Managing third-party antivirus transition to MDE

Overview

Moving from legacy AV to Microsoft Defender for Endpoint needs a coexistence and cutover plan to avoid coverage gaps.

Discovery

1. Inventory current AV: vendor, central console, policy features (firewall, device control, web filter).
2. Map feature parity gaps—plan compensating controls (e.g., web filtering via proxy or DNS).

Coexistence phase

• Follow Microsoft and third-party limited periodic scanning or passive mode guidance; do not run two active real-time scanners without vendor approval.
• Validate policy import: exclusion lists, USB rules, custom IOCs.

Cutover

1. Push MDE onboarding and confirm active protection.
2. Remove or disable old AV agent via vendor’s clean removal tool (not Add/Remove only).
3. Reboot if required; verify single AV reporting healthy in services and Defender status.

Validation window

Monitor for 7 days: performance complaints, app blocks, and missed detection tests.

Commercial notes

Align renewal cancellation with cutover date; capture savings in QBR.