Enable Defender for Endpoint integration

Microsoft Defender for Cloud integrates natively with Microsoft Defender for Endpoint to provide Defender for Endpoint and Defender Vulnerability Management capabilities in Defender for Cloud.

• When you enable the Defender for Servers plan in Defender for Cloud, Defender for Endpoint integration is enabled by default.
• The integration automatically deploys the Defender for Endpoint agent on machines.

This article explains how to manually enable Defender for Endpoint integration when necessary.

Prerequisites

Enable on a subscription

Defender for Endpoint integration is enabled by default when you enable a Defender for Servers plan. If you turn off the Defender for Endpoint integration on a subscription, you can turn it on again manually when necessary using these instructions.

1. In Defender for Cloud, select Environment settings and select the subscription containing the machines on which you want to deploy the Defender for Endpoint integration.

2. In Settings and monitoring > Endpoint protection, toggle the Status column settings to On.

   

3. Select Continue and Save to save your settings.

4. The Defender for Endpoint sensor is deployed to all Windows and Linux machines in the selected subscription.

   Onboarding might take up to an hour. Defender for Cloud detects any previous Defender for Endpoint installations and reconfigures them to integrate with Defender for Cloud.

Verify installation on Linux machines

Verify Defender for Endpoint sensor installation on a Linux machine by following these steps:

1. Run the following shell command on each machine: mdatp health. If Microsoft Defender for Endpoint is installed, you see its health status:

   healthy : true

   licensed: true

2. Additionally, in the Azure portal, you can check that Linux machines have a new Azure extension called MDE.Linux.

Enable Defender for Endpoint unified solution on Windows Server 2016/2012 R2

If Defender for Servers is enabled and Defender for Endpoint integration is on in a subscription that existed before spring 2022, you might need to manually enable integration of the unified solution for machines running Windows Server 2016 or Windows Server 2012 R2 in the subscription.

1. In Defender for Cloud, select Environment settings and select the subscription with the Windows machines that you want to receive Defender for Endpoint.

2. In the Monitoring coverage column of the Defender for Servers plan, select Settings.

   The status of the Endpoint protections component is Partial, meaning that not all parts of the component are enabled.

3. Select Fix to see the components that aren't enabled.

   

4. In Missing components > Unified solution, select Enable to automatically install the Defender for Endpoint agent on Windows Server 2012 R2 and 2016 machines connected to Microsoft Defender for Cloud.

   

5. To save the changes, select Save at the top of the page. In the Settings and monitoring page, select Continue.

   Defender for Cloud onboards existing and new machines to Defender for Endpoint.

   In case you are configuring Defender for Endpoint on the first subscription in your tenant, onboarding might take up to 12 hours. For new machines and subscriptions created after the integration has been enabled for the first time, onboarding takes up to an hour.

Enable on Linux machines (plan/integration enabled)

If Defender for Servers is already enabled and Defender for Endpoint integration is on in a subscription that existed before summer 2021, you might need to manually enable the integration for Linux machines.

1. In Defender for Cloud, select Environment settings and select the subscription with the Linux machines that you want to receive Defender for Endpoint.

2. In the Monitoring coverage column of the Defender for Server plan, select Settings.

   The status of the Endpoint protections component is Partial, meaning that not all parts of the component are enabled.

3. Select Fix to see the components that aren't enabled.

   

4. In Missing components > Linux machines, select Enable.

   

5. To save the changes, select Save at the top of the page. In the Settings and monitoring page, select Continue.

   • Defender for Cloud onboards Linux machines to Defender for Endpoint.
   • Defender for Cloud detects any previous Defender for Endpoint installations on Linux machines and reconfigures them to integrate with Defender for Cloud.
   • In case you are configuring Defender for Endpoint on the first subscription in your tenant, onboarding might take up to 12 hours. For new machines created after the integration has been enabled, onboarding takes up to an hour.

6. To verify Defender for Endpoint sensor installation on a Linux machine, run the following shell command on each machine.

   mdatp health

   If Microsoft Defender for Endpoint is installed, you see its health status:

   healthy : true

   licensed: true

7. In the Azure portal, you can check that Linux machines have a new Azure extension called MDE.Linux.

Enable integration with PowerShell in multiple subscriptions

To enable Defender for Servers integration for Linux machines or Windows Server 2012 R2 and 2016 with MDE Unified solution on multiple subscriptions, you can use one of the PowerShell scripts in the Defender for Cloud GitHub repository.

• Use this script to enable integration with the Defender for Endpoint modern unified solution on Windows Server 2012 R2 or Windows Server 2016
• Use this script to enable Defender for Endpoint integration on Linux machines

Manage automatic updates for Linux

In Windows, Defender for Endpoint version updates are provided via continuous knowledge base updates. In Linux, you need to update the Defender for Endpoint package.

• When you use Defender for Servers with the MDE.Linux extension, automatic updates for Microsoft Defender for Endpoint are enabled by default.

• If you want to manage version updates manually, you can disable automatic updates on your machines. To do this, add the following tag for machines onboarded with the MDE.Linux extension.

  • Tag name: ExcludeMdeAutoUpdate
  • Tag value: true

This configuration is supported for Azure VMs and Azure Arc machines, where the MDE.Linux extension initiates autoupdate.

Enable integration at scale

You can enable the Defender for Endpoint integration at scale through the supplied REST API version 2022-05-01. For full details, see the API documentation.

Here's an example request body for the PUT request to enable the Defender for Endpoint integration:

URI: https://management.azure.com/subscriptions/<subscriptionId>/providers/Microsoft.Security/settings/WDATP?api-version=2022-05-01

{
    "name": "WDATP",
    "type": "Microsoft.Security/settings",
    "kind": "DataExportSettings",
    "properties": {
        "enabled": true
    }
}

Track Defender for Endpoint deployment status

You can use the Defender for Endpoint deployment status workbook to track the Defender for Endpoint deployment status on your Azure VMs and Azure Arc-enabled VMs. The interactive workbook provides an overview of machines in your environment showing their Microsoft Defender for Endpoint extension deployment status.

Access the Microsoft Defender portal

1. Make sure you have the right permissions for portal access.

2. Check whether you have a proxy or firewall that is blocking anonymous traffic.

   • The Defender for Endpoint sensor connects from the system context, so anonymous traffic must be permitted.
   • To ensure unhindered access to the Microsoft Defender portal, enable access to service URLs in the proxy server.

3. Open the Microsoft Defender portal. Learn about Incidents and alerts in the Microsoft Defender portal.

Run a detection test

Follow the instructions in EDR detection test for verifying device's onboarding and reporting services.

Remove Defender for Endpoint from a machine

To remove the Defender for Endpoint solution from your machines:

1. To disable the integration, in Defender for Cloud > Environment settings, select the subscription with the relevant machines.
2. In the Defender plans page, select Settings & Monitoring.
3. In the status of the Endpoint protection component, select Off to disable the integration with Microsoft Defender for Endpoint for the subscription.
4. Select Continue and Save to save your settings.
5. Remove the MDE.Windows or MDE.Linux extension from the machine.
6. Offboard the device from the Microsoft Defender for Endpoint service.