Defender for Endpoint Policies

Question

Hello

If a workstation or server is onboarded to defender for endpoint and no security policies have been pushed to the endpoint, what are the default settings or configuration that defender uses? does it stay dormant until policies are pushed?

Thanks

Answer 1

@berketjune2012, Thanks for posting in Q&A. When you use Microsoft Defender for Endpoint, you can deploy endpoint security policies from Microsoft Intune to manage the Defender security settings on the devices you’ve onboarded to Defender without enrolling those devices with Intune. When a device is managed by Intune (enrolled to Intune) the device doesn't process policies for Defender for Endpoint security settings management. Instead, use Intune to deploy policy for Defender for Endpoint to your devices.

Defender will not stay dormant and will continue to run in the background to protect the device from threats even though no security policies have been pushed to the endpoint.

Hope the above information can help. If you have any more questions with Microsoft Defender for Endpoint You can also contact the support in the following link:

https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure

Best regards.

Crystal

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.