I often encounter customers who own Microsoft Defender for Endpoint but have never enabled it.
Sometimes they purchased a licensing package to gain access to other capabilities, and Defender for Endpoint came along with it. Often, they already have a third-party antivirus or EDR solution they prefer, so enabling another service seems unnecessary or potentially conflicting.
What gets overlooked is how much Defender for Endpoint can provide while your existing antivirus remains in place.
You can keep your preferred antivirus and still take advantage of endpoint telemetry, investigation tools, software inventory, vulnerability assessments, device discovery, and integrations with other Microsoft services. If you already own the licensing, it is worth taking the time to understand what you are leaving unused.
What passive mode actually gives you
Defender for Endpoint provides endpoint detection and response, or EDR, alongside Microsoft Defender Antivirus. When you use a third-party antivirus, the Microsoft antivirus component can run in passive mode while Defender for Endpoint continues collecting telemetry and providing investigation and response capabilities.
Passive mode does not mean the entire service is sitting idle.
Defender for Endpoint supports Windows, macOS, Linux, Android, and iOS, although the available capabilities differ by platform. Windows is particularly straightforward because the sensor is built into supported modern versions of the Windows operating system. Onboarding can be distributed through Intune, Configuration Manager, or Group Policy.
Defender for Endpoint can be rolled out to hundreds of thousands of devices over a very short period of time with very little risk or delay, especially when targeted at Windows devices.
A detailed record of activity
One of the most powerful capabilities is the amount of information collected from onboarded devices.
Who signed in? What processes ran? What network connections were made? What files were created or modified? What software was installed?
That information builds a centralized record of security-relevant activity, with a timeline you can review for an individual device and advanced hunting queries you can run across the environment.
It also gives you more than a collection of logs. Devices, files, IP addresses, and software have associated pages that help you follow an investigation.
You can look at an IP address and ask, “Where else has this address been seen in my environment?” You can examine a suspicious file and ask, “How many other computers have seen this file?”
That ability to move from one finding to related activity across the organization is incredibly useful. You do not have to start with a confirmed malware alert to find value in the data.
You get 180 days of Defender data visible through portal experiences, with 30 days available through native advanced hunting queries. That will increase to 90 days after Ignite in late November. Longer hunting retention is available through Microsoft Sentinel, with the associated configuration and costs.
Device Discovery
Defender for Endpoint also uses onboarded devices to discover other equipment on the corporate network.
That could include unmanaged computers, printers, network equipment, IP phones, or other connected devices. Discovery combines passive observation with lightweight active probing, depending on the configured discovery mode.
The resulting inventory can tell you what was discovered, which onboarded device saw it, when it was last seen, and identifying details such as its IP address, device name, or operating system when those can be determined.
Imagine someone connects an unauthorized device over the weekend. Even after it disconnects, the discovery record can give your security team something to investigate.
Visibility depends on network segmentation and the signals available, but this is a powerful way to identify equipment that never went through your normal onboarding process.
Software inventory, vulnerabilities, and hardening
The same endpoint visibility also supports software inventory and vulnerability management.
You can see discovered software, its version distribution, and the devices where it is installed. Defender compares that information against known vulnerabilities and helps prioritize remediation.
You can see that a vulnerability exists, you can identify which devices are affected and where to focus your patching effort.
This assessment is continuous. You do not have to wait for the next scheduled network vulnerability scan to learn that an onboarded endpoint has vulnerable software.
You also get security configuration recommendations. Defender can identify settings that leave a device less secure, explain the risk, and describe how to address it.
That combination gives you visibility into both the software that needs updating and the configurations that need hardening.
Remote investigation and response
There are also useful remote tools.
You can collect an investigation package, initiate a live response session, retrieve files for investigation, isolate a device, or remotely start an antivirus scan. Many of these capabilities remain available in passive mode.
Live response gives an authorized administrator a remote command-line investigation session. The investigation package collects information about the system’s current state, including items such as running processes, network connections, and startup configuration.
Because this is a cloud-connected service, the device does not have to be inside your office or connected to your domain network. With the required service connectivity, your security team can investigate a laptop while its user is working remotely or traveling.
Even if you prefer your existing antivirus, you can also manually run Microsoft antivirus scans, creating another scanning option available during an investigation. It gives your team another source of evidence when assessing an affected system.
Block Mode
There is an additional capability called EDR in block mode.
