Setting up Microsoft Defender for a business means choosing the right product and licence, running the setup wizard in the Defender portal, onboarding every company device, and then tuning policies in test mode before you enforce them. For most Irish small and medium-sized organisations the product is Microsoft Defender for Business, and the whole process can be done in an afternoon if your licences and device inventory are in order. This guide walks through each stage in sequence, shows where Intune comes in, and covers BitLocker disk encryption, which belongs in the same project.
TL;DR
- Defender for Business is included in Microsoft 365 Business Premium, or available standalone for organisations with up to 300 employees.
- The setup wizard handles the basics: security-team access, email notifications, Windows onboarding and default policies. Manual setup gives you more control.
- Onboard devices through Intune if you already use it. Local script and Group Policy also work.
- Attack surface reduction rules and controlled folder access are configured in Intune, and should run in audit mode before you enforce them.
- Deploy BitLocker through an Intune disk encryption policy, and make sure recovery keys are saved to Microsoft Entra before encryption completes.
Table of Contents
- Which Defender product do you actually need?
- Prerequisites before you start
- Running the setup wizard
- Onboarding your devices
- The first settings to configure
- How to test that protection is working
- Deploying BitLocker alongside Defender
- Our perspective
- Let us handle the setup
- Common mistakes to avoid
- FAQ
- Sources
Which Defender product do you actually need?
The name “Defender” covers several products, which is the first source of confusion. Defender Antivirus is the protection built into Windows. Defender for Endpoint is the enterprise endpoint platform. Defender for Business is the version designed for smaller organisations. Defender for Identity and Defender for Servers address other parts of the estate.
For a business with fewer than 300 people, Defender for Business is normally the right starting point. According to Microsoft’s service description, it is included in Microsoft 365 Business Premium, and it can also be bought standalone for businesses with up to 300 employees. The same page notes that Defender for Business features are enabled at tenant level by default, so you are not starting from nothing. Even so, “enabled” is not the same as “configured and monitored”, and that gap is where most incidents find their way in.
If you are unsure what you already own, check your Microsoft 365 admin centre licences before buying anything. Many firms on Business Premium have been paying for Defender for Business without ever opening the portal. We cover the product comparison in more detail in our Microsoft Defender review for Irish businesses.
Prerequisites before you start
A clean setup depends on a few checks made in advance.
Supported devices. Microsoft’s requirements page says Defender for Business supports Windows 10 and 11 in Business, Pro or Enterprise editions, the three most current macOS releases, and iOS and Android. Servers need a separate licence, so do not assume your file server is covered by the same plan. Windows Home devices, still common where staff have used personal laptops, are not supported.
Licences assigned to users. A licence in the tenant does nothing until it is assigned. Check that every person who uses a company device has one.
An admin account with the right role. Use a named administrator account, protected by multi-factor authentication. If you have not yet enforced it, our six-step MFA checklist for Microsoft 365 is the place to begin, because a security portal protected by a weak admin login defeats the purpose.
A device inventory. List every laptop, desktop and mobile device that touches company data. You cannot confirm onboarding is complete unless you know what complete looks like.
Running the setup wizard
Microsoft gives you two routes in its Defender for Business setup guide: the setup wizard, or a manual setup. Both end up in the same place, and the choice depends on how much control you need on day one.
What the wizard does
According to the same guide, the wizard grants access to your security team, sets up email notifications, onboards Windows devices and applies default settings. For a firm with a single IT contact or an outsourced provider, that covers the essentials quickly.
The practical steps are:
- Sign in to the Microsoft Defender portal with your admin account and open the setup option for Defender for Business.
- Choose who in your organisation or your IT partner should have access to the security console.
- Enter the email addresses that should receive alerts. Use a shared mailbox rather than one person’s inbox, so alerts are not missed during leave.
- Let the wizard onboard Windows devices and apply the default policies.
- Review the summary and confirm.
When to choose manual setup
Manual setup covers users and licences, roles, notifications, onboarding and policies as separate stages. We recommend it when you have multiple sites, different staff groups needing different policies, or an existing endpoint management setup you do not want the wizard to override. It takes longer, but you decide each setting rather than inheriting defaults.
