Set Up Microsoft Defender for Business in MSP Environments As cyber threats evolve quickly, MSPs need tools that are powerful, scalable, and built for the complexity of multi-tenant management. Microsoft Defender for Business delivers exactly that, and when it's configured correctly, it becomes an effective layer of protection in your security stack. We'll show you how to set it up in MSP environments. Before we begin, be sure to subscribe to NinjaOne's IT video hub, and our YouTube channel for more tech content like this. What Is Microsoft Defender for Business? Microsoft Defender for Business is an enterprise-grade security platform scaled for small and mid-sized businesses. Included with Microsoft 365 Business Premium or available as a standalone subscription, it combines antivirus, endpoint detection and response or EDR, firewall management, and automated investigation and remediation, or AIR, into a unified solution. How to Set Up Microsoft Defender for Business in Microsoft 365 Getting started begins in the Microsoft 365 Admin Center. From here, navigate to Setup, select Microsoft Defender for Business, and choose Get started to configure your baseline security policies. From the Microsoft Defender Portal at security.microsoft.com, head to Settings, Endpoints, and then Onboarding. Select your Windows version, download the onboarding package and assign devices to the appropriate security groups. How to Onboard Devices in Microsoft Defender for Business Once setup is complete, you have several options for onboarding devices. For environments not managed by Intune or Group Policy, use PowerShell. Download the local script package from the Defender Portal, deploy WindowsDefenderATPOnboardingScript.cmd via your RMM, and verify the onboarding state with a quick command: Get-MpComputerStatus. An OnboardingState value of 1 means the device is onboarded, while 2 indicates onboarding is in progress. If you prefer a domain-based approach, use Group Policy. Extract your onboarding package to a network share, open the Group Policy Management Console and configure the startup script under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Onboarding. For advanced or legacy environments, the command line offers direct control. From an elevated CMD prompt, enable the core antivirus service with this command: sc config WinDefend start=auto, net start WinDefend. For Defender for Business's advanced threat telemetry and endpoint detection and response (EDR), repeat the same pattern with the Sense service: sc config Sense start=auto, net start Sense. A quick sc query on either service lets you verify they're running as expected. Monitoring and Reporting with Microsoft Defender for Business With devices onboarded, the Microsoft Defender Portal becomes your command center. Monitor threat detections in real time, review device risk levels, and track automated remediation actions from one screen. For deeper analysis, Advanced Hunting with KQL lets you query antivirus and remediation events across your environment. For enterprise-level visibility, log forwarding to Microsoft Sentinel or your third-party SIEM keeps your security team informed. Microsoft Defender for Business gives MSPs a powerful, scalable foundation for protecting their clients. You simply need to set it up right, configure it thoughtfully, and integrate it with the tools you already trust. For more information, check out our official blog post on setting up Microsoft Defender for Business in MSP environments, linked in the description below.