You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/defender-endpoint-trial-user-guide.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -69,7 +69,7 @@ This playbook is a simple guide to help you make the most of your free trial. Us
69
69
70
70
To make sure your Defender for Endpoint subscription is properly provisioned, you can check your license state in either the Microsoft 365 admin center ([https://admin.microsoft.com](https://admin.microsoft.com)) or Microsoft Entra ID ([https://portal.azure.com](https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products)).
71
71
72
-
[Check your license state](production-deployment.md#check-license-state).
72
+
[Check your license state](production-deployment.md#check-your-license-state).
73
73
74
74
## Step 2: Set up role-based access control and grant permissions to your security team
Copy file name to clipboardExpand all lines: defender-endpoint/deployment-strategy.md
+17-11Lines changed: 17 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Identify Defender for Endpoint architecture and deployment method
2
+
title: Identify your architecture and select a deployment method for Defender for Endpoint
3
3
description: Select the best Microsoft Defender for Endpoint deployment strategy for your environment.
4
4
ms.service: defender-endpoint
5
5
ms.author: deniseb
@@ -13,10 +13,10 @@ ms.collection:
13
13
ms.topic: conceptual
14
14
ms.subservice: onboard
15
15
search.appverid: met150
16
-
ms.date: 12/12/2024
16
+
ms.date: 04/15/2025
17
17
---
18
18
19
-
# Identify Defender for Endpoint architecture and deployment method
19
+
# Identify your architecture and select a deployment method for Defender for Endpoint
20
20
21
21
**Applies to:**
22
22
@@ -26,7 +26,7 @@ ms.date: 12/12/2024
26
26
27
27
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630)
28
28
29
-
If you're already completed the steps to set up your Microsoft Defender for Endpointdeployment, and you have assigned roles and permissions for Defender for Endpoint, your next step is to create a plan for onboarding. Your plan begins with identifying your architecture and choosing your deployment method.
29
+
If you're already completed the steps to [prepare your environment for Defender for Endpoint](production-deployment.md), and you have [assigned roles and permissions for Defender for Endpoint](prepare-deployment.md), your next step is to create a plan for onboarding. This plan should begin with identifying your architecture and choosing your deployment method.
30
30
31
31
We understand that every enterprise environment is unique, so we've provided several options to give you the flexibility in choosing how to deploy the service. Deciding how to onboard endpoints to the Defender for Endpoint service comes down to two important steps:
32
32
@@ -43,21 +43,27 @@ Depending on your environment, some tools are better suited for certain architec
43
43
|**On-premises**|For enterprises who want to take advantage of the cloud-based capabilities of Microsoft Defender for Endpoint while also maximizing their investments in Configuration Manager or Active Directory Domain Services, we recommend this architecture.|
44
44
|**Evaluation and local onboarding**|We recommend this architecture for SOCs (Security Operations Centers) who are looking to evaluate or run a Microsoft Defender for Endpoint pilot, but don't have existing management or deployment tools. This architecture can also be used to onboard devices in small environments without management infrastructure, such as a DMZ (Demilitarized Zone).|
45
45
46
-
## Step 2: Select deployment method
46
+
## Step 2: Select your deployment method
47
47
48
-
Once you have determined the architecture of your environment and have created an inventory as outlined in the [requirements section](mde-planning-guide.md#requirements), use the table below to select the appropriate deployment tools for the endpoints in your environment. This will help you plan the deployment effectively.
48
+
Once you have determined the architecture of your environment and have created an inventory as outlined in the [requirements section](mde-planning-guide.md#requirements), use the table below to select the appropriate deployment tools for the endpoints in your environment. This information will help you plan the deployment effectively.
