Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson explains how to onboard Windows devices into Microsoft Defender for Endpoint and why onboarding matters for Microsoft security operations.
For the SC-200 exam, this topic is important because a Security Operations Analyst needs to understand how endpoint telemetry gets into the Microsoft Defender portal. If a device is not onboarded into Defender for Endpoint, analysts will not have full endpoint detection and response visibility for that machine.
This lesson focuses on two onboarding approaches:
- Automatic onboarding at scale using Microsoft Intune
- Manual onboarding using a local script
The main exam idea is simple: before analysts can investigate endpoint alerts, run response actions, review device timelines, or correlate endpoint activity in Microsoft Defender XDR, the endpoint must first be onboarded into Defender for Endpoint.
Key Concepts
Microsoft Defender for Endpoint Onboarding
Microsoft Defender for Endpoint onboarding is the process of connecting a device to Microsoft Defender for Endpoint so the device can send security telemetry to Microsoft Defender XDR.
Once onboarded, the device can appear in the Microsoft Defender portal under:
Assets > Devices
From there, analysts can investigate device risk, alerts, exposure, logged-on users, device timeline events, vulnerabilities, and security recommendations.
Onboarding is not just “installing antivirus.” Windows devices may already have Microsoft Defender Antivirus, but that does not automatically mean they are fully onboarded into Defender for Endpoint for EDR visibility.
Why Onboarding Matters
Defender for Endpoint onboarding enables:
- Endpoint detection and response
- Device inventory visibility
- Alert generation
- Device timeline investigation
- Advanced hunting data
- Automated investigation and remediation
- Isolation and containment actions
- Vulnerability and exposure visibility
- Correlation with Microsoft Defender XDR incidents
For SC-200, remember that endpoint investigation depends on the endpoint being onboarded and reporting correctly.
Microsoft Defender XDR and Defender for Endpoint Relationship
Microsoft Defender XDR is the unified security operations experience that brings together alerts, incidents, identities, endpoints, email, SaaS apps, and cloud resources.
Microsoft Defender for Endpoint is one of the Defender workloads that feeds endpoint signals into Defender XDR.
In this lesson, the onboarded machine becomes visible in the Defender portal so it can contribute endpoint data to security operations workflows.
Defender for Endpoint Provides Endpoint-Level Visibility
Defender for Endpoint is used for:
- Windows client and server monitoring
- Endpoint alerts
- Device inventory
- Endpoint investigation
- Device timeline
- Threat and vulnerability management
- Endpoint containment and remediation
- Attack surface reduction visibility
- Security recommendations
Defender XDR Correlates Endpoint Data
Microsoft Defender XDR can correlate endpoint activity with:
- Microsoft Defender for Office 365 email threats
- Microsoft Defender for Identity identity signals
- Microsoft Defender for Cloud Apps SaaS activity
- Microsoft Entra ID identity activity
- Defender for Endpoint device activity
This is why onboarding devices correctly matters. If the endpoint is missing, the investigation picture is incomplete.
Automatic Onboarding with Microsoft Intune
The preferred method for onboarding many Windows devices is to use Microsoft Intune.
Manual onboarding might be fine for a lab or a small number of devices, but it does not scale well. In an enterprise environment, you need a centralized deployment method.
Intune can automatically onboard supported Windows devices into Microsoft Defender for Endpoint when the proper connection is configured between Intune and Defender for Endpoint.
Prerequisites for Intune-Based Onboarding
The lesson highlights several requirements before automatic onboarding can work.
1. Devices Must Be Enrolled or Managed
Devices need to be managed through Intune. This often happens when users sign in to a Windows device and the device becomes joined or registered with Microsoft Entra ID.
In a typical Microsoft cloud-managed environment, the flow may look like this:
- User signs in to the Windows device.
- The device joins or registers with Microsoft Entra ID.
- The device enrolls into Intune through automatic MDM enrollment.
- Intune applies security and device management policies.
- Defender for Endpoint onboarding can be pushed through Intune.
2. Microsoft Entra ID Device Settings Must Allow Device Join
In Microsoft Entra ID, device settings control whether users can join devices to the tenant.
Relevant area:
Microsoft Entra ID > Devices > Device settings
The lesson shows that users are allowed to join devices. This supports the device enrollment workflow.
3. Automatic MDM Enrollment Must Be Enabled
Automatic enrollment into Intune is controlled through the mobility settings.
