Microsoft Defender for Endpoint Onboarding with Intune and Local Script – SC-200 Study Guide

Purpose of This Lesson

This lesson explains how to onboard Windows devices into Microsoft Defender for Endpoint and why onboarding matters for Microsoft security operations.

For the SC-200 exam, this topic is important because a Security Operations Analyst needs to understand how endpoint telemetry gets into the Microsoft Defender portal. If a device is not onboarded into Defender for Endpoint, analysts will not have full endpoint detection and response visibility for that machine.

This lesson focuses on two onboarding approaches:

1. Automatic onboarding at scale using Microsoft Intune
2. Manual onboarding using a local script

The main exam idea is simple: before analysts can investigate endpoint alerts, run response actions, review device timelines, or correlate endpoint activity in Microsoft Defender XDR, the endpoint must first be onboarded into Defender for Endpoint.

---

Key Concepts

Microsoft Defender for Endpoint Onboarding

Microsoft Defender for Endpoint onboarding is the process of connecting a device to Microsoft Defender for Endpoint so the device can send security telemetry to Microsoft Defender XDR.

Once onboarded, the device can appear in the Microsoft Defender portal under:

Assets > Devices

From there, analysts can investigate device risk, alerts, exposure, logged-on users, device timeline events, vulnerabilities, and security recommendations.

Onboarding is not just “installing antivirus.” Windows devices may already have Microsoft Defender Antivirus, but that does not automatically mean they are fully onboarded into Defender for Endpoint for EDR visibility.

Why Onboarding Matters

Defender for Endpoint onboarding enables:

• Endpoint detection and response
• Device inventory visibility
• Alert generation
• Device timeline investigation
• Advanced hunting data
• Automated investigation and remediation
• Isolation and containment actions
• Vulnerability and exposure visibility
• Correlation with Microsoft Defender XDR incidents

For SC-200, remember that endpoint investigation depends on the endpoint being onboarded and reporting correctly.

---

Microsoft Defender XDR and Defender for Endpoint Relationship

Microsoft Defender XDR is the unified security operations experience that brings together alerts, incidents, identities, endpoints, email, SaaS apps, and cloud resources.

Microsoft Defender for Endpoint is one of the Defender workloads that feeds endpoint signals into Defender XDR.

In this lesson, the onboarded machine becomes visible in the Defender portal so it can contribute endpoint data to security operations workflows.

Defender for Endpoint Provides Endpoint-Level Visibility

Defender for Endpoint is used for:

• Windows client and server monitoring
• Endpoint alerts
• Device inventory
• Endpoint investigation
• Device timeline
• Threat and vulnerability management
• Endpoint containment and remediation
• Attack surface reduction visibility
• Security recommendations

Defender XDR Correlates Endpoint Data

Microsoft Defender XDR can correlate endpoint activity with:

• Microsoft Defender for Office 365 email threats
• Microsoft Defender for Identity identity signals
• Microsoft Defender for Cloud Apps SaaS activity
• Microsoft Entra ID identity activity
• Defender for Endpoint device activity

This is why onboarding devices correctly matters. If the endpoint is missing, the investigation picture is incomplete.

---

Automatic Onboarding with Microsoft Intune

The preferred method for onboarding many Windows devices is to use Microsoft Intune.

Manual onboarding might be fine for a lab or a small number of devices, but it does not scale well. In an enterprise environment, you need a centralized deployment method.

Intune can automatically onboard supported Windows devices into Microsoft Defender for Endpoint when the proper connection is configured between Intune and Defender for Endpoint.

---

Prerequisites for Intune-Based Onboarding

The lesson highlights several requirements before automatic onboarding can work.

1. Devices Must Be Enrolled or Managed

Devices need to be managed through Intune. This often happens when users sign in to a Windows device and the device becomes joined or registered with Microsoft Entra ID.

In a typical Microsoft cloud-managed environment, the flow may look like this:

1. User signs in to the Windows device.
2. The device joins or registers with Microsoft Entra ID.
3. The device enrolls into Intune through automatic MDM enrollment.
4. Intune applies security and device management policies.
5. Defender for Endpoint onboarding can be pushed through Intune.

2. Microsoft Entra ID Device Settings Must Allow Device Join

In Microsoft Entra ID, device settings control whether users can join devices to the tenant.

Relevant area:

Microsoft Entra ID > Devices > Device settings

The lesson shows that users are allowed to join devices. This supports the device enrollment workflow.

3. Automatic MDM Enrollment Must Be Enabled

Automatic enrollment into Intune is controlled through the mobility settings.

Relevant area:

Microsoft Entra ID > Mobility > Microsoft Intune

This is where automatic MDM enrollment is configured.

If automatic enrollment is enabled and the user is properly licensed, Windows devices can be enrolled into Intune automatically.

4. Users Need Proper Licensing

The signed-in user needs a license that supports the required Microsoft Intune and Defender capabilities.

The lesson uses a Microsoft 365 E5-style licensing example.

For the SC-200 exam, remember that licensing and enrollment state matter. If the device is not managed by Intune, Intune-based onboarding will not work as expected.

---

Connecting Microsoft Defender for Endpoint and Intune

Intune cannot automatically onboard Windows devices into Defender for Endpoint unless Microsoft Defender for Endpoint and Intune are connected.

This connection is configured from the Microsoft Defender portal.

Path:

Microsoft Defender portal > Settings > Endpoints > Advanced features

The key setting is the integration between Microsoft Defender for Endpoint and Microsoft Intune.

Once enabled, Intune can use Defender for Endpoint settings for endpoint security management and device onboarding.

---

Intune Defender for Endpoint Settings

After enabling the connection on the Defender side, you can go to the Intune admin center.

Path:

Intune admin center > Endpoint security > Microsoft Defender for Endpoint

This area contains settings that control how Intune integrates with Defender for Endpoint.

Important settings include:

• Allow Microsoft Defender for Endpoint to enforce endpoint security configurations
• Connect Windows devices to Microsoft Defender for Endpoint
• Platform-specific onboarding options

If the Defender-to-Intune connection is not configured, these options may be unavailable or grayed out.

Key Exam Point

For automatic onboarding with Intune, there are two sides to check:

1. Microsoft Defender portal: Enable the Defender for Endpoint / Intune connection.
2. Intune admin center: Enable the relevant Defender for Endpoint onboarding options for supported devices.

---

Onboarding Methods for Defender for Endpoint

Microsoft supports multiple onboarding methods depending on the device type and management platform.

Common Windows onboarding methods include:

• Microsoft Intune
• Microsoft Configuration Manager
• Group Policy
• Local script
• VDI onboarding
• Azure Virtual Desktop deployment methods
• System Center Endpoint Protection in some legacy scenarios

Other supported platforms include:

• Windows Server
• macOS
• Linux
• Android
• iOS

For the SC-200 exam, pay attention to the workload and platform in the question. The correct onboarding method depends on whether the device is managed by Intune, ConfigMgr, Group Policy, or another deployment mechanism.

---

Manual Onboarding with Local Script

The lesson demonstrates manual onboarding using a local script.

This method is useful for:

• Labs
• Testing
• Demonstrations
• Small numbers of devices
• Break-glass scenarios
• Devices not yet managed by Intune or ConfigMgr

It is not the best approach for large-scale enterprise deployment.

Local Script Onboarding Workflow

The manual onboarding process follows this general workflow:

1. Open the Microsoft Defender portal.
2. Go to Settings.
3. Select Endpoints.
4. Go to Onboarding.
5. Select the operating system.
6. Choose the deployment method, such as Local script.
7. Download the onboarding package.
8. Copy the onboarding script to the target machine.
9. Open Terminal or Command Prompt as administrator.
10. Run the onboarding script.
11. Confirm the prompt.
12. Wait for the device to appear in the Microsoft Defender portal.

Important Timing Detail

After onboarding, the device may not appear instantly.

The lesson notes that it can take several minutes for the machine to show up in the Defender portal. A common expectation is that the device may appear within a few minutes, but analysts should allow time for cloud processing and portal refresh.

For exam purposes, do not assume that onboarding failure occurred just because the device does not appear immediately.

---

Standard vs Streamlined Onboarding

The lesson mentions two onboarding experiences:

Standard Onboarding

Standard onboarding displays information during the onboarding process. This is useful when you want to see script execution details and confirm the process interactively.

Best for:

• Labs
• Manual testing
• Troubleshooting
• Learning the onboarding process

Streamlined Onboarding

Streamlined onboarding is more background-oriented and less visible to the user.