Onboarding your devices
Defender only protects what it can see. Microsoft’s onboarding guidance lists three methods for Windows: a local script, Group Policy, or Intune. It recommends Intune if your organisation already uses it, and we agree.
Here is how we think about the choice.
| Method | Best suited to | Main limitation |
|---|---|---|
| Local script | A handful of devices, or a one-off machine that has missed the wider rollout | Manual, so easy to forget and hard to audit |
| Group Policy | Domain-joined estates with on-premises Active Directory | Does not reach devices that are rarely on the office network |
| Intune | Cloud-managed or hybrid fleets, including remote workers | Needs devices enrolled in Intune first |
If you are building a new fleet, enrolment and onboarding can happen together. Our guide to Windows Autopilot deployment explains how a new laptop can arrive at a member of staff already enrolled, encrypted and protected, without anyone in IT touching it. For larger rollouts, our Windows 11 deployment approach applies the same measure-then-automate thinking.
After onboarding, open the device list in the Defender portal and compare it with your inventory. Missing devices are usually ones that are switched off, unlicensed, or on an unsupported Windows edition.
The first settings to configure
The defaults are sensible, but a few areas deserve attention in the first week.
Policies live in two places
This catches many administrators out. Microsoft notes that while some policies are managed in the Defender portal, attack surface reduction (ASR) rules and controlled folder access must be configured in the Microsoft Intune admin centre. If you only ever look in the Defender portal, you may believe those protections are in place when they are not.
Use audit mode before you enforce
ASR rules block behaviours that malware commonly uses, such as launching child processes from Office documents. Some of those behaviours are also used by legitimate line-of-business software. Microsoft recommends using audit mode for ASR rules that need testing before enforcement, and for network protection in a test environment before switching to block mode.
Our approach is simple. Run the rules in audit mode on a pilot group for a couple of weeks. Review what would have been blocked. Add exclusions for genuine business tools, then move to block mode in stages. This avoids the Monday morning call from a finance team whose accounting package has stopped working.
Alerts that someone will read
An alert nobody reads is the same as no alert. Decide who reviews the queue, how often, and what happens out of hours. If you do not have the capacity in-house, this is where a managed provider earns its place, and where endpoint detection and response turns from a feature into an outcome.
How to test that protection is working
Do not rely on a green tick. Test it.
- Check device health. In the Defender portal, confirm every device shows as onboarded and reporting recently.
- Run a controlled detection test. Microsoft publishes a harmless test file for validating cloud-delivered protection, described in its guidance on configuring and validating Defender Antivirus connections. Download it on a pilot device and confirm the detection appears in the portal.
- Confirm alerts arrive. Make sure the notification mailbox received the test alert.
- Review your policies after changes. Every new device group or policy change is worth a short recheck.
This takes less than an hour and tells you more than any dashboard summary.
Deploying BitLocker alongside Defender
Defender reduces the chance of malware reaching a device. It does nothing for a laptop left on a train. Disk encryption covers that case, which is why we treat the two as one project.
Why encryption matters for Irish organisations
The Data Protection Commission’s data security guidance identifies whole-disk encryption as an essential measure for protecting personal data on portable devices, and suggests 256-bit encryption as an acceptable standard. If a laptop containing customer or employee data is lost and it is encrypted, the position is very different from one where it is not.
Creating the policy in Intune
According to Microsoft’s cloud-native endpoint tutorial, BitLocker is deployed through endpoint security policies in the Intune admin centre. You create a disk encryption policy, set the encryption level you want, and enforce silent enablement so BitLocker switches on without the user needing to do anything.
The disk encryption settings reference adds detail for silent enablement: you hide the warning about third-party encryption, and standard users can enable encryption during Microsoft Entra join in silent-enable scenarios. Test the policy on a pilot group first, on the exact hardware models you use, because older devices can behave differently.
Recovery keys come first
The recovery key is the part people forget. The same Microsoft reference explains that Intune can require BitLocker recovery information to be saved to Microsoft Entra before encryption completes. Turn that setting on. A device that encrypts without storing its key is a device you may never get back into.
