You have a Microsoft 365 subscription and Microsoft 365 E5 licenses assigned to your users. Your windows 10 devices are managed in Intune. You want to onboard your devices to Microsoft Defender for Endpoint. What must you configure first? 

Answer options:

A.Enable service-to-service connection between Intune and Microsoft Defender for Endpoint
B.Buy Microsoft Defender for Endpoint licenses for your users.
C.A dynamically assigned Device group in Azure AD.D.Install the Microsoft Monitoring Agent on your devices

Correct Answer: A 
Before you can start onboarding your windows 10 devices to Microsoft Defender for Endpoint you must enable a connection between Intune and Defender for Endpoint. 
This is configured in the Microsoft Endpoint Manager admin center – Endpoint Security – Microsoft Defender for Endpoint – Open the Microsoft Defender Security Center 

Within the Microsoft Defender Security Center, navigate to Setting – Advanced Features and set “Microsoft Intune Connection” to On: 

Option B is incorrect. You already have Microsoft 365 E5 licenses, which include a Microsoft Defender for Endpoint license
Option C is incorrect. Creating a device group in Azure AD is not correct, you must establish a connection between Intune and Microsoft Defender for Endpoint.
Option D is incorrect. Installing the MMA agent is a prerequisite for collecting data on your devices. 
Reference: 
To know more about onboarding devices to Defender of Endpoint, please refer to the link below: 

https://docs.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure