Supported Methods for Onboarding Devices to Defender for Endpoint in Intune
You need to onboard devices to Microsoft Defender for Endpoint using Microsoft Intune. Which THREE methods are supported?
Quick Answer
The answer is three supported methods: Microsoft Defender for Endpoint onboarding configuration profiles in Intune, Intune security policies, and Group Policy. These methods are correct because they directly integrate with the Windows security stack to push the onboarding script or configuration package to endpoints, establishing the required sensor connection to the Defender for Endpoint service. On the MD-102 exam, this question tests your ability to distinguish between endpoint management tools and security policy deployment channels—a common trap is confusing the Microsoft 365 Apps admin center (which handles Office configuration) or Windows Server Update Services (for patch management) with actual Defender onboarding mechanisms. Remember that any method that does not directly apply a Defender configuration package to the device’s security center is a distractor. A useful memory tip is “POG”: Policies (Intune security policies), Onboarding profiles (Defender-specific config profiles), and Group Policy—these three cover the full spectrum of managed and unmanaged device onboarding scenarios.
⚠ Common exam trap
Watch out — candidates often confuse the Microsoft 365 Apps admin center with the Microsoft 365 Defender portal or Intune, assuming it can manage security onboarding, when in reality it is limited to Office application lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Group Policy with administrative templates
Group Policy with administrative templates is supported for onboarding devices to Microsoft Defender for Endpoint because the Defender for Endpoint onboarding policy can be delivered via Group Policy objects (GPOs) using the 'Onboard' administrative template (WindowsDefenderATP.admx). This method allows domain-joined Windows devices to receive the onboarding configuration through standard Active Directory Group Policy processing, making it a valid deployment method for on-premises managed devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Group Policy with administrative templates
Why this is correct
Onboarding via GPO for domain-joined devices.
- ✗
Microsoft 365 Apps admin center
Why it's wrong here
Used for Office configuration, not Defender onboarding.
- ✓
Intune endpoint security policy for Microsoft Defender for Endpoint
Why this is correct
Onboarding via endpoint security policy in Intune.
- ✗
Windows Server Update Services
Why it's wrong here
Used for update management, not Defender onboarding.
- ✓
Microsoft Defender for Endpoint onboarding configuration profile in Intune
Why this is correct
Dedicated profile to deploy onboarding package.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
Group Policy
Group Policy is a Windows-based feature that allows administrators to centrally manage and enforce settings for users and computers across an organization.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to deploy Microsoft Defender for Endpoint to Windows 10 devices using Microsoft Intune. Which TWO methods can you use to deploy the Microsoft Defender for Endpoint client?
easy- A.Using Group Policy connected to Intune.
- ✓ B.As a line-of-business (LOB) app in Intune.
- C.From the Microsoft Store for Business.
- ✓ D.Via a device configuration profile using the 'Microsoft Defender for Endpoint' CSP.
- E.Via Microsoft Configuration Manager.
Why B: You can deploy the Microsoft Defender for Endpoint client as a line-of-business (LOB) app in Intune by uploading the Windows Defender ATP client installation file (e.g., WindowsDefenderATPOnboardingPackage.zip) and targeting it to Windows 10 devices. Option D is correct because you can use a device configuration profile with the 'Microsoft Defender for Endpoint' Configuration Service Provider (CSP) to configure and deploy the client settings, such as onboarding and policy enforcement, directly via Intune.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.