EDR deployment checklist for new workstations

Overview

Use this runbook when onboarding a new Windows workstation or re-imaging a device that must join a managed tenant with Microsoft Defender for Endpoint (MDE) or an equivalent EDR.

Prerequisites

• Intune (or your RMM) can deploy packages and read device compliance.
• Tenant has sufficient MDE (Plan 1/2 or bundled SKUs) licensing for the user or device.
• Outbound HTTPS from endpoints to Microsoft endpoints is allowed (proxy exceptions documented).
• You have a test device to validate policy before broad assignment.

Device readiness

1. Confirm the OS build is supported by your EDR stack (Windows 10 20H2+ or Windows 11 as required).
2. Remove conflicting legacy AV only after MDE is reporting Healthy and policies are applied (or follow vendor coexistence guidance).
3. Confirm time sync (domain or reliable NTP); clock skew breaks certificate and update channels.
4. Tag the device in Intune/RMM with the correct group that maps to EDR onboarding and exclusions rings.

Onboarding sequence

1. Join Entra ID (AAD) or hybrid join per client standard; avoid stale hybrid records.
2. Deploy the Defender for Endpoint onboarding package (Intune, GPO, or local script) from the security.microsoft.com onboarding section for the correct OS.
3. Verify services: Sense / Defender services running; Get-MpComputerStatus shows AMSI/on-access enabled where expected.
4. Confirm telemetry in Microsoft 365 Defender > Devices within 30–60 minutes (allow proxies to settle).
5. Assign Antivirus and Attack Surface Reduction policy from your baseline tier (audit first if net-new client).

Validation checks

• Device shows Active in MDE inventory with correct primary user.
• Quick scan or full scan can be initiated remotely and completes.
• Sample harmless EICAR test in a controlled folder triggers detection (where permitted by client policy).
• Exclusions list matches documented LOB paths; no broad folder exclusions without approval.

Common pitfalls

• Proxy SSL inspection breaking MDE connectivity (add exceptions per Microsoft documentation).
• Wrong tenant onboarding file copied between clients—always regenerate per tenant.
• Duplicate or stale AD computer accounts breaking hybrid join and policy delivery.

Documentation

Record onboarding package version, assignment groups, and validation screenshots in the PSA ticket and the client configuration document.