Does an Intune EDR Policy Auto-Onboard Devices to Defender for Endpoint?
Short answer
A Creating and assigning an Intune endpoint detection and response (EDR) policy onboards enrolled devices to Microsoft Defender for Endpoint automatically.
Question
Key Takeaways
The question tests whether you know that an assigned Intune EDR policy onboards Windows devices to Defender for Endpoint by itself; the trap is believing that only the Defender for Endpoint connector in Intune can perform automatic onboarding.
When Microsoft Defender for Endpoint is integrated with Intune, an endpoint detection and response (EDR) policy is a supported way to push the Defender for Endpoint onboarding configuration so enrolled devices onboard automatically. This page confirms that creating an EDR policy does meet the stated goal.
Common mistake: Answering No on the assumption that onboarding must be enabled through the Microsoft Defender for Endpoint connector in Intune or configured manually in the Defender portal, when an assigned EDR policy already delivers the onboarding package to targeted devices.
Expert Analysis
Why the Answer Is Correct
In Intune, the Endpoint security workload provides an Endpoint detection and response (EDR) policy type whose purpose is exactly what the scenario asks for: onboarding devices to Microsoft Defender for Endpoint. When you create such a policy for the Windows platform and assign it to a device group, Intune delivers the Defender for Endpoint onboarding package and configuration to those devices, so devices that enroll (or that already exist in the targeted group) are onboarded automatically without any manual script or portal step. Integration between Defender for Endpoint and Intune in an E5 subscription is already assumed by the scenario, so nothing else is required. Because the solution of creating an EDR policy satisfies the requirement of automatic onboarding at enrollment, the correct verdict is Yes.
Why the Other Options Are Wrong
"No" is the only distractor and it fails because it treats the EDR policy as if it merely tuned detection and response settings on an already-onboarded device. In reality the Intune EDR policy profile is one of the official onboarding mechanisms for Windows devices, alongside the Defender for Endpoint connector's automatic onboarding toggle. The connector is an alternative route, not a prerequisite, so its absence does not invalidate the stated solution. Choosing No would only be correct if the solution omitted the assignment of the policy to a device group or used a policy type that cannot carry onboarding data.
Community Comment Notes
KoenJas's comment essentially reproduces the scenario text rather than adding an argument. Preeb argued the opposite of the key, writing that "Creating an endpoint detection and response (EDR) policy alone does not ensure" onboarding and insisting the Defender portal and additional Intune configuration are needed — that overstates the requirement, since the EDR policy itself deploys the onboarding configuration. Krayzr concluded simply that the answer "would be yes", and the learner votes are unanimous for A, matching the analysis above.
Official Reference
- https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy
- https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure
These links open the official vendor documentation in a new tab.
Exam Strategy
For "does this meet the goal" case items, evaluate only the effect of the single action named in the solution against the stated requirement. An Intune EDR policy supplies the Defender for Endpoint onboarding payload on its own, so do not add imaginary prerequisites such as configuring the Defender portal before answering Yes.
Frequently Asked Questions
Why is answering No tempting on this Intune EDR policy question?
Does the EDR policy onboard devices that are already enrolled in Intune?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
KoenJas 👍 3After you answer a question in this section, you will NOT be able to return. As a result these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. You integrate Microsoft Defender for Endpoint with Microsoft Intune. You need to ensure that devices automatically onboard to Defender for Endpoint when they are enrolled in Intune. Solution: You create an endpoint detection and response (EDR) policy. Does this meet the goal? A. Yes B. No Yes, creating an endpoint detection and response (EDR) policy meets the goal. This policy ensures that devices are automatically onboarded to Microsoft Defender for Endpoint when they are enrolled in Intune, providing the necessary protection and monitoring. So, that would be a “yes.”
-
Preeb 👍 1No, Creating an endpoint detection and response (EDR) policy alone does not ensure that devices automatically onboard to Microsoft Defender for Endpoint when they are enrolled in Intune. To achieve automatic onboarding, you typically need to configure the onboarding settings in the Defender for Endpoint portal and ensure that the necessary configurations are set up within Intune for the devices to be enrolled and recognized by Defender for Endpoint.
-
Krayzr 👍 1 Answered Awould be “yes.”
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →