--- title: MECM/SCCM Onboarding for MDE (Windows) description: Comprehensive guide to Windows SCCM MDE onboarding. --- [Skip to content](https://knowledge.sittadel.com/sccm-windows-mde-onboarding#main-content) [![Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent copy](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png?width=55&height=55&name=Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png)](https://sittadel.com/) - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) Open main navigation Close main navigation - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) - [Get Sittadel](https://sittadel.com/start/) [Get Sittadel](https://sittadel.com/start/) Find answers to your security questions. - There are no suggestions because the search field is empty. 1. [Sittadel Knowledge Base](https://knowledge.sittadel.com/?hsLang=en) 2. [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en) 3. [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment) # MECM/SCCM Onboarding for MDE (Windows) ## Comprehensive guide to Windows SCCM MDE onboarding: retrieving the MDE onboarding package from the Defender portal and utilizing an SCCM server to deploy the Agent to connected Windows devices that are attached to a Domain Controller. ### **Gather Windows MDE SCCM Package** 1. Navigate to the [Endpoint Onboarding – Microsoft Defender](https://security.microsoft.com/securitysettings/endpoints/onboarding) portal, from this page specify the **Operating System** as **Windows 10 and 11, Connectivity Type** as **Streamlined, Deployment Method** as **Microsoft Endpoint Configuration Manger current branch and later.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-00-48-5049-PM.png?width=670&height=444&name=image-png-Aug-27-2024-03-00-48-5049-PM.png)** 2. Once the proper selections have been made, locate, and select **Download onboarding package**, a **GatewayWindowsDefenderATPOnboardingPackage.zip** file will be stored to the **Downloads** folderon the **User** account**.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-01-57-1241-PM.png?width=666&height=109&name=image-png-Aug-27-2024-03-01-57-1241-PM.png)![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-01-48-5779-PM.png?width=670&height=185&name=image-png-Aug-27-2024-03-01-48-5779-PM.png)** 3. We will need to **extract** **the contents of the package,** the **extracted .zip folder** should house a **file** named **WindowsDefenderATP.onboarding.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-02-18-5217-PM.png?width=670&height=69&name=image-png-Aug-27-2024-03-02-18-5217-PM.png)** 4. After the **extraction process** has been completed, we will want to relocate the **.onboarding** file to the **desired SCCM Server where desired Windows machines that are wishing to MDE join can have access to these resources**. ### **Deploying Windows SCCM MDE Package** 1. On the desired **SCCM Server,** we will access the **SCCM application.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-03-07-2283-PM.png?width=261&height=205&name=image-png-Aug-27-2024-03-03-07-2283-PM.png)** 2. From the **Configuration Manager console,** we will navigate to **Administration** and select **Client Settings,** we will either create custom **Client Device Settings** or go to the properties of the **Required Client Settings** and select **Endpoint Protection.** 3. For **Microsoft Defender for Endpoint Client** on **Windows Server 2012 R2** and **Windows Server 2016** settings, the default value is set as **Microsoft Monitoring Agent MMA (legacy)** which needs to be changed to **MDE Client (recommended).** Select **OK** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-04-24-2093-PM.png?width=670&height=620&name=image-png-Aug-27-2024-03-04-24-2093-PM.png)** 4. Once the **Endpoint Protection** settings have been specified, we will move navigate to **Assets and Compliance** and select **Endpoint Protection.** This will open a new window; we will want to navigate to **Microsoft Defender ATP Policies** and select **Create Microsoft Defender ATP Policy**. This should initiate a policy wizard to open. 5. Supply a **Name** and **Description** for the **Microsoft Defender for Endpoint policy** and select **Onboarding.** 6. Next you will be redirected to a page where you will need to supply the previously extracted **WindowsDefenderATP.onboarding** file, this can be achieved by selecting **Browse** and navigating through the **File Explorer** window until you get to the desired file path where the file had been transferred to. Once the file appears under **Configuration File** select **Next** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-27-2024-03-15-33-4587-PM.png?width=631&height=565&name=image-png-Aug-27-2024-03-15-33-4587-PM.png)** 7. After the **configuration file** has been uploaded, we will need to specify the file samples that will be collected and shared to the **Microsoft Defender** portal for the onboarded devices. We will want to specify that **All file types** are shared. 8. Once the **configuration file** and the **file samples** have been specified, we will progress through the **configuration summary** and complete the policy wizard. 9. After the wizard is closed, the policy should generate in the listed, we will want to **right-click** on the policy and select **Deploy** to target the **Microsoft Defender for Endpoint** policy to clients. ### Need Assistance? Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? [Inquire](https://sittadel.com/start/) about arranging a consultation to explore optimizing your Azure environment for painless management. - [UserOps](https://knowledge.sittadel.com/userops?hsLang=en#main-content) - [Access & Permissions](https://knowledge.sittadel.com/userops?hsLang=en#access-permissions) - [Account](https://knowledge.sittadel.com/userops?hsLang=en#account) - [Devices](https://knowledge.sittadel.com/userops?hsLang=en#devices) - [Document Sharing](https://knowledge.sittadel.com/userops?hsLang=en#document-sharing) - [Email](https://knowledge.sittadel.com/userops?hsLang=en#email) - [Requests](https://knowledge.sittadel.com/userops?hsLang=en#requests) - [Troubleshoot](https://knowledge.sittadel.com/userops?hsLang=en#troubleshoot) - [TechOps](https://knowledge.sittadel.com/techops?hsLang=en#main-content) - [Tenant Foundations](https://knowledge.sittadel.com/techops?hsLang=en#tenant-foundations) - [Collaboration Security](https://knowledge.sittadel.com/techops?hsLang=en#collaboration-security) - [Email Security](https://knowledge.sittadel.com/techops?hsLang=en#email-security) - [Device Security](https://knowledge.sittadel.com/techops?hsLang=en#device-security) - [Identity Security](https://knowledge.sittadel.com/techops?hsLang=en#identity-security) - [SecOps](https://knowledge.sittadel.com/secops?hsLang=en#main-content) - [Email SOC](https://knowledge.sittadel.com/secops?hsLang=en#email-soc) - [Identity SOC](https://knowledge.sittadel.com/secops?hsLang=en#identity-soc) - [Tenant SOC](https://knowledge.sittadel.com/secops?hsLang=en#tenant-soc) - [Device SOC](https://knowledge.sittadel.com/secops?hsLang=en#device-soc) - [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en) - [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en#main-content) - [Overview](https://knowledge.sittadel.com/deploy-mde?hsLang=en#overview) - [Intune Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#intune-deployment) - [Hands-On Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#hands-on-deployment) - [Azure Arc Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#azure-arc-deployment) - [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment) - [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment) - [GPO Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#gpo-deployment) - [Deploy Services](https://knowledge.sittadel.com/deploy-services?hsLang=en#main-content) - [Cloud Enclave](https://knowledge.sittadel.com/deploy-services?hsLang=en#cloud-enclave) - [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en#main-content) - [Entra ID](https://knowledge.sittadel.com/azure-portals?hsLang=en#entra-id) - [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune) - [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender) - [Purview](https://knowledge.sittadel.com/azure-portals?hsLang=en#purview) - [SharePoint Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#sharepoint-admin-center) - [Teams Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#teams-admin-center) - [Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#admin-center) - [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center) [![](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel_LogoH_Color_BlackText.png?width=186&height=55&name=Sittadel_LogoH_Color_BlackText.png)](https://Sittadel.com) Security for Humans. Copyright © 2026, Sittadel