Think of your preferred antivirus as the primary guard at the front door. Microsoft provides a backup guard who is authorized to step in when EDR detects malicious activity that made it past the first one.
Your third-party antivirus remains primary, but Defender can remediate malicious artifacts identified through its EDR capabilities.
It also does not enable every protection available when Microsoft Defender Antivirus is active. But it provides another layer of protection while allowing you to retain your existing antivirus.
What could this replace?
If you are looking to reduce costs and consolidate tools, this is where the conversation becomes particularly interesting.
Start with vulnerability management. Defender’s continuous software and configuration assessments can replace the need to run a separate vulnerability scanner against those systems. Depending on your requirements, that can eliminate both a software purchase and the operational work of scheduling scans, managing scanner infrastructure, and reviewing separate reports. You still need to account for assets and assessment requirements outside Defender’s coverage.
Next, consider cloud application visibility. Defender for Cloud Apps is Microsoft’s CASB, and its integration with Defender for Endpoint provides insight into cloud applications employees are accessing from their devices. With the appropriate licensing and configuration, the combined capabilities can replace a separate CASB used for application discovery and governance.
Endpoint network protection and web content filtering can also replace some functions of a separately installed web filtering agent. If your requirement is to identify malicious destinations, block selected applications, or restrict categories of websites, evaluate what the Microsoft capabilities already provide.
For broader proxy-style requirements, Microsoft Entra Internet Access, part of Global Secure Access, provides a cloud-delivered secure web gateway. It has separate licensing requirements and can complement Defender for Cloud Apps and Defender for Endpoint when you need traffic forwarding and additional access controls.
There are also endpoint controls such as App Control for Business, device control, and attack surface reduction rules. These are separate controls with their own deployment requirements, rather than features of a web proxy. But together with Intune policy management and Defender reporting, they can address requirements that otherwise lead an organization to purchase additional endpoint tools.
Finally, Defender for Endpoint can replace a third-party EDR, and Microsoft Defender Antivirus can replace a third-party antivirus.
You do not have to replace everything at once. You can start by collecting data, validate the overlapping capabilities, and retire other products as you become comfortable. Or you can move more quickly if consolidation is already a business priority.
The important step is to evaluate what you already own before renewing another overlapping service.
A gradual migration path
If you decide to move away from your third-party antivirus, passive mode gives you a practical starting point. It also allows Microsoft Defender Antivirus to serve as a backup to your existing protection.
Microsoft Defender Antivirus automatically enters passive mode when Windows recognizes another registered antivirus providing primary protection.
If that antivirus is removed, expires, or stops providing real-time protection, Microsoft Defender Antivirus can automatically become the primary antivirus. That includes situations where tampering or degradation causes the other product to stop reporting active protection.
That same behavior supports a straightforward migration. Onboard your devices in passive mode first, let Microsoft Defender Antivirus run passively alongside your existing product, configure your policies, and validate the environment. Then systematically remove the third-party antivirus and verify that Microsoft Defender Antivirus becomes active.
I have seen organizations migrate hundreds of thousands of systems through this approach in a matter of weeks. You can establish visibility and prepare the replacement before removing the existing protection, then move at whatever pace makes sense for your organization.
If you decide to make Microsoft your primary antivirus
Microsoft Defender Antivirus is a modern antivirus solution that does much more than compare files against a list of known malware signatures.
It combines real-time file protection, behavioral monitoring, heuristics, machine learning, and cloud-delivered intelligence. It evaluates both the characteristics of a file and what software is doing, helping identify suspicious activity even when the exact file has not been seen before.
Protection also extends beyond files. With network protection enabled, Defender can block connections to malicious destinations from applications and background processes, not just activity inside a web browser. Web content filtering adds category-based restrictions for websites such as gambling or adult content, while potentially unwanted application protection can block software such as adware.
You can add your own indicators and exceptions, but you do not have to build an extensive list of known malicious destinations yourself.
There is also cloud-based file analysis and detonation. When local analysis cannot confidently determine whether a file is safe, Defender can query Microsoft’s cloud protection service and, depending on your sample-submission settings, submit the file for deeper analysis. Think of the bomb squad evaluating a suspicious package: the objective is to understand what it does before allowing it to cause harm.
With block at first sight configured, a suspicious file can be held while that evaluation takes place. The resulting intelligence helps protect other devices against the same threat. Organizations control sample submission, including whether to automatically submit samples considered unlikely to contain personal information or allow broader sample submission.
