Moving from Defender managed through ConfigMgr to MDE but keeping the ConfigMgr client installed

Question

Moving from Defender managed through ConfigMgr to MDE but keeping the ConfigMgr client installed

MarcVanderhaegen 306

Hello,

We currently have our servers (2016/2019/2022/2025) managed through ConfigMgr.

We would like move from Defender manager through ConfigMgr to Defender managed through MDE but at the same time we would like to keep the ConfigMgr client installed (needed for software deployment, inventory etc...).

Is this possible ?

At the moment, what I have done is :

Under Assets and Compliance - Endpoint Protection - Microsoft Defender for Endpoint Policies, the machine we want to migrate are excluded from the collection on which the policy is deployed.

Under Assets and Compliance - Endpoint Protection - Antimalware Policies, the machines are excluded from the policies.

In the MDE portal under System - Settings - Enforcement scope, Enable Configuration Management is enabled for Windows Servers with the tag MDE-Management.
In the MDE portal, the machines we want to migrate have the MDE-Management tag.

Despite all of that the machine do not 'switch' to MDE, the device management status keeps saying 'Managed by ConfigMgr'.

But when I check in the ConfigMgr console, for these servers in the Endpoint Protection Deployment Information, the deployment state says 'Unmanaged'.

If I run the script MDEClientAnalyzer, I see that the Enrollment status says 'Device is managed by SCCM Agent (4)'

I have already restarted the servers, all the changes were made more than 24 hours ago.
Have I forgot something to change for this to work ?

Thanks for your help.

Marc

0 comments

1 answer

Your answer

Answer 1

Yep - this is supported. You can keep the Configuration Manager client installed for software deployment, inventory, compliance, etc., while moving Microsoft Defender Antivirus/Endpoint Protection configuration to Microsoft Defender for Endpoint. You are not removing or uninstalling the ConfigMgr client. You are moving the authority for Defender configuration from ConfigMgr to MDE.

The behavior you are seeing is consistent with ConfigMgr still being detected as the management authority. Excluding the servers from the ConfigMgr Endpoint Protection collections and seeing "Unmanaged" in Endpoint Protection Deployment Information does not necessarily cause the MDE configuration-management switch to occur. The MDE setting is effectively a handoff mechanism, and Windows needs to meet the prerequisites for MDE security settings management.

For Windows Server, first verify that the servers are actually onboarded to MDE and that the MDE sensor is healthy. In the Defender portal, check the device's MDE onboarding status and make sure the device is represented as an onboarded Windows Server rather than merely being visible through another management/inventory mechanism. Also verify that the MDE-Management tag is actually present on the device that MDE is evaluating. Your enforcement scope should include Windows Servers and the scope/tag combination must include those machines.

The important part in your case is the existing ConfigMgr Endpoint Protection policy state. I would not rely solely on the collection exclusions. Check the local server for the ConfigMgr Defender policy that remains in effect. Run Get-MpPreference and inspect the Defender configuration, and also check the relevant ConfigMgr Endpoint Protection policy information under C:\Windows\CCM\Logs, particularly EndpointProtectionAgent.log, EndpointProtectionReporting.log, and PolicyAgent.log. If ConfigMgr is still applying an Endpoint Protection policy, the MDE configuration-management transition can be prevented even though the console reports the deployment as "Unmanaged."

Regarding the MDE portal saying the device is "Managed by ConfigMgr" and ConfigMgr showing the device as "Unmanaged" - those two states are not necessarily contradictory. "Unmanaged" in the ConfigMgr Endpoint Protection deployment information means ConfigMgr is not currently reporting an active Endpoint Protection deployment for that device. The MDE "Managed by ConfigMgr" designation is about the security configuration-management authority that MDE believes currently controls the Defender settings.

I would also verify that the ConfigMgr client version and the server OS are supported for MDE security settings management. Since you have Server 2016 through Server 2025, do this on one test server first rather than changing the entire server population. In particular, make sure the MDE agent/platform and Windows Defender Antivirus components are current, because an old Defender platform or unsupported MDE component can prevent the management-authority transition.

One other thing to check is whether you have enabled the relevant MDE security-settings-management functionality for servers in the Defender portal and licensed the servers appropriately. The MDE "Enforcement scope" setting you described is the correct area, but enabling it does not override an existing management authority if the device does not satisfy the prerequisites.

I would troubleshoot one server rather than making more collection changes. On that server, confirm that MDE is onboarded and healthy, confirm the MDE-Management tag is visible in the Defender portal, confirm the server falls within the Enforcement scope, verify that no ConfigMgr Endpoint Protection policy is still being received locally, and then examine the MDE/Defender management state again. The ConfigMgr client should remain installed throughout this process.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

MarcVanderhaegen 306 Reputation points

2026-09-03T12:59:29.4233333+00:00

Hello Marcin,

Thanks for your answer.

I am only doing the changes on a few servers dedicated to test the migration. At the moment I am focussing on a 2025 Server.

The server is well onboarded in the Defender portal and the tag is well applied.

If I check the applied policies, the endpoint protection is configured on 'not managed'.

But still, on the machine, in the registry, the default client antimalware policy seems to be applied.

This policy is applied to all clients by default and there is no way to disable that.

Marc
Marcin Policht 105.8K Reputation points MVP Volunteer Moderator

2026-09-03T22:28:51.4933333+00:00

AFAIK, the CCM\EPAgent registry entry showing Default Client Antimalware Policy is most likely the last ConfigMgr policy that was applied - in other words, its presence alone does not necessarily imply that ConfigMgr is still actively managing Defender.

I'd not try to disable or remove the Default Client Antimalware Policy or delete the registry keys. Let the new Client Settings take effect, trigger a Machine Policy Retrieval, and verify in EndpointProtectionAgent.log that ConfigMgr is no longer applying/enforcing Endpoint Protection. Once ConfigMgr has relinquished Endpoint Protection management, MDE Security Settings Management should take over - as long as the Server 2025 machine is onboarded, tagged MDE-Management, within the Enforcement scope, and otherwise meets the MDE Security Settings Management prerequisites.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
MarcVanderhaegen 306 Reputation points

2026-09-04T04:04:38.08+00:00

Hello,
I agree with you, CCM\EPAgent shows the last policies applied on the machine.
But when I compare with a standard server (not being used for the migration), I can see the name of our production policy for defender.
Like this :

So on the test server, it means that the machine is well removed from all the custom endpoint policies but still, this default client antimalware policy is still applied.
If I check the EndpointProtectionAgent.log before trying the migration, I can see that the policies are applied :

If I check now on the same machine after trying to migrate :

It is not saying that the machine tries to apply any policy. That is confusing.
The only line that has me worried is 'Check and enforce EP Deployment state.'. Here also it is not clear what the machine does. what deployment state ? It doesn't say what the state should be.

We have a few servers in workgroup and another domain were the sccm agent is not installed and onboarding them in MDE and adding the tag MDE-Management is working just fine. So I know the whole thing on the MDE side is correctly set up.

It is almost 40 hours now that I have tried migrating the test servers so a delay in MDE can't be the cause anymore. Normally it should take less than 16 hours (according to what we have seen in the past)

I keep looking.