Setting Up Microsoft Defender for Business (Step-by-Step)

Overview

Microsoft Defender for Business is an endpoint security solution built specifically for small and medium businesses (up to 300 users). It includes endpoint detection and response (EDR), automated investigation, threat and vulnerability management, and attack surface reduction — capabilities that previously required an E5 licence.

Defender for Business is included with Microsoft 365 Business Premium or available as a standalone add-on.

Prerequisites

• Microsoft 365 Business Premium, E3 + Defender for Business add-on, or E5 licence
• Global Admin or Security Admin role
• Devices running Windows 10/11 Pro, Enterprise, or Education
• macOS, iOS, and Android are also supported

Step 1: Open the Setup Wizard

1. Go to security.microsoft.com (Microsoft Defender XDR portal)
2. If this is your first time, the Setup wizard will launch automatically
3. If not, go to Settings > Endpoints > Onboarding

The wizard walks through:

• Assigning user permissions
• Setting up email notifications for alerts
• Onboarding your first devices

Step 2: Onboard Devices

Windows devices via Intune (recommended)

If your devices are enrolled in Intune, onboarding is automatic:

1. Go to intune.microsoft.com > Endpoint security > Microsoft Defender for Endpoint
2. Toggle Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations to On
3. Toggle Connect Windows devices to On
4. Devices will onboard automatically within hours

Windows devices via local script (for non-Intune environments)

1. Go to security.microsoft.com > Settings > Endpoints > Onboarding
2. Select Local Script as the deployment method
3. Download the onboarding package
4. Run on each device as Administrator:

# Extract and run the onboarding script
Expand-Archive -Path "WindowsDefenderATPOnboardingPackage.zip" -DestinationPath "C:\Temp\MDE"
& "C:\Temp\MDE\WindowsDefenderATPLocalOnboardingScript.cmd"

Verify onboarding

# Check Defender for Endpoint service status
Get-Service -Name "Sense" | Select-Object Status, StartType
# Should show: Running, Automatic

Or check in the portal: security.microsoft.com > Assets > Devices — the device should appear within 5-10 minutes.

macOS devices

1. In the Defender portal, go to Settings > Endpoints > Onboarding
2. Select macOS as the operating system
3. Download the onboarding package
4. Deploy via Intune or install manually using the .pkg installer

Mobile devices (iOS / Android)

Deploy Microsoft Defender via Intune app deployment:

1. Go to intune.microsoft.com > Apps > All apps > Add
2. Select Microsoft Defender for the appropriate platform
3. Assign to your user groups

Step 3: Configure Security Policies

Default policies (automatic)

Defender for Business comes with pre-configured policies that are suitable for most SMBs:

Customise policies

To adjust policies:

1. Go to security.microsoft.com > Endpoints > Configuration management > Device configuration
2. Click the policy you want to edit
3. Common adjustments:
   • Move ASR rules from Audit to Block after reviewing audit results for 1-2 weeks
   • Add folder exclusions for line-of-business applications that trigger false positives
   • Adjust scan schedules to run outside business hours

Step 4: Configure Alerts and Notifications

1. Go to security.microsoft.com > Settings > Endpoints > Email notifications
2. Click Add notification rule
3. Configure:
   • Name: Critical Alerts — IT Team
   • Severity: High and Critical
   • Recipients: your IT team email or distribution group
4. Also configure alerts in Settings > Endpoints > Alert notifications for specific detection categories

Step 5: Review the Security Dashboard

After onboarding devices, your main monitoring views are:

Threat and Vulnerability Management

security.microsoft.com > Vulnerability management > Dashboard

This shows:

• Exposure score — how vulnerable your environment is (lower is better)
• Microsoft Secure Score for Devices — how well your devices are configured
• Top security recommendations — prioritised actions to reduce risk
• Vulnerable software — applications with known CVEs installed on your devices

Incidents and Alerts

security.microsoft.com > Incidents & alerts

This shows correlated security events. Each incident groups related alerts, affected devices, and users into a single investigation view. Defender automatically investigates many alerts and takes remediation actions.

Device Inventory

security.microsoft.com > Assets > Devices

Shows all onboarded devices with their:

• Risk level (High, Medium, Low)
• Exposure level
• OS version and health status
• Last seen timestamp

Step 6: Enable Automated Investigation and Response

Defender for Business includes automated investigation that can quarantine files, block malicious processes, and remediate threats without manual intervention.

1. Go to security.microsoft.com > Settings > Endpoints > Advanced features
2. Ensure Automated Investigation is set to On
3. Set the automation level to Full - remediate threats automatically for most environments

Monitoring Checklist (Weekly)

Troubleshooting

Next Steps

• Enable web content filtering to block malicious and inappropriate websites
• Configure device groups to apply different policies to different teams
• Integrate with Microsoft Sentinel for advanced SIEM capabilities (larger organisations)
• Review the Secure Score recommendations monthly and implement the top priorities