Best for:

• More automated deployment workflows
• Lower-touch deployment scenarios
• Production-style onboarding where user interaction should be minimized

For the exam, the bigger point is not necessarily the naming of the mode, but the difference between an interactive onboarding approach and a more silent deployment approach.

---

Verifying Onboarding

Once onboarding completes, the device should eventually appear in the Defender portal.

Path:

Microsoft Defender portal > Assets > Devices

From the device inventory, analysts can review information such as:

• Device name
• Health state
• Risk level
• Exposure level
• Operating system
• Last seen time
• Onboarding status
• Associated alerts
• Logged-on users
• Device timeline

In the lab example, the Windows machine appears after the portal is refreshed.

---

Microsoft Security Operations Context

In a real SOC workflow, onboarding is foundational.

If the device is not onboarded, the SOC may be blind to endpoint activity. That means analysts may miss process execution, file activity, network connections, malware detections, and device timeline events.

How an Analyst Uses an Onboarded Device

Once a device is onboarded, an analyst can:

• Triage endpoint alerts
• Review the device timeline
• Investigate suspicious processes
• Identify logged-on users
• Review file activity
• Check network connections
• Determine whether the device is exposed or vulnerable
• Isolate the device if necessary
• Run antivirus scans or investigation packages
• Collect evidence
• Escalate to endpoint engineering or infrastructure teams

Example SOC Workflow

A typical endpoint investigation might look like this:

1. An incident is generated in Microsoft Defender XDR.
2. The incident includes an endpoint alert from Defender for Endpoint.
3. The analyst opens the affected device entity.
4. The analyst reviews the device timeline.
5. The analyst checks related users, files, processes, and IP addresses.
6. The analyst determines whether the alert is true positive or false positive.
7. The analyst takes containment action if needed.
8. The analyst documents findings and updates the incident.
9. The analyst recommends detection or policy improvements.

None of this works well if the endpoint is not onboarded and reporting telemetry.

---

Incident Investigation Relevance

Defender for Endpoint onboarding affects several investigation areas.

Alerts

An alert is a specific detection. For example, suspicious PowerShell execution or malware activity on a device.

Incidents

An incident groups related alerts and evidence together. Defender XDR can combine endpoint, identity, email, and cloud alerts into one incident.

Entities

Entities are objects involved in an investigation. Examples include:

• Devices
• Users
• IP addresses
• Files
• URLs
• Mailboxes
• Cloud apps

Evidence

Evidence includes the specific artifacts associated with an alert or incident, such as a malicious file, suspicious process, command line, or network connection.

Why Onboarding Matters

If a device is not onboarded into Defender for Endpoint, it may not provide the endpoint evidence needed for investigation.

---

Exam-Relevant Takeaways

For the SC-200 exam, remember these points:

• Use Microsoft Defender for Endpoint for endpoint detection, investigation, and response.
• Use Microsoft Intune for scalable onboarding of managed Windows devices.
• Use local script onboarding for labs, testing, or small-scale manual onboarding.
• A device enrolled in Intune is not automatically useful for Defender for Endpoint unless the Defender for Endpoint integration is configured.
• Enable the connection between Defender for Endpoint and Intune in the Microsoft Defender portal.
• Configure Defender for Endpoint onboarding options in the Intune admin center.
• Devices appear in the Defender portal under Assets > Devices.
• Device onboarding may take several minutes to appear in the portal.
• Microsoft Entra ID join and Intune automatic enrollment are part of the device management path.
• Proper licensing is required.
• Different platforms have different onboarding methods.
• For large environments, avoid manual onboarding as the primary deployment method.
• For endpoint investigations, the affected device must be onboarded and reporting telemetry.