Relevant area:
Microsoft Entra ID > Mobility > Microsoft Intune
This is where automatic MDM enrollment is configured.
If automatic enrollment is enabled and the user is properly licensed, Windows devices can be enrolled into Intune automatically.
4. Users Need Proper Licensing
The signed-in user needs a license that supports the required Microsoft Intune and Defender capabilities.
The lesson uses a Microsoft 365 E5-style licensing example.
For the SC-200 exam, remember that licensing and enrollment state matter. If the device is not managed by Intune, Intune-based onboarding will not work as expected.
Connecting Microsoft Defender for Endpoint and Intune
Intune cannot automatically onboard Windows devices into Defender for Endpoint unless Microsoft Defender for Endpoint and Intune are connected.
This connection is configured from the Microsoft Defender portal.
Path:
Microsoft Defender portal > Settings > Endpoints > Advanced features
The key setting is the integration between Microsoft Defender for Endpoint and Microsoft Intune.
Once enabled, Intune can use Defender for Endpoint settings for endpoint security management and device onboarding.
Intune Defender for Endpoint Settings
After enabling the connection on the Defender side, you can go to the Intune admin center.
Path:
Intune admin center > Endpoint security > Microsoft Defender for Endpoint
This area contains settings that control how Intune integrates with Defender for Endpoint.
Important settings include:
- Allow Microsoft Defender for Endpoint to enforce endpoint security configurations
- Connect Windows devices to Microsoft Defender for Endpoint
- Platform-specific onboarding options
If the Defender-to-Intune connection is not configured, these options may be unavailable or grayed out.
Key Exam Point
For automatic onboarding with Intune, there are two sides to check:
- Microsoft Defender portal: Enable the Defender for Endpoint / Intune connection.
- Intune admin center: Enable the relevant Defender for Endpoint onboarding options for supported devices.
Onboarding Methods for Defender for Endpoint
Microsoft supports multiple onboarding methods depending on the device type and management platform.
Common Windows onboarding methods include:
- Microsoft Intune
- Microsoft Configuration Manager
- Group Policy
- Local script
- VDI onboarding
- Azure Virtual Desktop deployment methods
- System Center Endpoint Protection in some legacy scenarios
Other supported platforms include:
- Windows Server
- macOS
- Linux
- Android
- iOS
For the SC-200 exam, pay attention to the workload and platform in the question. The correct onboarding method depends on whether the device is managed by Intune, ConfigMgr, Group Policy, or another deployment mechanism.
Manual Onboarding with Local Script
The lesson demonstrates manual onboarding using a local script.
This method is useful for:
- Labs
- Testing
- Demonstrations
- Small numbers of devices
- Break-glass scenarios
- Devices not yet managed by Intune or ConfigMgr
It is not the best approach for large-scale enterprise deployment.
Local Script Onboarding Workflow
The manual onboarding process follows this general workflow:
- Open the Microsoft Defender portal.
- Go to Settings.
- Select Endpoints.
- Go to Onboarding.
- Select the operating system.
- Choose the deployment method, such as Local script.
- Download the onboarding package.
- Copy the onboarding script to the target machine.
- Open Terminal or Command Prompt as administrator.
- Run the onboarding script.
- Confirm the prompt.
- Wait for the device to appear in the Microsoft Defender portal.
Important Timing Detail
After onboarding, the device may not appear instantly.
The lesson notes that it can take several minutes for the machine to show up in the Defender portal. A common expectation is that the device may appear within a few minutes, but analysts should allow time for cloud processing and portal refresh.
For exam purposes, do not assume that onboarding failure occurred just because the device does not appear immediately.
Standard vs Streamlined Onboarding
The lesson mentions two onboarding experiences:
Standard Onboarding
Standard onboarding displays information during the onboarding process. This is useful when you want to see script execution details and confirm the process interactively.
Best for:
- Labs
- Manual testing
- Troubleshooting
- Learning the onboarding process
Streamlined Onboarding
Streamlined onboarding is more background-oriented and less visible to the user.
Best for:
- More automated deployment workflows
- Lower-touch deployment scenarios
- Production-style onboarding where user interaction should be minimized
For the exam, the bigger point is not necessarily the naming of the mode, but the difference between an interactive onboarding approach and a more silent deployment approach.