The settings also include client-driven rotation of recovery passwords for Microsoft Entra-joined and hybrid-joined devices, which limits the exposure if a key has been read out to a user or support technician. The DPC’s guidance is blunt that encryption is pointless unless the decryption key is kept secure, and it says keys should meet password-complexity standards. Your helpdesk should also have a documented process for verifying who is asking for a recovery key before releasing it. Our password policy guidance and endpoint encryption deployment guide go further on both points.
Removable storage and device records
Encryption on the laptop does not cover a USB stick. The DPC’s portable storage recommendations suggest restricting copying to portable storage and keeping an asset register of organisation-issued devices and their authorised users. Keeping that register current is a governance task as much as a technical one, and a structured approach to security and compliance governance helps keep records and audit trails consistent as your estate grows.
Our perspective
We have supported Irish organisations for around 30 years, and the pattern with Defender is consistent. The software is rarely the problem. The problem is that it was switched on once, nobody owned it afterwards, and six months later nobody can say which devices are covered or who reads the alerts.
Our advice is to treat setup as the start of a routine rather than a project with an end date. Agree who reviews alerts. Check device coverage monthly. Review ASR and encryption policies when you add new hardware or software. Keep recovery keys somewhere that survives the loss of a single administrator.
We also encourage clients not to see Defender in isolation. It sits beside multi-factor authentication, backup, patching and a sensible data-protection policy. The DPC has noted that after a ransomware attack, the ability to restore from secure backups is critical to data availability and compliance, which is why our Microsoft 365 backup guide belongs on the same checklist as this one. Endpoint protection reduces the odds of an incident. Tested backups limit the damage if one still happens.
— Carl
Let us handle the setup
As a Microsoft Cloud Service Provider, we configure Defender for Business, onboard devices through Intune, build the BitLocker policy and monitor alerts as an extension of your own team. If you would rather not run this yourself, take a look at our managed support plans or our IT security and data protection services, and tell us how many devices you have. We will tell you what a sensible rollout looks like for your organisation.
Common mistakes to avoid
A few errors come up often enough to name.
Assuming the licence means protection. Defender for Business is enabled at tenant level, but devices still need onboarding, and policies still need review.
Skipping servers. Servers need a separate licence, so a firm that believes its Business Premium plan covers everything may have its most valuable machines unprotected.
Enforcing ASR rules on day one. Skipping audit mode is the quickest way to break a legitimate application and lose staff goodwill.
Encrypting without storing the key. Set the policy so that recovery information is saved to Microsoft Entra before encryption completes.
Forgetting unmanaged devices. Personal phones and old laptops that sit outside Intune are often the weakest point, so decide whether they are allowed to reach company data at all.
FAQ
Do I have to turn on Microsoft Defender for my business?
Defender for Business features are enabled at tenant level by default, but you still need to complete setup, assign licences and onboard devices before they are protected. Windows also ships with Defender Antivirus, which provides baseline protection. For a business, the managed, centrally reported version gives you visibility and policy control that the built-in tool alone does not.
How do I configure Defender for Endpoint or Defender for Business?
Open the Microsoft Defender portal and run the setup wizard, or complete the manual setup if you need more control. Then onboard devices, ideally through Intune, and review policies. ASR rules and controlled folder access are set in the Intune admin centre rather than the Defender portal.
Which Windows Defender settings matter most for a small business?
Start with device onboarding, alert notifications to a shared mailbox, and cloud-delivered protection. Then add ASR rules in audit mode and move them to block mode once you have reviewed the results. Pair these with disk encryption and multi-factor authentication.
How do I deploy BitLocker to company laptops?
Create a disk encryption policy under endpoint security in the Intune admin centre, set the encryption level, and enable silent enablement. Require recovery information to be saved to Microsoft Entra before encryption completes, and test on a pilot group first.
Sources
- Microsoft Defender service description
- Requirements for Microsoft Defender for Business
- Set up and configure Microsoft Defender for Business
- Onboard devices to Microsoft Defender for Business
- Configure security settings in Defender for Business
- Onboard Windows devices to Defender for Endpoint using Intune
- Configure and validate Defender Antivirus network connections
- Set up cloud-native Windows endpoints with Intune
- Intune endpoint security disk encryption policy settings
- DPC data security guidance note
- DPC general portable storage recommendations
- DPC regulatory activity report 2018 to 2020