← All Minis/Defender Launchpad/Live demo

Defender Launchpad — agentic rollout planner

Describe a deployment goal in plain English. The planner agent decomposes it across Microsoft Entra, Intune, and Defender for Endpoint, sequences the work into phases for each platform, and writes you a complete rollout runbook.

⚡ Illustrative agent No data leaves the page
Background

🚀 Why this is hard: one goal, many products

On paper, "roll out Defender for Endpoint to all Windows and iOS devices" is a single sentence. In practice it spans three Microsoft products and two very different operating systems, and the steps have to happen in the right order or the whole thing stalls.

Windows endpoints onboard through an Intune EDR policy; iOS needs the Defender app plus a VPN profile to light up web and network protection. Both then feed a device-risk signal into Intune compliance, which a Conditional Access policy in Microsoft Entra ID uses to gate access. Miss a dependency — connect Intune to Defender before onboarding, get risk signals flowing before you enforce — and devices silently fail to report or users get locked out.

Defender Launchpad shows what an agent does with that complexity: it reads the goal, decomposes the work across the three products, sequences it into phases, splits the Windows and iOS build paths, and produces the deliverable teams actually want — a complete rollout runbook. Try it below: the board assembles the plan, then the agent writes the runbook.

What the agent produces

🗺️
A cross-product planTasks mapped to Entra, Intune & Defender, each tagged by platform and dependency.
📅
A phased timelinePrepare → Pilot → Ring 1 → Broad → Operate, so risk is contained and policies are tuned before enforcement.
🧭
Two build tracksSeparate, concrete step-by-step paths for Windows and for iOS.
📄
A finished runbookExec summary, prerequisites, validation tests, rollback, and a RACI — copy & adapt.
Where it shines

🎯 Use cases

Anywhere a one-line ask hides a multi-product, multi-team deployment:

🛡️
Security rolloutsPlan an MDE, attack-surface-reduction, or Defender for Cloud Apps launch across a mixed device fleet.
🏛️
Regulated & federalProduce a documented, phased rollout with validation and rollback — the artifacts auditors and ATOs expect.
📋
Runbook generationTurn a vague request into a sharable runbook with RACI, timeline, and per-platform steps in minutes.
🤝
Cross-team alignmentGive identity, endpoint, and security teams one map of who does what, and when.
🎓
Onboarding & trainingShow new admins how a multi-product Microsoft rollout actually fits together end to end.
⚡
Pre-sales & scopingSketch a credible deployment plan fast to frame a project, proposal, or statement of work.
Deployment goal
Ready. Press Plan the launch to begin.
PHASE 0PrepareLicensing, connectors, groups
PHASE 1PilotSmall ring, both platforms
PHASE 2Ring 1Expand & tune policies
PHASE 3BroadAll devices, enforce CA
PHASE 4OperateMonitor, alert, report
🗺️ Cross-product plan
0 tasks across 3 products
The planning board is empty.
Press Plan the launch and watch the agent build a cross-product rollout for Windows + iOS.
📄 Agent-generated rollout runbook 
The runbook appears here after the agent finishes planning. It includes an executive summary, prerequisites & licensing, the cross-product architecture, step-by-step build for Windows and iOS, validation tests, and a rollback plan.
Be honest

⚖️ Pros, cons & limitations

✓ Pros

  • Turns a vague goal into a structured, phased plan.
  • Makes cross-product dependencies explicit and ordered.
  • Separates the Windows and iOS build paths clearly.
  • Ends with a real, copyable deliverable — the runbook.
  • Fast: great for alignment, scoping, and training.

✕ Cons / trade-offs

  • A starting plan, not a substitute for an engineer's review.
  • Real tenants have nuances a generic plan can't know.
  • Product UIs, blade names, and steps change over time.
  • It plans and documents — it doesn't execute anything.

△ Limitations

  • This demo is illustrative — the plan is generated in your browser, not from your tenant.
  • Always verify steps against current Intune / Defender docs.
  • Licensing & prerequisites vary by organization.
  • Validate ASR & Conditional Access in audit / report-only first.
Want the deeper write-up? The about page covers the full background, the three-product plan, the Windows-vs-iOS build, and a copy-paste expert prompt plus a "make it real" path that grounds the agent in Microsoft Graph.