# Bound the validity of Defender deployment packages before distributing them

> How should a Windows Defender deployment package's lifetime match the planned onboarding campaign?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-126-bound-the-validity-of-defender-deployment-packages-before-distributing-them/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:54+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How should a Windows Defender deployment package's lifetime match the planned onboarding campaign?

## Potentially affected

Use this check when preparing Microsoft's Defender deployment tool for an approved Windows onboarding campaign. Identify who will receive the package and the scheduled deployment window before generating it.

## DSE recommendation

DSE recommends choosing validity from the approved deployment schedule and recording a package owner.

## Article

## Source facts

The Defender deployment tool requires a key generated on the portal onboarding page. Deployment packages allow a chosen expiration up to one year; Microsoft recommends keeping validity as short as possible. The portal provides a package list that can be filtered by active, expired or hidden state. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/defender-deployment-tool-windows).

## Applicability

Use this check when preparing Microsoft’s Defender deployment tool for an approved Windows onboarding campaign. Identify who will receive the package and the scheduled deployment window before generating it.

## DSE recommendation

DSE recommends choosing validity from the approved deployment schedule and recording a package owner. Distribute the package and key through controlled channels, identify replacement responsibility for delayed deployments, and remove obsolete copies from ordinary distribution locations under the organization’s retention process. Review any request for a longer window explicitly.

## Verification

Before a pilot deployment, compare the package’s recorded expiry and state with the planned use time. Confirm the expected device onboarding result and retain the deployment evidence separately from the key. At campaign closure, reconcile active packages against remaining authorized work and document the disposition of superseded packages.

## Official references

[Microsoft Learn: Deploy Microsoft Defender endpoint security to Windows devices using the Defender deployment tool](https://learn.microsoft.com/en-us/defender-endpoint/defender-deployment-tool-windows). Source reviewed September 17, 2026.

## Primary reference

- Name: Deploy Microsoft Defender endpoint security to Windows devices using the Defender deployment tool - Microsoft Defender for Endpoint | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-endpoint/defender-deployment-tool-windows
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Bound the validity of Defender deployment packages before distributing them,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-126-bound-the-validity-of-defender-deployment-packages-before-distributing-them/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.