Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use this procedure only when you choose to associate eligible servers already reporting to Defender for Endpoint with Defender for Servers through an Azure subscription. Direct onboarding doesn't install the endpoint agent and isn't required to continue using an existing Defender for Endpoint deployment.
Note
To connect your non-Azure machines via Azure Arc, see Connect on-premises servers to Defender for Servers.
Who is affected
Important
The setting applies to existing and future eligible non-Azure servers onboarded to Defender for Endpoint in the same Microsoft Entra tenant. You can't select individual servers or limit it to a pilot group.
Review the full affected population before enabling the setting, including servers with an existing Azure Arc connection.
Prerequisites
- Servers meet Defender for Endpoint requirements and report healthy telemetry.
- The selected Azure subscription and Defender for Endpoint use the same Microsoft Entra tenant.
- You have the Owner role on the selected Azure subscription and the Security Administrator role or a higher-privileged role in Microsoft Entra ID.
- Required features are available through this connection. Review feature limits before choosing a plan.
Important
If you have both Microsoft Defender for Endpoint for Servers licenses and Defender for Servers enabled, request the billing discount to avoid double billing. For steps, see Can I get a discount if I already have a Microsoft Defender for Endpoint license?
Configure Direct onboarding
To enable Direct onboarding in the Azure portal:
Sign in to the Azure portal.
Search for and select Defender for Cloud.
Go to Environment settings > Direct onboarding.
Set Direct onboarding to On.
Select the subscription you want to use for servers onboarded through Defender for Endpoint.
Select Save.
Non-Azure servers might take up to 24 hours to appear in the selected subscription.
Verify Direct onboarding
- In Defender for Cloud, confirm that representative affected servers appear under the selected subscription with the intended plan.
- Check endpoint health separately using the onboarding checks.
- Check for duplicate records. Keep the endpoint agent current; older versions can interfere with correlation when a server uses multiple connection methods.
The following minimum agent versions help Defender for Cloud correlate servers that use multiple connection methods:
| Operating system | Minimum agent version |
|---|---|
| Windows Server 2019 and later | 10.8555 |
| Windows Server 2016 or Windows Server 2012 R2 (modern, unified solution) | 10.8560 |
| Linux (AMD64) | 30.101.23052.009 |
| Linux (ARM64) | 30.101.25022.004 |
Feature limits
Direct onboarding supports Defender for Servers Plan 1 and a subset of Plan 2 capabilities. Some Plan 2 features still require Azure Arc. Review plan feature requirements for your workloads.
Direct onboarding supports AWS and GCP VMs using the Defender for Endpoint agent. If you also connect the AWS or GCP account through a multicloud connector, use Azure Arc to access Arc-dependent capabilities.
Direct onboarding doesn't provide Azure management capabilities such as Azure Policy or Guest Configuration. Continue to manage endpoint settings through your existing supported tools.
Manage security settings
| Server type | Management options |
|---|---|
| Windows Server | Defender for Endpoint security settings management Configuration Manager Group Policy PowerShell WMI |
| Linux Server | Defender for Endpoint security settings management Configure security settings in Defender for Endpoint on Linux |