✅ Onboard all Windows devices to Microsoft Defender for Endpoint, so they are covered by endpoint detection and response (EDR) and Defender Vulnerability Management scanning.

➡️ Provides the automated vulnerability scanning that Essential Eight patching controls depend on.

✅ Devices: All Windows 10 / 11 devices
🚫 Exclusions: None

✅ Device telemetry, threat detection and vulnerability inventory
✅ Template: Endpoint security › Endpoint detection and response

➡️ Devices onboard automatically using the Intune–Defender for Endpoint connector. No onboarding package needs to be uploaded.

ℹ️ Prerequisite: The Microsoft Defender for Endpoint connector must be enabled in Intune (Endpoint security › Microsoft Defender for Endpoint) and the tenant must be licensed for Defender for Endpoint or Defender for Business.

🚫 Antivirus settings (see IBP – DfB – Windows – Antivirus)
🚫 Attack Surface Reduction rules (see E8-IPB-Attack Surface reduction)
🚫 Telemetry reporting frequency

✅ Enabled
✅ Assigned to all devices

✅ A vulnerability scanner is used at least fortnightly to identify missing patches for operating systems (ISM‑1702)
✅ Supports vulnerability scanning for applications (ISM‑1699)
ℹ️ Inforcer Best Practice control applied at all maturity levels

This policy ensures that:

✅ Every Windows device reports to Microsoft Defender
✅ Missing patches and vulnerable software are found automatically
✅ Threats on devices can be detected and investigated

This provides the visibility needed to prove patching and respond to threats.