Verifying Onboarding
Once onboarding completes, the device should eventually appear in the Defender portal.
Path:
Microsoft Defender portal > Assets > Devices
From the device inventory, analysts can review information such as:
- Device name
- Health state
- Risk level
- Exposure level
- Operating system
- Last seen time
- Onboarding status
- Associated alerts
- Logged-on users
- Device timeline
In the lab example, the Windows machine appears after the portal is refreshed.
Microsoft Security Operations Context
In a real SOC workflow, onboarding is foundational.
If the device is not onboarded, the SOC may be blind to endpoint activity. That means analysts may miss process execution, file activity, network connections, malware detections, and device timeline events.
How an Analyst Uses an Onboarded Device
Once a device is onboarded, an analyst can:
- Triage endpoint alerts
- Review the device timeline
- Investigate suspicious processes
- Identify logged-on users
- Review file activity
- Check network connections
- Determine whether the device is exposed or vulnerable
- Isolate the device if necessary
- Run antivirus scans or investigation packages
- Collect evidence
- Escalate to endpoint engineering or infrastructure teams
Example SOC Workflow
A typical endpoint investigation might look like this:
- An incident is generated in Microsoft Defender XDR.
- The incident includes an endpoint alert from Defender for Endpoint.
- The analyst opens the affected device entity.
- The analyst reviews the device timeline.
- The analyst checks related users, files, processes, and IP addresses.
- The analyst determines whether the alert is true positive or false positive.
- The analyst takes containment action if needed.
- The analyst documents findings and updates the incident.
- The analyst recommends detection or policy improvements.
None of this works well if the endpoint is not onboarded and reporting telemetry.
Incident Investigation Relevance
Defender for Endpoint onboarding affects several investigation areas.
Alerts
An alert is a specific detection. For example, suspicious PowerShell execution or malware activity on a device.
Incidents
An incident groups related alerts and evidence together. Defender XDR can combine endpoint, identity, email, and cloud alerts into one incident.
Entities
Entities are objects involved in an investigation. Examples include:
- Devices
- Users
- IP addresses
- Files
- URLs
- Mailboxes
- Cloud apps
Evidence
Evidence includes the specific artifacts associated with an alert or incident, such as a malicious file, suspicious process, command line, or network connection.
Why Onboarding Matters
If a device is not onboarded into Defender for Endpoint, it may not provide the endpoint evidence needed for investigation.
Exam-Relevant Takeaways
For the SC-200 exam, remember these points:
- Use Microsoft Defender for Endpoint for endpoint detection, investigation, and response.
- Use Microsoft Intune for scalable onboarding of managed Windows devices.
- Use local script onboarding for labs, testing, or small-scale manual onboarding.
- A device enrolled in Intune is not automatically useful for Defender for Endpoint unless the Defender for Endpoint integration is configured.
- Enable the connection between Defender for Endpoint and Intune in the Microsoft Defender portal.
- Configure Defender for Endpoint onboarding options in the Intune admin center.
- Devices appear in the Defender portal under Assets > Devices.
- Device onboarding may take several minutes to appear in the portal.
- Microsoft Entra ID join and Intune automatic enrollment are part of the device management path.
- Proper licensing is required.
- Different platforms have different onboarding methods.
- For large environments, avoid manual onboarding as the primary deployment method.
- For endpoint investigations, the affected device must be onboarded and reporting telemetry.
