Module 7: Defender for Endpoint Configuration & Device Management
Module 1 introduced Defender for Endpoint as a component. Module 3 showed you the device investigation page. This module teaches you to configure the product — onboarding, ASR rules, EDR settings, device groups, and the compliance integration that blocks AiTM attacks.
The configuration decisions you make here directly affect your investigation capability. An unboarded device is invisible. A misconfigured ASR rule blocks legitimate software. A poorly scoped device group gives the wrong analysts access to the wrong devices.
You need Defender for Endpoint P2 (included in M365 E5) and an Intune-enrolled device for full lab exercises. The developer tenant from Module 1.11 provides the licensing. If you do not have a physical device to enroll, you can follow the configuration steps in the portal and verify with KQL queries against sample data.