The broader Defender environment adds automatic attack disruption. Endpoint signals, combined with other Defender signals, can trigger containment actions such as isolating compromised devices or disabling compromised accounts when the applicable requirements are met. This is a Defender XDR capability rather than simply an antivirus setting, and it can also operate with Defender Antivirus in passive mode.
These protections also connect to the other Microsoft services you use. Defender for Cloud Apps uses endpoint signals to discover cloud application usage. With the appropriate active-antivirus configuration, network protection provides endpoint enforcement to block access to unsanctioned applications.
Purview Endpoint DLP uses the endpoint integration to monitor and control sensitive data activity, including when the antivirus is passive. The newer Defender for Identity sensor also uses the integrated sensor approach on compatible identity servers, including domain controllers, with its own activation requirements.
There is now a custom data collection capability as well, allowing organizations to expand collection beyond the default endpoint telemetry for supported scenarios. That can use the existing sensor to collect additional information for Microsoft Sentinel, where ingestion charges apply.
Do not bring every old exception with you
Organizations tend to accumulate years of antivirus exclusions, allowed files, trusted folders, and custom network exceptions. One of the mistakes I see during a migration is trying to bring that entire collection into Defender.
Start fresh. Do not migrate the old exclusion list.
Begin your pilot with Microsoft’s recommended configuration and no additional custom antivirus exclusions. Test your applications and workloads, then add narrowly scoped exclusions only where that evaluation identifies a genuine requirement.
Defender combines continuous real-time protection with lightweight quick scans, and Microsoft includes built-in exclusions and automatic exclusions for supported Windows Server roles. This largely eliminates the need for any custom networker file exclusions that historically have been used to prevent antivirus products from interfering with system operations or performance.
I have worked with extremely large enterprises that run Defender Antivirus with no custom antivirus exclusions, and they do just fine.
Let go of the attachment to that hoarded exclusion list. Reevaluate accumulated allow and deny indicators too, while preserving required firewall controls. Carry forward demonstrated requirements, rather than years of assumptions.
Rethinking scheduled scans
Scanning is another area where older operating habits can follow a migration.
Microsoft Defender Antivirus provides continuous real-time protection. Microsoft recommends combining that with cloud-delivered protection and scheduled quick scans.
A quick scan focuses on locations and activity associated with malware persistence. It is lighter than scanning every file on every disk.
For user devices, schedule weekly scans when the computers are likely to be powered on. Midday can be more practical than an overnight schedule for laptops that employees shut down. For servers, consider the workload and maintenance schedule.
Full scans remain available, but they are more resource-intensive and can take hours or longer. They are useful for specific requirements or investigations, though you may consider scheduling these full scans monthly or quarterly.
Microsoft Defender Offline scans provide another option. They restart the computer and scan outside the normal Windows environment, which is useful when investigating persistent malware.
Where you manage the settings
Another adjustment is understanding where antivirus policy is managed.
You might be accustomed to configuring your antivirus and reviewing its alerts in one dedicated product console. In Microsoft’s environment, policy management often comes through Intune, Microsoft Configuration Manager, or Group Policy on Windows, and management tools such as Intune or Jamf on macOS.
The Defender portal is where your security team investigates alerts, reviews device activity, and performs response actions.
There is also increasing integration between these experiences. With the required Intune connection and Defender for Endpoint security settings management configured, you can create and manage supported endpoint security policies directly in the Defender portal, including for supported devices that are not enrolled in Intune.
Protecting the protection
Once you have the intended policies in place, you also want to prevent unauthorized changes.
Tamper protection helps protect important Defender settings against changes that would weaken protection. Attempts to change protected settings can be blocked and surfaced for investigation. This can include changes attempted through local tools, the registry, or Group Policy.
Start with what you already own
My recommendation is simple: if Defender for Endpoint is not enabled today, find out whether your organization already licenses it. Generally, that means E5 or E7 licensing but may require additional add-ons.
Confirm that the licensing covers the capabilities you want. Servers require separate coverage from Defender for Servers. Then pilot it alongside your existing product in passive mode, validate the configuration, and look at the information it provides. If you decide later to use Defender Antivirus, it’s quite easy to migrate to active mode.
You may decide to consolidate and save money on overlapping services. You may keep your current antivirus and use Defender for the additional visibility and investigation capabilities.