Tool / Feature Decision Guide
| Scenario | Best Microsoft Security Tool or Feature | Why |
|---|---|---|
| You need to onboard hundreds of managed Windows devices into Defender for Endpoint | Microsoft Intune | Intune provides scalable policy-based onboarding for managed devices. |
| You need to onboard one lab VM for testing | Local script onboarding | A local script is simple and fast for a small number of devices. |
| You need to verify whether an endpoint is visible to security operations | Microsoft Defender portal > Assets > Devices | This is where onboarded Defender for Endpoint devices appear. |
| You need to enable Defender for Endpoint integration with Intune | Microsoft Defender portal > Settings > Endpoints > Advanced features | The Defender-side connection must be enabled before Intune options are available. |
| You need to configure Defender for Endpoint onboarding settings for managed devices | Intune admin center > Endpoint security > Microsoft Defender for Endpoint | Intune controls onboarding and endpoint security settings for managed devices. |
| You need endpoint telemetry for investigation | Microsoft Defender for Endpoint | Defender for Endpoint provides EDR visibility, device timeline, alerts, and response actions. |
| You need cross-domain incident correlation across endpoint, identity, and email | Microsoft Defender XDR | Defender XDR correlates alerts and evidence across Microsoft security workloads. |
| You need centralized SIEM correlation using logs from Microsoft and non-Microsoft sources | Microsoft Sentinel | Sentinel is the cloud-native SIEM/SOAR platform. |
| You need to onboard devices that are not Intune-managed but are domain-joined | Group Policy or Configuration Manager | These are better enterprise deployment methods than local scripts for traditional environments. |
| You need to investigate suspicious activity on a device | Defender for Endpoint device page and timeline | The device page provides endpoint investigation details. |
Defender for Endpoint vs Microsoft Sentinel
| Need | Microsoft Defender for Endpoint | Microsoft Sentinel |
|---|---|---|
| Endpoint detection and response | Yes | Not directly; Sentinel can ingest endpoint data |
| Device timeline investigation | Yes | No, Sentinel uses log queries and incidents |
| Device isolation | Yes | Can trigger through automation/playbooks if integrated |
| SIEM correlation across many sources | Limited compared to Sentinel | Yes |
| KQL log hunting across connected sources | Advanced Hunting in Defender XDR | Log Analytics workspace in Sentinel |
| Third-party log ingestion | Not the primary purpose | Yes |
| Endpoint onboarding required | Yes | No, but endpoint data must be connected if needed |
Exam Tip
If the scenario is specifically about endpoint onboarding, device timeline, endpoint alerts, or device containment, the answer is usually Microsoft Defender for Endpoint.
If the scenario is about SIEM, log ingestion, analytics rules, data connectors, or cross-source correlation, the answer is usually Microsoft Sentinel.
Incidents vs Alerts
| Concept | Meaning | Example |
|---|---|---|
| Alert | A single detection from a security product | Suspicious PowerShell activity detected on a device |
| Incident | A grouped investigation containing related alerts and evidence | Endpoint alert + identity alert + suspicious email campaign |
| Entity | An object involved in an investigation | Device, user, IP address, file, mailbox |
| Evidence | Specific artifact associated with the alert or incident | File hash, process command line, URL, sender address |
Exam Tip
Do not confuse alerts and incidents. An incident can contain multiple alerts, and alerts can contain evidence and entities.
KQL Notes
This lesson does not focus on KQL. However, onboarding devices into Defender for Endpoint is what enables endpoint data to become available for hunting and investigation.
In Microsoft Defender XDR Advanced Hunting, endpoint-related tables may include data such as:
- Device process events
- Device network events
- Device file events
- Device logon events
- Device registry events
Simple Example: Find Recent Activity for a Specific Device
DeviceProcessEvents
| where DeviceName == "NYC-CL-11"
| sort by Timestamp desc
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
What This Query Does
| Query Part | Purpose |
|---|---|
DeviceProcessEvents | Searches process execution telemetry from onboarded devices. |
where DeviceName == "NYC-CL-11" | Filters results to one specific device. |
sort by Timestamp desc | Shows the newest events first. |
project | Displays only the columns useful for quick review. |
Exam-Relevant KQL Point
KQL is useful only when the relevant data exists. If a device is not onboarded into Defender for Endpoint, endpoint hunting tables may not contain the telemetry needed for investigation.
Common Exam Traps
Trap 1: Assuming Intune Enrollment Means Defender for Endpoint Onboarding
A device can be enrolled in Intune without being properly onboarded into Defender for Endpoint.
For Defender for Endpoint visibility, the Defender integration and onboarding configuration must be in place.
Trap 2: Choosing Local Script for Enterprise Deployment
Local script onboarding works for a lab or a small number of machines, but it is not the best answer for hundreds of managed endpoints.
For scale, choose Intune, Configuration Manager, or Group Policy depending on the environment.
Trap 3: Confusing Defender for Endpoint with Defender Antivirus
Microsoft Defender Antivirus provides antivirus protection. Microsoft Defender for Endpoint provides EDR, device investigation, timeline, vulnerability visibility, and response actions.
They are related but not the same thing.
Trap 4: Looking in the Wrong Portal
For Defender for Endpoint device investigation, use the Microsoft Defender portal.
