Defender for Endpoint is bought far more often than it is properly onboarded. The agent is installed, the Defender XDR portal shows green ticks, and the project is closed — six months later, an assessment finds half the platform unconfigured. This field guide is the realistic onboarding path through Microsoft Intune in 2026: licensing, the service connector, Windows and macOS, EDR in block mode, ASR, the compliance signal back into Conditional Access, validation, and the operational model after deployment.

Conditional Access can ask for a compliant device. Microsoft Intune defines what compliant actually means. This guide gives you an interactive builder, a ten-policy baseline, platform-specific recommendations for Windows, macOS, iOS/iPadOS and Android, a safe rollout sequence, and the operational advice I use when deploying device compliance in production. No data is sent anywhere. Everything runs in the browser.