Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

The new Defender server security experience - Microsoft Defender for Endpoint | Microsoft Learn

8 October 2026Public preview+126 / −21 lines

In brief

The page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers. It covers server asset views, investigations, hunting, RBAC, and device groups.

What Defender admins need to know

Administrators can manage protection and investigate threats using combined cloud and endpoint information. Existing Defender for Endpoint servers require no onboarding, reinstallation, or migration; review capability requirements before changing configuration.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Integration with MicrosoftThe new Defender for Cloudserver security experience - Microsoft Defender for Endpoint | Microsoft Learn

MicrosoftThe new Defender server security experience brings Defender for Endpoint can integrate with Microsoftand Defender for Cloud to provide a comprehensive Windows server protection solution. With this integration, Microsoft Defender for Cloud can use the power of Defender for Endpoint to provide improved threat detection for Windows Servers.

The following capabilities are included in this integration:

  • Automated onboarding - Defender for Endpoint sensor is automatically enabled on Windows Servers that are onboarded to Microsoft Defender for Cloud. For more information on Microsoft Defender for Cloud onboarding, see Use the integrated Microsoft Defender for Endpoint license.

    Note

    The integration between Microsoft Defender for servers and Microsoft Defender for Endpoint has been expanded to support Windows Server 2019 and Azure Virtual Desktop (AVD).

  • Windows servers monitored by Microsoft Defender for Cloud will also be available in Defender for Endpoint - Microsoft Defender for Cloud seamlessly connects to the Defender for Endpoint tenant, providing a single view across clients and servers. In addition, Defender for Endpoint alerts will be availabletogether in the Microsoft Defender portal. Use it to manage server protection and investigate threats with cloud and endpoint information in one place.

    This public preview covers Azure environments and on-premises servers. See What's new for Cloud console.the release summary.

  • On this page: Server investigation - Microsoftasset page | Investigate an incident | Go hunt | RBAC and device groups.

    Servers already running Defender for Cloud customers can access the Microsoft Defender portal to perform detailed investigation to uncover the scope of a potential breach.

Endpoint

Important

  • When you use Microsoft Defender for Cloud to monitor servers, aServers already running Defender for Endpoint tenant is automatically created (in the US for US users, in the EU for European and UK users). Data collected by Defender for Endpoint is stored in the geo-location of the tenant as identified during provisioning.
  • If you use Defender for Endpoint before using Microsoft Defender for Cloud, your data will be stored in the location you specified when you created your tenant even if you integratecontinue operating with Microsoft Defender for Cloud at a later time.
  • Once configured, you cannot change the location where your data is stored. If youtheir existing configuration. You don't need to moveonboard, reinstall, or migrate them to maintain their existing protection. Review the requirements for each unified capability before changing your data to another location, you need to contact Microsoft Support to resetconfiguration.

    Review the tenant. Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers. server asset page

    \ No newline at end of file The server asset page brings together available cloud-resource and endpoint-device information for the same server, instead of requiring separate investigation pages.

    1. In Microsoft Defender, open an alert involving the server and select Open asset page from the server's menu. From an incident graph, open the server node's menu and select Asset details.
    2. Check the endpoint device ID and, where available, the Azure resource ID. Don't identify a server by name alone.
    3. Review the server's identity, onboarding status, and available resource and operating-system details.
    4. Select Open device timeline to inspect endpoint activity, or Go hunt to investigate related events.

    If records appear duplicated or incorrectly matched, check both identifiers before taking action. Available context depends on connected data sources; manual onboarding doesn't create an Azure resource.

    Response actions depend on your permissions, the platform, and the server's state. Use the supported device-response guidance before taking an action that could affect the workload.

    Investigate alerts and incidents

    To investigate a server, you need access to its investigation data, and the server must have a related alert or incident.

    1. Open an incident involving the server and review its attack graph.
    2. Select the server node. For a server with correlated cloud and endpoint records, the graph provides one server identity and investigation menu.
    3. Right-click the node or open its ellipsis menu. Choose Asset details for context, Pin related alerts to inspect related detections, or Go hunt to investigate activity.
    4. Open a related alert and follow its server link. Confirm that it leads to the same server identity before considering a response action.

    Cloud and endpoint alerts can refer to the same server without becoming a single alert. A shared asset identity doesn't guarantee that every alert is grouped into one incident.

    Use Go hunt

    You need advanced hunting access to the data being queried. Being able to open an asset page doesn't grant access to all hunting tables.

    1. From the incident graph, open the server node's menu and select Go hunt. You can also use the action from the server's alert or asset context where available.
    2. Choose All activity, Related alerts, or See all available queries, then select the query you need.
    3. Inspect the generated query and its results in advanced hunting. Go hunt can execute the generated query automatically rather than only displaying it for review.
    4. Check that the query targets the intended server. Where both identities are available, review its endpoint device and cloud-resource identifiers, selected tables, and time range.
    5. To investigate another time window, adjust the query's timestamp filter and run it again. Use UTC in query expressions.
    6. Open relevant results, compare their timestamps with the alert, and return to the incident to continue the investigation.

