Bound the validity of Defender deployment packages before distributing them

Source facts

The Defender deployment tool requires a key generated on the portal onboarding page. Deployment packages allow a chosen expiration up to one year; Microsoft recommends keeping validity as short as possible. The portal provides a package list that can be filtered by active, expired or hidden state. Microsoft Learn.

Applicability

Use this check when preparing Microsoft’s Defender deployment tool for an approved Windows onboarding campaign. Identify who will receive the package and the scheduled deployment window before generating it.

DSE recommendation

DSE recommends choosing validity from the approved deployment schedule and recording a package owner. Distribute the package and key through controlled channels, identify replacement responsibility for delayed deployments, and remove obsolete copies from ordinary distribution locations under the organization’s retention process. Review any request for a longer window explicitly.

Verification

Before a pilot deployment, compare the package’s recorded expiry and state with the planned use time. Confirm the expected device onboarding result and retain the deployment evidence separately from the key. At campaign closure, reconcile active packages against remaining authorized work and document the disposition of superseded packages.

Official references

Microsoft Learn: Deploy Microsoft Defender endpoint security to Windows devices using the Defender deployment tool. Source reviewed September 17, 2026.