NOTE: A proper license is required for the user accessing the device, for enrollment in MDE (Microsoft Defender for Endpoint) to be processed successfully. We do have a finite number of licenses to go around.
in the Intune Admin Center, go to Endpoint Security > Endpoint detection and response.
Two policies exist. The Intune named policy is for Intune-managed devices. Do not use the Co-Management policy. That policy is for on-premises devices managed by Configuration Manager.
Using "EDR-Pilot-Intune-TJW" (name subject to change) as an example:
To include your device, simply include it in your campus device group. It will take some time for the profile to be applied to endpoint.
Successfully onboarded devices will show up in the Defender portal (security.microsoft.com) as onboarded.
MDE will monitor activity on the device and make recommendations / remediation steps. This should not be done hastily. Evaluate recommendations, draw up a plan for remediation, test on a small group of devices for potential impact.