Ensure 'Endpoint protection' component status is set to 'On'

Overview

The Endpoint protection component enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud.

IMPORTANT: When enabling integration between DfE and DfC, some undesirable side effects may occur.

For Server 2019 and above, if Defender is installed (the default for these server SKUs), this will trigger the deployment of the new unified agent and link to any of the extended configurations in the Defender portal.
If the new unified agent is required for server SKUs of Win 2016 or Linux and lower, additional integration needs to be switched on, and agents need to be aligned.

Rationale

Microsoft Defender for Endpoint integration brings comprehensive Endpoint Detection and Response (EDR) capabilities within Microsoft Defender for Cloud. This integration helps spot abnormalities and detect and respond to advanced attacks on endpoints monitored by Microsoft Defender for Cloud.

MDE works only with Standard Tier subscriptions.

Impact

Endpoint protection requires licensing and is included in these plans:

Defender for Servers plan 1
Defender for Servers plan 2

Default Value

By default, Endpoint protection is off.

Additional information

"Microsoft Defender for Endpoint (MDE)" was formerly known as "Windows Defender Advanced Threat Protection (WDATP)." The "WDATP" acronym is still used within Azure in several places (e.g., Azure CLI).

Remediation guidance

Remediate from Azure Portal

Open Microsoft Defender for Cloud | Environment settings
Select a subscription
Click Settings & monitoring.
Set the Status for Endpoint protection to On.
Click Continue.

Remediate from Azure CLI

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.Security/settings/WDATP?api-version=2021-06-01 -d@"input.json"'

Where input.json contains the Request body json data as mentioned below.

{
  "id": "/subscriptions//providers/Microsoft.Security/settings/WDATP",
  "kind": "DataExportSettings",
  "type": "Microsoft.Security/settings",
  "properties": {
    "enabled": true
  }
}

Service-wide remediation

Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.

Azure

Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.

Operational rollout

Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
Re-scan and track approved exceptions with an owner and expiry date.

Query logic

These are the stored checks tied to this control.

Azure subscriptions with WDATP (endpoint protection) disabled

Connectors

Microsoft Azure

Covered asset types

Connector

Expected check: eq []

{
  connectors(
    where: { dataExportSettings_SOME: { name: "WDATP", enabled: false } }
  ) {
    ...AssetFragment
  }
}