---

Tool / Feature Decision Guide

Scenario	Best Microsoft Security Tool or Feature	Why
You need to onboard hundreds of managed Windows devices into Defender for Endpoint	Microsoft Intune	Intune provides scalable policy-based onboarding for managed devices.
You need to onboard one lab VM for testing	Local script onboarding	A local script is simple and fast for a small number of devices.
You need to verify whether an endpoint is visible to security operations	Microsoft Defender portal > Assets > Devices	This is where onboarded Defender for Endpoint devices appear.
You need to enable Defender for Endpoint integration with Intune	Microsoft Defender portal > Settings > Endpoints > Advanced features	The Defender-side connection must be enabled before Intune options are available.
You need to configure Defender for Endpoint onboarding settings for managed devices	Intune admin center > Endpoint security > Microsoft Defender for Endpoint	Intune controls onboarding and endpoint security settings for managed devices.
You need endpoint telemetry for investigation	Microsoft Defender for Endpoint	Defender for Endpoint provides EDR visibility, device timeline, alerts, and response actions.
You need cross-domain incident correlation across endpoint, identity, and email	Microsoft Defender XDR	Defender XDR correlates alerts and evidence across Microsoft security workloads.
You need centralized SIEM correlation using logs from Microsoft and non-Microsoft sources	Microsoft Sentinel	Sentinel is the cloud-native SIEM/SOAR platform.
You need to onboard devices that are not Intune-managed but are domain-joined	Group Policy or Configuration Manager	These are better enterprise deployment methods than local scripts for traditional environments.
You need to investigate suspicious activity on a device	Defender for Endpoint device page and timeline	The device page provides endpoint investigation details.

---

Defender for Endpoint vs Microsoft Sentinel

Need	Microsoft Defender for Endpoint	Microsoft Sentinel
Endpoint detection and response	Yes	Not directly; Sentinel can ingest endpoint data
Device timeline investigation	Yes	No, Sentinel uses log queries and incidents
Device isolation	Yes	Can trigger through automation/playbooks if integrated
SIEM correlation across many sources	Limited compared to Sentinel	Yes
KQL log hunting across connected sources	Advanced Hunting in Defender XDR	Log Analytics workspace in Sentinel
Third-party log ingestion	Not the primary purpose	Yes
Endpoint onboarding required	Yes	No, but endpoint data must be connected if needed

Exam Tip

If the scenario is specifically about endpoint onboarding, device timeline, endpoint alerts, or device containment, the answer is usually Microsoft Defender for Endpoint.

If the scenario is about SIEM, log ingestion, analytics rules, data connectors, or cross-source correlation, the answer is usually Microsoft Sentinel.

---

Incidents vs Alerts

Concept	Meaning	Example
Alert	A single detection from a security product	Suspicious PowerShell activity detected on a device
Incident	A grouped investigation containing related alerts and evidence	Endpoint alert + identity alert + suspicious email campaign
Entity	An object involved in an investigation	Device, user, IP address, file, mailbox
Evidence	Specific artifact associated with the alert or incident	File hash, process command line, URL, sender address

Exam Tip

Do not confuse alerts and incidents. An incident can contain multiple alerts, and alerts can contain evidence and entities.

---

KQL Notes

This lesson does not focus on KQL. However, onboarding devices into Defender for Endpoint is what enables endpoint data to become available for hunting and investigation.

In Microsoft Defender XDR Advanced Hunting, endpoint-related tables may include data such as:

• Device process events
• Device network events
• Device file events
• Device logon events
• Device registry events

Simple Example: Find Recent Activity for a Specific Device

DeviceProcessEvents
| where DeviceName == "NYC-CL-11"
| sort by Timestamp desc
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName

What This Query Does

Query Part	Purpose
DeviceProcessEvents	Searches process execution telemetry from onboarded devices.
where DeviceName == "NYC-CL-11"	Filters results to one specific device.
sort by Timestamp desc	Shows the newest events first.
project	Displays only the columns useful for quick review.

Exam-Relevant KQL Point

KQL is useful only when the relevant data exists. If a device is not onboarded into Defender for Endpoint, endpoint hunting tables may not contain the telemetry needed for investigation.

---

Common Exam Traps

Trap 1: Assuming Intune Enrollment Means Defender for Endpoint Onboarding

A device can be enrolled in Intune without being properly onboarded into Defender for Endpoint.

For Defender for Endpoint visibility, the Defender integration and onboarding configuration must be in place.

Trap 2: Choosing Local Script for Enterprise Deployment

Local script onboarding works for a lab or a small number of machines, but it is not the best answer for hundreds of managed endpoints.

For scale, choose Intune, Configuration Manager, or Group Policy depending on the environment.

Trap 3: Confusing Defender for Endpoint with Defender Antivirus

Microsoft Defender Antivirus provides antivirus protection. Microsoft Defender for Endpoint provides EDR, device investigation, timeline, vulnerability visibility, and response actions.

They are related but not the same thing.

Trap 4: Looking in the Wrong Portal

For Defender for Endpoint device investigation, use the Microsoft Defender portal.

