Microsoft Secure Boot certificates from 2011 begin expiring in June 2026. Practical field guide for inventory, deployment of the 2023 family, and validation.

Defender for Endpoint is bought far more often than it is properly onboarded. The agent is installed, the Defender XDR portal shows green ticks, and the project is closed — six months later, an assessment finds half the platform unconfigured. This field guide is the realistic onboarding path through Microsoft Intune in 2026: licensing, the service connector, Windows and macOS, EDR in block mode, ASR, the compliance signal back into Conditional Access, validation, and the operational model after deployment.

A configured device is not a hardened device. This part layers Microsoft's pre-built security baselines on top of your configuration profiles, connects Defender for Business, and starts Attack Surface Reduction in Audit mode.