    For a specific endpoint event, open Device timeline, select the event, and use Hunt for related events where available. This searches around that event rather than starting from the whole server.

    All activity doesn't guarantee every data source is included. If results are empty or incomplete, check the query filters, available tables, retention, endpoint reporting, and your data permissions. An empty query result doesn't establish that the server is unaffected. See Go hunt query behavior for query-adjustment guidance.

    Verify RBAC and server access

    Roles define what a person can do; scopes define which data they can access.

    ControlPurpose
    Microsoft Entra user groupIdentifies the people receiving access, such as a server operations team.
    Defender RBAC roleGrants selected read, investigation, response, or administration permissions.
    Device groupGroups endpoints and controls access to their data through assigned Entra user groups. It can also set automated-remediation behavior.
    Cloud scopeGroups selected cloud environments, such as Azure subscriptions, for cloud-data access. It is separate from Azure RBAC.

    For a server represented in both cloud and endpoint data, configure the relevant cloud scope and device group. Linking a device group to a cloud scope aligns server membership; it doesn't replace role assignments or grant users access by itself. Existing endpoint-only deployments don't need a cloud connection just to continue operating.

    Assign the team's permissions

    Use the permissions model active in your tenant. Don't activate a different model merely to follow this guide.

    For tenants using Microsoft Defender unified RBAC, a Security Administrator or an administrator with the required delegated Authorization permissions can:

    1. Open Permissions > Microsoft Defender XDR > Roles and create or edit the appropriate role.
    2. Select the permissions the team needs. Keep investigation access separate from response and administration permissions.
    3. Add an assignment for the team's Microsoft Entra security group and the required data sources. Access to Defender for Endpoint data alone doesn't grant access to Defender for Cloud data.
    4. For cloud data, select the intended cloud scopes. Review and submit the assignment.

    Follow Create custom roles for the full wizard. Tenants still using the previous endpoint model should use Defender for Endpoint RBAC; existing roles aren't replaced by this experience.

    Define a server device group

    Create a device group to manage access to servers using device conditions or existing cloud scopes. Before you begin, ensure that the Microsoft Entra user groups you want to assign have the appropriate role-based access control (RBAC) roles.

    1. In the Microsoft Defender portal, go to Settings > Endpoints > Permissions > Device groups.

    2. Select Add device group, or edit an existing group. Enter a descriptive name and review the automated-remediation level.

    3. On the Devices page, choose how to populate the group:

      OptionDescription
      Define using conditionsMatch servers using supported device attributes, such as device name, domain, tags, or OS platform.
      Select cloud scopes to populate this groupSelect one or more existing cloud scopes. Devices from all selected scopes are included. (preview)

    4. Select Next and review the matching devices on the Preview devices page before continuing.

    5. On the User access page, select the Microsoft Entra user groups that should have access, and then select Submit.

    6. Review the group's membership and access assignments. For condition-based groups, review the group ranking: a device that matches multiple condition-based groups belongs to the highest-ranked group.

    Note

    Cloud-scope membership includes all devices from the selected scopes. Review the selected scopes to ensure that the group includes only the intended devices.

    Align a cloud scope and device group

    1. If needed, create the Azure scope under System > Permissions > Microsoft Defender XDR > Scopes > Add cloud scope. Select the intended connected Azure subscriptions.
    2. Assign the team's cloud-data permissions to that scope, then select it in the device group's Devices step.
    3. Keep the team's endpoint role and device-group User access assignment in place. Verify access to both data sources.

    Follow Manage cloud scopes if scope activation is required. Activation is an irreversible configuration change: review existing assignments and the activation wizard before proceeding.

    The cloud-scope link updates device membership as the selected scope's contents change. Newly connected environments aren't automatically added to the cloud scope. Review scope membership when adding an Azure environment.

    Check the effective access

    Test with ordinary analyst accounts, not only a Security Administrator account; broad administrator access can hide scoping mistakes. A display filter narrows a view but isn't a substitute for permissions.

    CheckRequired outcome
    Open a server within the user's assigned accessThe intended server and permitted data are available.
    Navigate from an alert or incident to the asset and huntingThe server identity remains correct and access remains appropriate.
    Attempt to open an out-of-scope serverRestricted data and actions remain inaccessible.
    Check a response or configuration actionThe action is available only to an authorized user; don't execute disruptive actions just to test access.

    If expected access is missing, check role permissions, data-source assignments, Entra group membership, the device's effective group, and its cloud scope. If an analyst sees unintended server data, review other role assignments and broad access before expanding the rollout.

    Remove server protection

    See Offboard devices for automatic Azure offboarding and other supported offboarding methods. \ No newline at end of file