Microsoft Defender for Business: Setup, Fix & Config Guide

The starting point for every Microsoft Defender for Business fix is confirming your subscription is actually active and your licenses are assigned. Head to https://admin.microsoft.com and navigate to Billing > Your products. You should see either "Microsoft Defender for Business" as a standalone product, or "Microsoft 365 Business Premium" which bundles Defender for Business in.

If you're on a standalone plan, double-check that your organization qualifies, Defender for Business standalone is available to organizations with up to 300 users, including those already on Microsoft 365 Business Basic, Microsoft 365 Business Standard, or Office 365 E1. If you have more than 300 users, you need to look at Microsoft Defender for Endpoint Plan 1 or Plan 2 instead.

Now go to Users > Active users and select a user who needs access. Under the Licenses and apps tab, find the Defender for Business or Microsoft 365 Business Premium license and make sure it's assigned. Do this for every user who needs coverage, Defender for Business licenses are per-user, not per-device.

Once licenses are assigned, head back to security.microsoft.com. If the portal loads and shows the Defender for Business setup wizard, you're good. The wizard will walk you through onboarding your first devices with a simplified, step-by-step interface that doesn't require deep security knowledge to complete. If you see the full Microsoft Defender for Endpoint enterprise experience instead of the simplified Defender for Business interface, your tenant may have been provisioned under a different plan, check your billing page again carefully.

What success looks like: The Defender portal loads at security.microsoft.com with the simplified Defender for Business navigation, you'll see items like "Devices," "Vulnerabilities," "Incidents & alerts," and "Reports" in the left sidebar. No missing tiles, no "access denied" banners.

This is the step that trips up most IT admins who aren't security specialists. Even if you're a Global Admin on the Microsoft 365 side, the Microsoft Defender for Business portal operates on Microsoft Entra ID (formerly Azure Active Directory) role-based access control. You need specific security roles assigned in Entra ID, not just a Microsoft 365 admin role.

Go to https://entra.microsoft.com and sign in. Navigate to Identity > Roles & admins > Roles & admins. Search for Security Administrator in the role list. Click on it, then click Add assignments and add the accounts that need to configure Defender for Business policies and manage devices.

If someone only needs to view security data but not make changes, say, a manager reviewing reports, assign them the Security Reader role instead. This is the least-privilege approach and it's the right one.

Here's a PowerShell shortcut if you manage multiple accounts. Open PowerShell as Administrator and run:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

# Find the Security Administrator role ID
$role = Get-MgDirectoryRole | Where-Object {$_.DisplayName -eq "Security Administrator"}

# Add a user to the role (replace with actual UPN)
New-MgDirectoryRoleMember -DirectoryRoleId $role.Id `
  -BodyParameter @{"@odata.id" = "https://graph.microsoft.com/v1.0/users/user@yourdomain.com"}

After assigning the role, sign out of the Defender portal completely and sign back in. Role changes in Entra ID typically propagate within a few minutes, but can take up to 15 minutes in larger tenants.

What success looks like: You can now navigate to Settings > Endpoints inside the Defender portal and see all configuration options enabled, not grayed out. The "Onboard devices" option under Device management should be clickable.

Onboarding failures in Microsoft Defender for Business are often caused by a Windows device simply not meeting the prerequisites. The Defender portal won't always tell you this clearly, it'll just fail silently or show a device as "onboarded" when it's actually not communicating properly.

First, the supported operating systems. Your Windows devices must be running one of:

• Windows 10 or 11 Business
• Windows 10 or 11 Professional
• Windows 10 or 11 Enterprise

Windows Home editions are not supported, full stop. If you have employees using personal Windows Home machines, they cannot be onboarded to Defender for Business.

Second, and this is the one people miss, KB5006738 must be installed on every Windows device. This is a Windows update that enables the necessary security components Defender for Business relies on. Check whether it's installed by running this in PowerShell:

Get-HotFix -Id KB5006738

If nothing comes back, the update is missing. Go to Settings > Windows Update > Check for updates and run a full update cycle. You can also download KB5006738 directly from the Microsoft Update Catalog if Windows Update is restricted on your network.

For Mac devices, Defender for Business supports the three most-current macOS releases. If a Mac is running a version older than that, onboarding will fail. Check Apple menu > About This Mac and update if needed before attempting onboarding.

What success looks like: After installing KB5006738 and running the onboarding script (downloaded from Settings > Endpoints > Device management > Onboarding in the Defender portal), the device appears in the Devices list within the portal within 5–15 minutes with a status of "Active."

If you've cleared the subscription, permission, and device prerequisite hurdles, your next move is getting through the Microsoft Defender for Business initial setup wizard. Microsoft built this specifically so that small business IT admins, people who aren't running a 24/7 Security Operations Center, can get meaningful protection configured in under an hour.

Open security.microsoft.com and if this is a fresh Defender for Business tenant, you should see a setup wizard prompt on the home screen. If the wizard doesn't appear automatically, go to Settings > Endpoints > Setup. The wizard walks you through four main stages:

1. Assign user permissions, Maps back to the Entra ID roles from Step 2.
2. Set up email notifications, Configure who gets alerted when incidents occur. I strongly recommend adding at least one non-admin email here as a backup.
3. Onboard devices, Download the onboarding package for your platform (Windows, Mac, iOS, Android) and deploy it.
4. Set up security policies, This is where Defender for Business shines versus the enterprise product. Default security policies are pre-configured and cover next-generation protection, firewall rules, and attack surface reduction right out of the box. For most SMBs, the defaults are genuinely good.

For Windows devices specifically, Defender for Business includes a simplified firewall and antivirus configuration interface that doesn't require Group Policy expertise. The policies show up under Device configuration in the portal and can be applied per device group. If you use Microsoft Intune already, Defender for Business integrates with your existing Intune policies, you don't need to rebuild anything.

What success looks like: Under Device configuration, you see your Windows devices listed under the default policy group with a green "Succeeded" status next to the policy assignment. No red "Error" or yellow "Pending" states hanging around.

A lot of Microsoft Defender for Business guides stop at Windows and Mac. But your business almost certainly has iPhones and Android phones accessing company email, Teams, or SharePoint. Those devices are endpoints too, and they need protection.

For mobile devices, iOS/iPadOS and Android, Defender for Business supports two paths: Mobile Threat Defense capabilities built directly into Defender, or Microsoft Intune as the management layer. If you're already using Intune (which is included in Microsoft 365 Business Premium), the Intune path is simpler and gives you more granular control.

To enroll iOS devices via Intune, go to https://intune.microsoft.com, navigate to Devices > iOS/iPadOS > iOS enrollment, and set up an Apple MDM Push Certificate if you haven't already. This requires an Apple ID, use a company Apple ID, not a personal one, so you don't lose access if someone leaves. Then deploy the Microsoft Defender app from the App Store via an Intune app policy.

For Android devices, go to Devices > Android > Android enrollment in Intune. Android Enterprise is the recommended enrollment method. Push the Microsoft Defender app via a managed Google Play assignment.

If Intune isn't in your stack and you're on standalone Defender for Business, use the Mobile Threat Defense (MTD) connector. In the Defender portal, go to Settings > Endpoints > Advanced features and look for the Microsoft Intune connection toggle. Even without full Intune management, you can configure mobile threat defense to flag risky devices. The exact mobile threat defense setup documentation is linked from the Defender portal's onboarding section.

What success looks like: Mobile devices appear in the Devices inventory in the Defender portal with platform icons showing iOS or Android. You should see threat detection events flowing in from mobile devices alongside your Windows and Mac endpoints, everything in one place.