For onboarding policy and managed endpoint configuration, use Intune.
For identity directory and device join settings, use Microsoft Entra ID.
Trap 5: Expecting Instant Device Visibility
After onboarding, devices may take time to appear in the Defender portal. A short delay does not automatically mean onboarding failed.
Trap 6: Ignoring Licensing
Many Microsoft security features depend on the proper license. If a scenario mentions users or devices without proper licensing, automatic onboarding or advanced Defender features may not work.
Trap 7: Confusing Microsoft Defender XDR and Microsoft Sentinel
Defender XDR provides integrated investigation across Microsoft Defender workloads.
Sentinel is a SIEM/SOAR platform that ingests data from Microsoft and non-Microsoft sources.
Real-World SOC Analyst Notes
Onboarding Is a Visibility Requirement
A SOC cannot investigate what it cannot see. If a workstation, server, or VDI system is not onboarded, endpoint telemetry may be missing from incidents and hunting queries.
Validate Onboarding Before Relying on Detections
In production, it is not enough to deploy onboarding policies. You should confirm that devices are actually appearing in Defender for Endpoint and reporting recently.
Useful validation checks include:
- Device appears in Defender portal
- Last seen time is current
- Sensor health is healthy
- Device risk and exposure data populate
- Alerts generate when expected
- Device timeline contains events
Avoid One-Off Manual Processes at Scale
Manual onboarding creates operational risk because it depends on an administrator touching individual machines.
For large environments, use centralized deployment such as:
- Intune
- Configuration Manager
- Group Policy
- VDI image-based onboarding
- Server onboarding through supported management methods
Coordinate with Endpoint and Infrastructure Teams
Defender onboarding can involve multiple teams:
- Endpoint management team
- Microsoft 365 security team
- Identity team
- Server team
- VDI team
- Network team
- Change management team
A SOC analyst may not own deployment, but they need to know whether missing telemetry is due to an onboarding, licensing, health, or configuration issue.
Be Careful with Tenant-Wide Changes
Enabling Intune and Defender integration can affect large groups of devices. In real environments, this should follow change control and pilot testing.
Consider:
- Pilot groups
- Exclusions
- Rollback plans
- User impact
- Sensor health
- Network connectivity
- Proxy/firewall requirements
- Device platform support
Document the Onboarding Method
For incident response and operations, document how each device category is onboarded.
Examples:
- Corporate laptops: Intune
- Domain-joined desktops: Group Policy
- Servers: Defender for Cloud or onboarding package
- VDI: Golden image onboarding process
- macOS: Intune or Jamf
- Linux: Defender deployment package or management tooling
Alert Fatigue Depends on Coverage Quality
Poor onboarding creates uneven visibility. Some devices generate telemetry and alerts, while others remain invisible. This creates a false sense of security and makes incident scoping harder.
Quick Reference Summary
- Defender for Endpoint onboarding connects devices to Microsoft Defender XDR for endpoint telemetry.
- Onboarded devices appear under Assets > Devices in the Microsoft Defender portal.
- Intune is the preferred method for scalable onboarding of managed Windows devices.
- Local script onboarding is useful for labs and small-scale manual testing.
- Microsoft Entra ID join and Intune automatic enrollment help get devices managed.
- Defender for Endpoint and Intune must be connected before Intune can onboard devices.
- Configure the Defender-side connection in the Microsoft Defender portal.
- Configure onboarding options in the Intune admin center.
- Device visibility may take several minutes after onboarding.
- Defender Antivirus and Defender for Endpoint are related but not the same.
- For endpoint investigation, use Defender for Endpoint.
- For SIEM ingestion and analytics rules, use Microsoft Sentinel.
- For identity directory/device join settings, use Microsoft Entra ID.
- For managed endpoint security policy deployment, use Intune.
Flashcards
Q: What is Microsoft Defender for Endpoint onboarding?
A: It is the process of connecting a device to Defender for Endpoint so it can send endpoint telemetry to Microsoft Defender XDR.
Q: Where do onboarded devices appear in the Microsoft Defender portal?
A: Under Assets > Devices.
Q: What is the best onboarding method for hundreds of Intune-managed Windows devices?
A: Microsoft Intune-based onboarding.
Q: When is local script onboarding most appropriate?
A: For labs, testing, demonstrations, or a small number of devices.