49
49
50
50
|Endpoint|Deployment tool|
51
51
|---|---|
52
-
|**Windows**|[Local script (up to 10 devices)](configure-endpoints-script.md)<br/>[Group Policy](configure-endpoints-gp.md)<br/>[Microsoft Intune/ Mobile Device Manager](configure-endpoints-mdm.md)<br/>[Microsoft Configuration Manager](configure-endpoints-sccm.md)<br/>[VDI scripts](configure-endpoints-vdi.md)|
53
-
|**Windows servers<br/>Linux servers** <br/>(Requires a server license) |[Onboard Windows devices using a local script](configure-endpoints-script.md)<br/>[Integration with Microsoft Defender for Cloud](azure-server-integration.md)|
|**Linux servers**|[Local script](linux-install-manually.md)<br/>[Puppet](linux-install-with-puppet.md)<br/>[Ansible](linux-install-with-ansible.md)<br/>[Chef](linux-deploy-defender-for-endpoint-with-chef.md)<br/>[Saltstack](linux-install-with-saltack.md)<br/>[Defender for Endpoint on Linux for ARM64-based devices (preview)](mde-linux-arm.md)|
52
+
|**Windows client devices**|[Microsoft Intune / Mobile Device Management (MDM)](configure-endpoints-mdm.md) <br/>[Microsoft Configuration Manager](configure-endpoints-sccm.md)<br/>[Local script (up to 10 devices)](configure-endpoints-script.md)<br/>[Group Policy](configure-endpoints-gp.md)<br/>[Non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md)<br/>[Azure Virtual Desktop](onboard-windows-multi-session-device.md)<br/>[System Center Endpoint Protection and Microsoft Monitoring Agent](onboard-downlevel.md) (for previous versions of Windows) |
53
+
|**Windows Server** <br/>(Requires a server license) |[Local script](configure-endpoints-script.md)<br/>[Integration with Microsoft Defender for Cloud](azure-server-integration.md)<br/>[Guidance for Windows Server with SAP](mde-sap-windows-server.md)|
|**Linux server**|[Installer script based deployment](linux-installer-script.md)<br/>[Ansible](linux-install-with-ansible.md)<br/>[Chef](linux-deploy-defender-for-endpoint-with-chef.md)<br/>[Puppet](linux-install-with-puppet.md)<br/>[Saltstack](linux-install-with-saltack.md)<br/>[Manual deployment](linux-install-manually.md)<br/>[Direct onboarding with Defender for Cloud](/azure/defender-for-cloud/onboard-machines-with-defender-for-endpoint)<br/>[Guidance for ARM64-based devices (preview)](mde-linux-arm.md)<br/>[Guidance for Linux with SAP](mde-linux-deployment-on-sap.md)|
> For devices that aren't managed by Microsoft Intune or Microsoft Configuration Manager, you can use the Security Management for Microsoft Defender for Endpoint to receive security configurations for Microsoft Defender directly from Intune.
60
+
> For devices that aren't managed by Intune or Configuration Manager, you can use the Defender for Endpoint Security Settings Management to receive security configurations directly from Intune.
61
+
> To onboard servers to Defender for Endpoint, [server licenses](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-defender-for-endpoint) are required. You can choose from these options:
62
+
>
63
+
> -[Microsoft Defender for Servers Plan 1 or Plan 2](/azure/defender-for-cloud/defender-for-servers-overview) (as part of the Defender for Cloud) offering
64
+
- Microsoft Defender for Endpoint for servers
65
+
-[Microsoft Defender for Business servers](/defender-business/get-defender-business#how-to-get-microsoft-defender-for-business-servers) (for small and medium-sized businesses only)
## Onboard devices using any of the supported management tools
37
37
38
-
The deployment tool you use influences how you onboard endpoints to the service.
38
+
The deployment tool you use influences how you onboard endpoints to the service. Refer to your selected [deployment method](deployment-strategy.md#step-2-select-your-deployment-method).
39
39
40
-
To start onboarding your devices:
40
+
If you're onboarding devices in the Microsoft Defender portal, follow these steps:
41
41
42
-
1. Go to [Select deployment method](deployment-strategy.md#step-2-select-deployment-method).
43
-
2. Choose the Operating System for the devices you wish to Onboard.
44
-
3. Select the tool you plan to use.
45
-
4. Follow the instructions to Onboard your devices.
42
+
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints**, and then, under **Device management**, select **Onboarding**.
46
43
47
-
This video provides a quick overview of the onboarding process and the different tools and methods.
44
+
:::image type="content" source="media/mde-device-onboarding-ui.png" alt-text="Screenshot showing device onboarding in the Microsoft Defender portal for Defender for Endpoint.":::
45
+
46
+
2. Under **Select operating system to start onboarding process**, select the operating system for the device.
47
+
48
+
3. Under **Connectivity type**, select either **Streamlined** or **Standard**. (See [prerequisites for streamlined connectivity](/defender-endpoint/configure-device-connectivity#prerequisites).)
49
+
50
+
4. Under **Deployment method**, select an option. Then download the onboarding package (and installation package, if there is one available). Follow the instructions to onboard your devices.
51
+
52
+
The following video provides a quick overview of the onboarding process and the different tools and methods:
@@ -59,7 +64,7 @@ This table provides an example of the deployment rings you might use:
59
64
|Deployment ring|Description|
60
65
|---|---|
61
66
|Evaluate|Ring 1: Identify 50 devices to onboard to the service for testing.|
62
-
|Pilot|Ring 2: Identify and onboard the next 50-100 endpoints in a production environment. Microsoft Defender for Endpoint supports various endpoints that you can onboard to the service, for more information, see [Select deployment method](deployment-strategy.md#step-2-select-deployment-method).|
67
+
|Pilot|Ring 2: Identify and onboard the next 50-100 endpoints in a production environment. Microsoft Defender for Endpoint supports various endpoints that you can onboard to the service, for more information, see [Select deployment method](deployment-strategy.md#step-2-select-your-deployment-method).|
63
68
|Full deployment|Ring 3: Roll out service to the rest of environment in larger increments. For more information, see [Get started with your Microsoft Defender for Endpoint deployment](mde-planning-guide.md).
Checking for the license state and whether it was properly provisioned can be done through the admin center or through the **Microsoft Azure portal**.
50
+
Checking for the license state and whether it was properly provisioned can be done through the Microsoft 365 admin center or through the **Microsoft Azure portal**.
