Summary

Microsoft Defender for Endpoint requires each device to be onboarded to your tenant before it reports in. This article covers using an Automox Worklet to onboard Windows devices at scale, using the local onboarding package to carry your tenant details.

Prerequisites

1. A Microsoft 365 tenant with licensing that includes Defender for Endpoint.
   • See Microsoft's Minimum requirements for Microsoft Defender for Endpoint for licensing and supported platforms.
   • You can confirm the service is live by opening the Microsoft Defender portal and checking that an Endpoints section exists under Settings.
2. An account with permission to view and download the Onboarding and Offboarding packages. Consult Microsoft's role documentation for the current requirement, since Defender permissions have moved to unified role-based access control.
3. An Automox agent installed on every device you intend to onboard. This Worklet targets Windows. For other platforms, use the onboarding methods Microsoft documents for those operating systems.
4. Microsoft Defender Antivirus must be present and running on the device. It is a prerequisite component, and onboarding will not succeed without it. This is the most common cause of an onboarding run that reports success while the device never appears in the portal.
   • On older Windows Server versions the Defender sensor components are not present by default and must be installed before the onboarding package is run. See Microsoft's Onboard Windows servers guidance for the requirements that apply to your Server version.

Deploying the Worklet

Obtaining the Payload

Microsoft provides a local onboarding script package containing an organization ID unique to your tenant, along with certificate information used to validate communication during onboarding. That package is delivered to the Worklet as a payload.

1. Open the Microsoft Defender portal.
2. From the left-hand menu, select Settings.

1. From the Settings menu, select Endpoints.

1. Scroll down the Settings menu and select Onboarding under Device management.

1. Set the operating system dropdown to Windows 10 and 11, set Deployment method to Local Script (for up to 10 devices), then select Download onboarding package.

• Note: the "up to 10 devices" label can be disregarded here. Microsoft applies that guidance because the local script has no deployment tracking of its own, which the Worklet provides. The package is used only to supply your tenant information, and the script inside it is not what runs.
• Do not rename the downloaded zip file. The Worklet references the default name, WindowsDefenderATPOnboardingPackage.zip.

Creating the Policy

1. Open the Automox console and sign in with an account holding Zone Operator for a single zone, or Global Administrator to apply across the organization.
2. From the navigation bar, select Manage > Worklet Catalog.
   • 
3. Search for Defender. Locate the Defender for Endpoint onboarding Worklet in the results, select the ellipsis button to its right, then Create Policy.
   • 
   • Search rather than matching an exact name, as catalog Worklet titles are occasionally revised.
4. In the Create worklet wizard, select + Associate Groups and select the groups this policy should apply to.
5. Scroll to the Payload section below the Remediation Code panel and select Upload File.
   • 
6. Select the zip file downloaded earlier. A tile appears confirming the payload uploaded.
   • 
7. Configure the schedule to your preference and select Create Policy.
   • Note: after a device completes a successful run, it can take roughly 5 to 30 minutes to appear in the Microsoft Defender portal.

Troubleshooting

• The Worklet reports exit code 0 and nothing happens. Exit code 0 means the evaluation found nothing to do. Confirm the devices are actually in an assigned group and that the payload uploaded, then check whether the Defender Antivirus prerequisite above is satisfied.
• The run succeeds but the device never appears in the portal. Allow up to 30 minutes first. If it still does not appear, verify Defender Antivirus is present and running, and on Server editions confirm the sensor prerequisites for that version.
• Onboarding works on workstations but not servers. Older Server versions require components to be installed before onboarding. Treat servers as a separate group with their own prerequisite step rather than adding them to the workstation policy.
• Confirm the payload name. A renamed zip file causes the Worklet to fail to locate it.

Related resources

• Onboard Windows devices using a local script
• Onboard Windows servers to Microsoft Defender for Endpoint
• Minimum requirements for Microsoft Defender for Endpoint