Onboard iOS Devices to Microsoft Defender for Endpoint via Intune

MS-102 By islever Editorial Last updated

Short answer

D Add an app to Intune to deploy the Microsoft Defender for Endpoint iOS app to corporate-owned devices.

Question

You have a Microsoft 365 E5 subscription that includes Microsoft Intune. You manage all iOS devices by using Intune. You plan to protect corporate-owned iOS devices by using Microsoft Defender for Endpoint. You configure a connection between Intune and Defender for Endpoint. You need to onboard the devices to Defender for Endpoint. What should you do?
  1. Download an onboarding package.
  2. Create an app protection policy.
  3. Enable Microsoft Defender for Cloud.
  4. Add an app to Intune. Correct Answer

Key Takeaways

The question tests the difference between agent-based onboarding (Windows/macOS) and app-based deployment (iOS) in the context of Intune integration.

This page clarifies the correct method to onboard corporate-owned iOS devices to Microsoft Defender for Endpoint using Intune. It explains that deploying the specific app is required, contrary to Windows/macOS onboarding packages.

Common mistake: Most candidates choose 'Download an onboarding package' because this is the standard procedure for Windows and macOS devices, leading them to incorrectly apply the same logic to iOS.

Expert Analysis

Why the Answer Is Correct

For iOS devices managed by Intune, Microsoft Defender for Endpoint is deployed as a native application rather than through a background agent script. The correct action is to add the Microsoft Defender for Endpoint app to Intune (Option D). By adding the iOS store app to Intune, administrators can deploy it to enrolled user groups, ensuring the security solution is installed and active on the corporate-owned devices.

Why the Other Options Are Wrong

Option A is incorrect because onboarding packages are used for Windows and macOS devices to configure the sensor and connect to the service; they are not applicable to iOS. Option B, creating an app protection policy, secures data within apps but does not install or onboard the endpoint detection tool itself. Option C refers to Microsoft Defender for Cloud, which is a cloud security posture management tool unrelated to device-level endpoint protection.

Community Comment Notes

Community consensus initially favored Option D, with users noting that the term "Add an app" specifically refers to adding the iOS store app in the Intune admin center. Some users were confused by the phrasing, preferring the term "onboarding package," but verified that for iOS, the mechanism is app deployment. One commenter explicitly stated that downloading an onboarding package is used for Windows/macOS only, reinforcing why D is the distinct correct choice for iOS.

Exam Strategy

Always distinguish between OS-specific deployment methods. For Windows/macOS, look for 'onboarding package' or 'agent'. For iOS/iPadOS, look for 'app deployment' or 'store app' when integrating third-party or Microsoft security apps via Intune.

Frequently Asked Questions

Why isn't 'Download an onboarding package' correct for iOS?

Onboarding packages are scripts/configs for Windows and macOS sensors. iOS uses the Microsoft Defender for Endpoint app from the App Store.

What does 'Add an app' mean in Option D?

It means adding the Microsoft Defender for Endpoint iOS store app in the Intune Admin Center and assigning it to user groups.

More MS-102 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Preeb 👍 6
    Answer is Download an onboarding package.
  2. Tr619899 👍 3
    A. Download an onboarding package. Explanation: Onboarding Package: For Defender for Endpoint, an onboarding package must be downloaded and deployed to the devices. This package typically includes the necessary scripts or configurations that enable the integration of Defender for Endpoint with your managed devices through Intune. Additional Steps: After downloading the onboarding package, you would deploy it to the iOS devices managed by Intune. This process helps ensure that these devices are properly registered with Defender for Endpoint and start receiving the necessary protection policies.
  3. 665d390 👍 3 Answered D
    https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-ios Deployment of Microsoft Defender for Endpoint on iOS can be done via Microsoft Intune and both supervised and unsupervised devices are supported
  4. Xive 👍 3 Answered D
    D is correct. For Administrators Access to the Microsoft Defender portal. Access to the Microsoft Intune admin center, to: Deploy the app to enrolled user groups in your organization.
  5. Ody 👍 2
    It's worded oddly, but it is correct. By "an app" they mean the "iOS store app" In the Microsoft Intune admin center, go to Apps > iOS/iPadOS > Add > iOS store app and click Select.
Show 2 more comments
  1. Alireza2147 👍 1 Answered A
    To onboard corporate-owned iOS devices to Microsoft Defender for Endpoint when you're using Microsoft Intune, you need to follow these steps: Download an onboarding package from the Microsoft Defender for Endpoint portal. This package will provide the necessary configuration files or apps that enable Defender for Endpoint to be deployed and activated on the devices. Install the onboarding package on the iOS devices, which could involve pushing the configuration through Intune, so Defender for Endpoint can start protecting the devices.
  2. wafferrr 👍 1 Answered D
    Download an onboarding package is used for Windows/macOS onboarding but not for iOS.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which passwordless method works on Windows, Android, and iOS?

S-grade

How Do You Monitor Mailbox Activities in Defender for Cloud Apps?

S-grade

Which components configure a Defender for Cloud Apps log collector?

S-grade

How to Configure a Custom Phishing Link in Attack Simulation Training?

S-grade

Practice All MS-102 Questions

Access 111 questions with complete answers and detailed explanations.

View Full MS-102 Practice Test →

← Back to MS-102 Study Guide