Defender for Endpoint onboarding health checks
Advanced Hunting queries and a local PowerShell check that show which devices are onboarded, which ones have stopped reporting, and which discovered devices still need onboarding.
The problem
After an Intune-based rollout, the device inventory says a device is onboarded, but that doesn't tell you whether its sensor is still healthy and sending telemetry. Devices drop out quietly: reimaged machines, broken proxies, sensors stuck in impaired communication. Unmanaged devices that device discovery has found are easy to overlook as well.
Approach
Use the DeviceInfo table in Advanced Hunting, take the latest record per device, and slice it by onboarding status, sensor health and last seen time. For a single machine, a short PowerShell check confirms the Sense service and the onboarding state in the registry.
Implementation
Run the queries in the Defender portal under Investigation & response › Hunting › Advanced hunting. Each one starts from the latest DeviceInfo record per device.
Onboarding status across the estate
A quick overview by platform. OnboardingStatus separates onboarded devices from discovered ones that can be onboarded, are unsupported, or lack information.
DeviceInfo
| where Timestamp > ago(7d)
| summarize arg_max(Timestamp, OnboardingStatus, OSPlatform) by DeviceId
| summarize Devices = count() by OnboardingStatus, OSPlatform
| sort by OnboardingStatus asc, Devices descOnboarded, but the sensor is not healthy
These devices count as onboarded, yet their sensor reports something other than Active, for example impaired communications or no sensor data.
DeviceInfo
| where Timestamp > ago(1d)
| summarize arg_max(Timestamp, OnboardingStatus, SensorHealthState, OSPlatform, OSVersion) by DeviceId, DeviceName
| where OnboardingStatus == "Onboarded" and SensorHealthState != "Active"
| project DeviceName, OSPlatform, OSVersion, SensorHealthState, LastReport = Timestamp
| sort by LastReport ascOnboarded devices that went quiet
Devices that reported earlier in the 30-day window but have not been seen for three days. Typical causes are reimaging, a device that has been retired, or a proxy change.
DeviceInfo
| where OnboardingStatus == "Onboarded"
| summarize LastSeen = max(Timestamp) by DeviceId, DeviceName, OSPlatform
| where LastSeen < ago(3d)
| sort by LastSeen ascDiscovered devices that can be onboarded
Device discovery finds unmanaged machines on the network. This list is the backlog for the next onboarding wave.
DeviceInfo
| where Timestamp > ago(7d)
| summarize arg_max(Timestamp, OnboardingStatus, OSPlatform, OSVersion, DeviceType) by DeviceId, DeviceName
| where OnboardingStatus == "Can be onboarded"
| project DeviceName, OSPlatform, OSVersion, DeviceType, LastSeen = Timestamp
| sort by OSPlatform asc, DeviceName ascChecking a single Windows device
On the device itself, run this in an elevated PowerShell session. OnboardingState is 1 on an onboarded device, and the Sense service is the Defender for Endpoint sensor.
Get-Service -Name Sense | Select-Object Name, Status, StartType
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' |
Select-Object OnboardingState, OrgId, LastConnectedTip: the second query is a good candidate for a custom detection rule. Add ReportId to the projected columns, then save it from Advanced Hunting with a daily frequency.
Security considerations
All queries are read-only and need only Advanced Hunting read access (Security data basics in unified RBAC). The output lists device names and OS versions, so treat exports as internal data. Advanced Hunting keeps 30 days of data, so a device that has been silent for longer disappears from these results; compare against the device inventory or Intune for that case.