Q: Which portal is used to enable the Defender for Endpoint connection to Intune?
A: The Microsoft Defender portal under Settings > Endpoints > Advanced features.
Q: Which portal is used to configure Defender for Endpoint onboarding settings for managed devices?
A: The Intune admin center under Endpoint security > Microsoft Defender for Endpoint.
Q: Does Intune enrollment automatically guarantee Defender for Endpoint onboarding?
A: No. The Defender for Endpoint integration and onboarding settings must be configured.
Q: Why does Defender for Endpoint onboarding matter to a SOC analyst?
A: It provides endpoint telemetry, alerts, device timeline data, and response capabilities needed for investigation.
Q: What Microsoft product is used for endpoint detection and response?
A: Microsoft Defender for Endpoint.
Q: What Microsoft product is used as a cloud-native SIEM/SOAR platform?
A: Microsoft Sentinel.
Q: What is the difference between an alert and an incident?
A: An alert is a single detection, while an incident groups related alerts, entities, and evidence.
Q: What should an analyst remember if a newly onboarded device does not appear immediately?
A: Device visibility can take several minutes after onboarding.
Q: What role does Microsoft Entra ID play in this workflow?
A: It supports device join/registration and automatic enrollment into device management workflows.
Q: Why is manual onboarding not ideal for enterprise scale?
A: It is difficult to manage consistently across many devices and lacks the scalability of centralized deployment tools.
Q: What type of data can become available for hunting after Defender for Endpoint onboarding?
A: Endpoint telemetry such as process events, file events, logon events, network events, and registry activity.
Practice Questions
Question 1:
A company has 600 Windows laptops enrolled in Microsoft Intune. The security team wants all laptops to automatically onboard into Microsoft Defender for Endpoint. What should you configure?
A. Download the local onboarding script and run it manually on each laptop
B. Enable the Defender for Endpoint integration with Intune and configure Defender onboarding in Intune
C. Create a Microsoft Sentinel analytics rule
D. Enable Microsoft Defender Antivirus only
Correct Answer:
B. Enable the Defender for Endpoint integration with Intune and configure Defender onboarding in Intune
Explanation:
For scalable onboarding of Intune-managed Windows devices, configure the Defender for Endpoint and Intune integration, then enable the appropriate onboarding settings in Intune. Local scripts are not the best choice for hundreds of devices.
Question 2:
You manually onboard a Windows test VM into Microsoft Defender for Endpoint using a local script. After the script completes successfully, the device does not immediately appear in the Defender portal. What should you do first?
A. Reinstall Windows
B. Assume the onboarding package is invalid
C. Wait several minutes and refresh the device inventory
D. Create a Microsoft Sentinel workbook
Correct Answer:
C. Wait several minutes and refresh the device inventory
Explanation:
Newly onboarded devices may take several minutes to appear in the Microsoft Defender portal. A short delay does not necessarily indicate failure.
Question 3:
A SOC analyst needs to investigate suspicious process execution on a Windows endpoint. Which Microsoft security product provides the device timeline and endpoint investigation details?
A. Microsoft Defender for Endpoint
B. Microsoft Entra ID
C. Microsoft Purview
D. Microsoft Defender for Office 365
Correct Answer:
A. Microsoft Defender for Endpoint
Explanation:
Defender for Endpoint provides endpoint detection and response capabilities, including device timeline, process activity, alerts, and response actions.
Question 4:
A device is visible in Intune but does not appear in Microsoft Defender portal under Assets > Devices. What is the most likely issue?
A. The device cannot be managed by Intune
B. Microsoft Sentinel is not enabled
C. Defender for Endpoint onboarding or integration is not configured correctly
D. The device must be deleted from Microsoft Entra ID
Correct Answer:
C. Defender for Endpoint onboarding or integration is not configured correctly
Explanation:
Intune enrollment and Defender for Endpoint onboarding are related but separate. A device can be managed by Intune without being fully onboarded into Defender for Endpoint.
Question 5:
Which tool should you use to centrally onboard Intune-managed Windows devices into Defender for Endpoint?
A. Microsoft Intune
B. Microsoft Purview
C. Microsoft Defender for Office 365
D. Microsoft Teams admin center
Correct Answer:
A. Microsoft Intune
Explanation:
Microsoft Intune is used to manage devices and can deploy Defender for Endpoint onboarding settings to supported managed endpoints.