For onboarding policy and managed endpoint configuration, use Intune.

For identity directory and device join settings, use Microsoft Entra ID.

Trap 5: Expecting Instant Device Visibility

After onboarding, devices may take time to appear in the Defender portal. A short delay does not automatically mean onboarding failed.

Trap 6: Ignoring Licensing

Many Microsoft security features depend on the proper license. If a scenario mentions users or devices without proper licensing, automatic onboarding or advanced Defender features may not work.

Trap 7: Confusing Microsoft Defender XDR and Microsoft Sentinel

Defender XDR provides integrated investigation across Microsoft Defender workloads.

Sentinel is a SIEM/SOAR platform that ingests data from Microsoft and non-Microsoft sources.

---

Real-World SOC Analyst Notes

Onboarding Is a Visibility Requirement

A SOC cannot investigate what it cannot see. If a workstation, server, or VDI system is not onboarded, endpoint telemetry may be missing from incidents and hunting queries.

Validate Onboarding Before Relying on Detections

In production, it is not enough to deploy onboarding policies. You should confirm that devices are actually appearing in Defender for Endpoint and reporting recently.

Useful validation checks include:

• Device appears in Defender portal
• Last seen time is current
• Sensor health is healthy
• Device risk and exposure data populate
• Alerts generate when expected
• Device timeline contains events

Avoid One-Off Manual Processes at Scale

Manual onboarding creates operational risk because it depends on an administrator touching individual machines.

For large environments, use centralized deployment such as:

• Intune
• Configuration Manager
• Group Policy
• VDI image-based onboarding
• Server onboarding through supported management methods

Coordinate with Endpoint and Infrastructure Teams

Defender onboarding can involve multiple teams:

• Endpoint management team
• Microsoft 365 security team
• Identity team
• Server team
• VDI team
• Network team
• Change management team

A SOC analyst may not own deployment, but they need to know whether missing telemetry is due to an onboarding, licensing, health, or configuration issue.

Be Careful with Tenant-Wide Changes

Enabling Intune and Defender integration can affect large groups of devices. In real environments, this should follow change control and pilot testing.

Consider:

• Pilot groups
• Exclusions
• Rollback plans
• User impact
• Sensor health
• Network connectivity
• Proxy/firewall requirements
• Device platform support

Document the Onboarding Method

For incident response and operations, document how each device category is onboarded.

Examples:

• Corporate laptops: Intune
• Domain-joined desktops: Group Policy
• Servers: Defender for Cloud or onboarding package
• VDI: Golden image onboarding process
• macOS: Intune or Jamf
• Linux: Defender deployment package or management tooling

Alert Fatigue Depends on Coverage Quality

Poor onboarding creates uneven visibility. Some devices generate telemetry and alerts, while others remain invisible. This creates a false sense of security and makes incident scoping harder.

---

Quick Reference Summary

• Defender for Endpoint onboarding connects devices to Microsoft Defender XDR for endpoint telemetry.
• Onboarded devices appear under Assets > Devices in the Microsoft Defender portal.
• Intune is the preferred method for scalable onboarding of managed Windows devices.
• Local script onboarding is useful for labs and small-scale manual testing.
• Microsoft Entra ID join and Intune automatic enrollment help get devices managed.
• Defender for Endpoint and Intune must be connected before Intune can onboard devices.
• Configure the Defender-side connection in the Microsoft Defender portal.
• Configure onboarding options in the Intune admin center.
• Device visibility may take several minutes after onboarding.
• Defender Antivirus and Defender for Endpoint are related but not the same.
• For endpoint investigation, use Defender for Endpoint.
• For SIEM ingestion and analytics rules, use Microsoft Sentinel.
• For identity directory/device join settings, use Microsoft Entra ID.
• For managed endpoint security policy deployment, use Intune.

---

Flashcards

Q: What is Microsoft Defender for Endpoint onboarding?
A: It is the process of connecting a device to Defender for Endpoint so it can send endpoint telemetry to Microsoft Defender XDR.

Q: Where do onboarded devices appear in the Microsoft Defender portal?
A: Under Assets > Devices.

Q: What is the best onboarding method for hundreds of Intune-managed Windows devices?
A: Microsoft Intune-based onboarding.

Q: When is local script onboarding most appropriate?
A: For labs, testing, demonstrations, or a small number of devices.

