Enterprise Endpoint Platform Service (EPS) & Microsoft Defender Operations

This request is to consolidate two related efforts - enterprise Microsoft Defender operations and Multi-Tenant Organization - driven identity and endpoint modernization-into a single, unified enterprise endpoint security vehicle. The consolidated approach funds the centralized team responsible for operating Microsoft Defender for Endpoint (MDE), Microsoft Defender Antivirus (MDAV), and Microsoft Defender for Cloud (MDC), while executing HHS Multi-Tenant Organization (MTO) requirements, including cloud-based authentication, retirement of legacy ADFS infrastructure, modernization of access controls, and migration to Microsoft Intune. Together, these efforts establish unified governance, consistent device compliance enforcement, and reliable enterprise visibility across approximately 55,000 endpoints and 15,000+ servers spanning 27 Institutes and Centers.

If this consolidation is not approved, NIH will continue operating under fragmented endpoint and identity management structures, increasing enterprise-scale operational and cybersecurity risk. Defender operations and MTO modernization would remain disconnected, reducing coordination between device compliance, authentication controls, and detection coverage at a time when third-party tools are being retired. This fragmentation increases the likelihood of inconsistent security baselines, coverage gaps, delayed remediation, and uneven enforcement of Zero Trust access controls.

Without consolidation, NIH would sustain duplicated management structures and limited enterprise visibility across more than 70,000 assets, slowing onboarding, monitoring, and reporting. Migration from legacy ADFS to cloud-based authentication could stall, prolonging reliance on outdated identity infrastructure and elevating exposure risk. Inconsistent MDE coverage or delayed detection tuning during active modernization materially increases the probability of endpoint compromise and extended containment events. Decentralized execution also heightens audit risk due to configuration drift and inconsistent baseline enforcement, while preserving duplicative tooling and operational inefficiencies that forgo an estimated $2.7M-$4.6M annually in avoidable cost and risk exposure.

Failure to approve this consolidation leaves NIH operating with preventable fragmentation at enterprise scale, materially elevating cybersecurity exposure, operational instability, and compliance risk at a time of mandated federal transformation.