51
51
52
-
1. To view your licenses, go to the **Microsoft Azure portal** and navigate to the [Microsoft Azure portal license section](https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products).
52
+
- In the [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/), in the navigation pane, expand **Billing**, and then select **Your products**.
- In the [Microsoft Azure portal](https://portal.azure.com/#home), under **Manage Microsoft Entra ID**, select **View**. Then, under **Manage**, select **Licenses**.
61
55
62
56
## Cloud Service Provider validation
63
57
64
-
To gain access into which licenses are provisioned to your company, and to check the state of the licenses, go to the admin center.
58
+
To gain access into which licenses are provisioned to your company, and to check the state of the licenses, go to the Microsoft 365 admin center.
65
59
66
-
1. From the **Partner portal**, select **Administer services > Office 365**.
60
+
1. From the **Partner portal**, select **Administer services** > **Office 365**.
67
61
68
-
2.Clicking on the **Partner portal** link opens the **Admin on behalf** option and gives you access to the customer admin center.
62
+
2.Selecting the **Partner portal** link opens the **Admin on behalf** option and gives you access to the customer admin center.
Initiating Microsoft Defender for Endpoint tenant is easy. From the navigation menu, select any item under the Endpoints section, or any Microsoft Defender XDR feature such as Incidents, Hunting, Action center, or Threat analytics to start the tenant creation process.
68
+
To provision Defender for Endpoint in your tenant, follow these steps:
69
+
70
+
1. Go to the [Microsoft Defender portal](https://security.microsoft.com) and sign in.
75
71
76
-
From a web browser, navigate to the [Microsoft Defender portal](https://security.microsoft.com).
72
+
2. In the navigation pane, select any of the following items:
77
73
74
+
- Under **Assets**, select **Devices**.
75
+
- Under **Endpoints**, select an item, such as **Dashboard** or **Endpoint security policies**.
76
+
78
77
## Data center location
79
78
80
79
Microsoft Defender for Endpoint stores and process data in the [same location as used by Microsoft Defender XDR](/defender-xdr/m365d-enable). If Microsoft Defender XDR hasn't been turned on yet, onboarding to Defender for Endpoint also turns on Defender XDR, and a new data center location is automatically selected based on the location of active Microsoft 365 security services. The selected data center location is shown on the screen.
81
80
82
81
## Network configuration
83
82
84
-
Ensure devices can connect to the Defender for Endpoint cloud services. The use of a proxy is recommended.
83
+
Ensure devices can connect to the Defender for Endpoint cloud services. The use of a proxy is recommended. See the following articles to configure your network:
85
84
86
-
[STEP 1: Configure your network environment to ensure connectivity with Defender for Endpoint service](configure-environment.md).
87
-
[STEP 2: Configure your devices to connect to the Defender for Endpoint service using a proxy](configure-proxy-internet.md).
88
-
[STEP 3: Verify client connectivity to Microsoft Defender for Endpoint service URLs](verify-connectivity.md).
85
+
1.[Configure your network environment to ensure connectivity with Defender for Endpoint service](configure-environment.md).
89
86
90
-
In certain scenarios, you might want to allow traffic to IP addresses. Not all services are accessible in this way and you need to evaluate how to address this potential issue in your environment - for example, by centrally downloading then distributing updates. For more information, see [Option 2: Configure connectivity using static IP ranges](configure-device-connectivity.md#option-2-configure-connectivity-using-static-ip-ranges).
87
+
2.[Configure your devices to connect to the Defender for Endpoint service using a proxy](configure-proxy-internet.md).
88
+
89
+
3.[Verify client connectivity to Microsoft Defender for Endpoint service URLs](verify-connectivity.md).
90
+
91
+
In certain scenarios, you might want to allow traffic to IP addresses. Not all services are accessible in this way and you need to evaluate how to address this potential issue in your environment. For example, you might need to download updates to a central location and then distribute them. For more information, see Configure connectivity using static IP ranges](configure-device-connectivity.md#option-2-configure-connectivity-using-static-ip-ranges).
91
92
92
93
## Next step
93
94
94
95
- Continue to [Step 2 - Assign roles and permissions](prepare-deployment.md)
96
+
95
97
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
Copy file name to clipboardExpand all lines: defender-endpoint/switch-to-mde-phase-1.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -69,7 +69,7 @@ Now that you've updated your organization's devices, the next step is to get Def
69
69
70
70
1. Buy or try Defender for Endpoint today. [Start a free trial or request a quote](https://aka.ms/mdatp). Microsoft 365 E3 includes Defender for Endpoint Plan 1, and Microsoft 365 E5 includes Defender for Endpoint Plan 2.
71
71
72
-
2. Verify that your licenses are properly provisioned. [Check your license state](production-deployment.md#check-license-state).
72
+
2. Verify that your licenses are properly provisioned. [Check your license state](production-deployment.md#check-your-license-state).
73
73
74
74
3. Set up your dedicated cloud instance of Defender for Endpoint. See [Defender for Endpoint setup: Tenant configuration](production-deployment.md#tenant-configuration).
0 commit comments