers enabled, request the billing discount to avoid double billing. For steps, see Can I get a discount if I already have a Microsoft Defender for Endpoint license?.

  • Make sure you have the required permissions:
    • Subscription Owner permissions on the subscription you select for onboarding.
    • Microsoft Entra Security Administrator (or higher) permissions on the tenant.
  • Review the current limitations

Enable in the Defender for Cloud portal

Configure Direct onboarding

To enable directDirect onboarding in the Defender for CloudAzure portal:

  1. Sign in to the Azure portal.
  2. Search for and select Defender for Cloud.
  3. Go to Environment settings > Direct onboarding.
  4. Toggle directSet Direct onboarding to On.
  5. Select the subscription you want to use for servers onboarded through Defender for Endpoint.
  6. Select Save.

Non-Azure servers might take up to 24 hours to appear in the selected subscription.

Deploy

Verify Direct onboarding

  1. In Defender for Endpoint on yourCloud, confirm that representative affected servers

    Deploy appear under the Defender for Endpoint agentselected subscription with the same way on Windows and Linux servers, with or without direct onboarding. See Onboard servers to Defender for Endpoint for more information.

    Current limitations

    • Plan support – Direct onboarding provides all Defender for Servers Plan 1 features. Some Defender for Servers Plan 2 features still require Azure Arc. If you enable Plan 2, directly onboarded servers gain Plan 1 + Defender Vulnerability Management features.

      intended plan.

    • Multicloud support – Direct onboarding supports AWS and GCP VMsCheck endpoint health separately using the Defenderonboarding checks.

    • Check for Endpoint agent. However, if you also connect your AWS or GCP account to Defender for Servers via multicloud connectors, we still recommend using Azure Arc.

      duplicate records. Keep the endpoint agent current; older versions can interfere with correlation when a server uses multiple connection methods.

Simultaneous onboarding –The following minimum agent versions help Defender for Cloud automatically correlatescorrelate servers onboarded throughthat use multiple methods. Older Defender for Endpoint agent versions might limit this behavior and, in rare cases, cause duplicate billing. Ensure agents meet or exceed these minimum versions:connection methods:

Operating Systemsystem Minimum agent version
Windows Server 2019 and later 10.8555
Windows Server 2016 or Windows Server 2012 R2 (modern, unified solution) 10.8560
Linux (AMD64) 30.101.23052.009
Linux (ARM64) 30.101.25022.004

Feature limits

Direct onboarding supports Defender for Servers Plan 1 and a subset of Plan 2 capabilities. Some Plan 2 features still require Azure Arc. Review plan feature requirements for your workloads.

Direct onboarding supports AWS and GCP VMs using the Defender for Endpoint agent. If you also connect the AWS or GCP account through a multicloud connector, use Azure Arc to access Arc-dependent capabilities.

Direct onboarding doesn't provide Azure management capabilities such as Azure Policy or Guest Configuration. Continue to manage endpoint settings through your existing supported tools.

Manage security settings

\ No newline at end of file

Server typeManagement options
Windows ServerDefender for Endpoint security settings managementConfiguration ManagerGroup PolicyPowerShellWMI
Linux ServerDefender for Endpoint security settings managementConfigure security settings in Defender for Endpoint on Linux
\ No newline at end of file