Q: Which portal is used to enable the Defender for Endpoint connection to Intune?
A: The Microsoft Defender portal under Settings > Endpoints > Advanced features.

Q: Which portal is used to configure Defender for Endpoint onboarding settings for managed devices?
A: The Intune admin center under Endpoint security > Microsoft Defender for Endpoint.

Q: Does Intune enrollment automatically guarantee Defender for Endpoint onboarding?
A: No. The Defender for Endpoint integration and onboarding settings must be configured.

Q: Why does Defender for Endpoint onboarding matter to a SOC analyst?
A: It provides endpoint telemetry, alerts, device timeline data, and response capabilities needed for investigation.

Q: What Microsoft product is used for endpoint detection and response?
A: Microsoft Defender for Endpoint.

Q: What Microsoft product is used as a cloud-native SIEM/SOAR platform?
A: Microsoft Sentinel.

Q: What is the difference between an alert and an incident?
A: An alert is a single detection, while an incident groups related alerts, entities, and evidence.

Q: What should an analyst remember if a newly onboarded device does not appear immediately?
A: Device visibility can take several minutes after onboarding.

Q: What role does Microsoft Entra ID play in this workflow?
A: It supports device join/registration and automatic enrollment into device management workflows.

Q: Why is manual onboarding not ideal for enterprise scale?
A: It is difficult to manage consistently across many devices and lacks the scalability of centralized deployment tools.

Q: What type of data can become available for hunting after Defender for Endpoint onboarding?
A: Endpoint telemetry such as process events, file events, logon events, network events, and registry activity.

---

Practice Questions

Question 1:

A company has 600 Windows laptops enrolled in Microsoft Intune. The security team wants all laptops to automatically onboard into Microsoft Defender for Endpoint. What should you configure?

A. Download the local onboarding script and run it manually on each laptop
B. Enable the Defender for Endpoint integration with Intune and configure Defender onboarding in Intune
C. Create a Microsoft Sentinel analytics rule
D. Enable Microsoft Defender Antivirus only

Correct Answer:
B. Enable the Defender for Endpoint integration with Intune and configure Defender onboarding in Intune

Explanation:
For scalable onboarding of Intune-managed Windows devices, configure the Defender for Endpoint and Intune integration, then enable the appropriate onboarding settings in Intune. Local scripts are not the best choice for hundreds of devices.

---

Question 2:

You manually onboard a Windows test VM into Microsoft Defender for Endpoint using a local script. After the script completes successfully, the device does not immediately appear in the Defender portal. What should you do first?

A. Reinstall Windows
B. Assume the onboarding package is invalid
C. Wait several minutes and refresh the device inventory
D. Create a Microsoft Sentinel workbook

Correct Answer:
C. Wait several minutes and refresh the device inventory

Explanation:
Newly onboarded devices may take several minutes to appear in the Microsoft Defender portal. A short delay does not necessarily indicate failure.

---

Question 3:

A SOC analyst needs to investigate suspicious process execution on a Windows endpoint. Which Microsoft security product provides the device timeline and endpoint investigation details?

A. Microsoft Defender for Endpoint
B. Microsoft Entra ID
C. Microsoft Purview
D. Microsoft Defender for Office 365

Correct Answer:
A. Microsoft Defender for Endpoint

Explanation:
Defender for Endpoint provides endpoint detection and response capabilities, including device timeline, process activity, alerts, and response actions.

---

Question 4:

A device is visible in Intune but does not appear in Microsoft Defender portal under Assets > Devices. What is the most likely issue?

A. The device cannot be managed by Intune
B. Microsoft Sentinel is not enabled
C. Defender for Endpoint onboarding or integration is not configured correctly
D. The device must be deleted from Microsoft Entra ID

Correct Answer:
C. Defender for Endpoint onboarding or integration is not configured correctly

Explanation:
Intune enrollment and Defender for Endpoint onboarding are related but separate. A device can be managed by Intune without being fully onboarded into Defender for Endpoint.

---

Question 5:

Which tool should you use to centrally onboard Intune-managed Windows devices into Defender for Endpoint?

A. Microsoft Intune
B. Microsoft Purview
C. Microsoft Defender for Office 365
D. Microsoft Teams admin center

Correct Answer:
A. Microsoft Intune

Explanation:
Microsoft Intune is used to manage devices and can deploy Defender for Endpoint onboarding settings to supported managed endpoints.