cuong do

Posted on Oct 13 Originally published at gitlab.com

Defender for Endpoint: licensing and permissions

#microsoftdefender #mde #endpointsecurity #azuresecurity

My own Day 1 study notes on Defender for Endpoint, cleaned up and checked against current Microsoft Learn docs (October 2026).
Read this before you onboard the first device: most "why can't I see X" problems later come from the wrong plan or the wrong role.

All screenshots come from my own lab tenant. Names and IDs are cropped or blacked out.

1. What MDE is
2. Plans
3. Requirements to check first
4. Mixed licensing (Plan 1 and Plan 2 in one tenant)
5. Permissions
6. Summary
References (Microsoft Learn)

1. What MDE is

Microsoft Defender for Endpoint (MDE) protects, detects, investigates and responds to threats on endpoints: Windows, macOS, Linux, Android and iOS.

Capability	What it does
Behavioral sensors	Built into Windows, collect and send behavior data
Cloud security analytics	Machine learning on that data to find threats
Threat intelligence	Attacker techniques seen by Microsoft and partners
Vulnerability management	Find and fix weak software and settings
Attack surface reduction	ASR rules, network and web protection, device control
Next-generation protection	Microsoft Defender Antivirus
EDR	Investigate and respond to threats that got past prevention
Automated investigation and remediation	Fewer alerts to handle by hand
Defender Experts	Managed hunting service (paid add-on)
APIs	Automation and integration

It integrates with Defender XDR, Microsoft Sentinel, Intune and the other Defender products (Cloud, Identity, Office 365, Cloud Apps).

Source: Microsoft Defender for Endpoint overview

2. Plans

	Plan 1	Plan 2
Where you get it	Standalone, or in Microsoft 365 E3/A3	Standalone, or in Microsoft 365 E5/A5
Next-gen AV, ASR, manual response	✓	✓
EDR, advanced hunting, automated investigation		✓

Defender Vulnerability Management add-on gives extra risk-assessment features.
Microsoft Defender for Business is the version for small and medium businesses.
Servers are licensed separately: Defender for Servers Plan 1 or 2 (through Defender for Cloud), or Defender for Endpoint for Servers.

This is what the plans look like when you search the product catalog in the Microsoft 365 admin center (Marketplace). Prices are what my lab showed at the time and differ by region and agreement.

My lab used trial licenses:

MDE comes as a service plan inside bundles such as Microsoft 365 E5. You can see it, and switch it on or off per user, under Billing > Licenses > (product) > Assign licenses:

Sources: Defender for Endpoint Plan 1 overview · Defender for Business overview

3. Requirements to check first

OS: Windows 10/11, Windows Server 2012 R2 and later, Windows 365 Cloud PC, Azure Local, macOS, Linux, Android, iOS.
Hardware: the same as the OS needs. My lab rule of thumb: 2 cores and 1 GB RAM minimum, 4 of each is more comfortable.
Browser for the portal: Microsoft Edge or any modern browser.
Network: IPv4, or IPv6 with DNS64/NAT64. Devices need internet access, direct or through a proxy.
Data location: you pick the geography when the tenant is first set up. You cannot change it later, so decide it on purpose.

Source: Minimum requirements for Microsoft Defender for Endpoint

Microsoft Defender Antivirus must still be there

Defender Antivirus must be installed, even if another antivirus is the main one.
With a third-party antivirus on an onboarded device, Defender Antivirus runs in passive mode. Real-time scanning and updates keep working, but features such as cloud-delivered protection and ASR rules do not.
The ELAM driver must be enabled, or onboarding fails.
Do not disable the Defender services (WinDefend, Sense and so on) to "make room" for the other product.

Quick check on a Windows device:

Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled

AMRunningMode shows Normal, Passive or EDR Block Mode.

Source: Defender Antivirus compatibility with other security products

4. Mixed licensing (Plan 1 and Plan 2 in one tenant)

Common cases:

different plans for different user groups
a Plan 2 trial for some users while the rest stay on Plan 1
a slow move from Plan 1 to Plan 2

How it works:

Mixed mode: tag devices to decide which ones get Plan 1 or Plan 2 features.
Single plan mode: one plan for every device.
Check the result in the license usage report in the Defender portal.

Limits:

Mixed mode is for client devices only, not servers.
Defender for Business does not support mixed licensing.

Source: Manage subscription settings (mixed licensing)

Three ways to tag a device

1. Manually in the portal. Open the device page, then Manage tags:

2. With the registry on the device. Set the Group value (REG_SZ) under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging. In my lab the tag was Kiosk:

# Run as administrator. Replace Kiosk with your tag.
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging" -Name Group -Value "Kiosk"

Registry tags sync about once a day. A restart makes the device send it sooner. To remove the tag, clear the value instead of deleting the key.

3. With rules. Rule-based tags are added automatically from conditions such as device name, domain or OS.

Source: Create and manage device tags

5. Permissions

Admin roles

Whoever buys the subscription becomes Global Administrator by default.
Keep Global Administrators to a minimum. Give each person the least privileged role that does the job.
Assign roles from the user's profile, from Roles > Role assignments, or with PowerShell for many users. Export the admin list to CSV and review it regularly.

Source: Assign admin roles in Microsoft 365

Unified RBAC (URBAC)

One place in the Defender portal to manage permissions for Endpoint, Identity, Office 365 Plan 2, Cloud, Vulnerability Management, Cloud Apps and more.
New Endpoint tenants use URBAC by default since February 2025.
You need Global Administrator or Security Administrator in Entra ID to set it up.
Existing roles can be imported. You activate URBAC per workload. After that, you manage those permissions only in the Defender portal.

Source: Microsoft Defender XDR Unified RBAC

Custom roles for Endpoint

In my lab I built a "view only" role for local IT. The permission groups are: View data, Active remediation actions, Alerts investigation, Manage security settings and Live response (Basic or Advanced). Tier 1 only gets View data:

This screenshot is from the older Endpoint roles page (Settings > Endpoints > Roles). In a URBAC tenant you create the same thing under Permissions > Microsoft Defender XDR > Roles, and the permission names are grouped a little differently.

Sources: Create and manage roles for RBAC · Use RBAC in Defender for Endpoint

Device groups and a simple tier model

Use Entra ID groups plus custom roles, and limit what each role sees with device groups.

A device group is built from matching rules on name, domain, tag and OS. Here the rule uses the tag from section 4:

Each group gets its own remediation level and the Entra ID user groups that can see it. A device that matches several groups lands only in the highest-ranked one. Devices that match nothing go to Ungrouped devices (default).

Tier	Who	Example permissions
Tier 1	Local IT / security ops	View data
Tier 2	Regional security ops	View data + remediation
Tier 3	Global security experts	Full access

Source: Create and manage device groups

6. Summary

Pick the right plan first: Plan 1, Plan 2, Business, and separate server licenses.
Defender Antivirus must exist even when it is not the main antivirus.
Mixed licensing works for clients, not servers. Tags decide which plan a device gets.
Use least privilege. Plan for URBAC, custom roles and device groups early.

Next: Day 2: onboard a device, then decide who can see it

DEV Community