In my lab, Defender was paid for on 50 devices, but 20 of them were not protected and no alert said so. I read the device inventory, count every onboarding and sensor state with one KQL query, and walk through the four causes I found: the Intune EDR policy assigned to the wrong group, a proxy that blocks the sensor's WinHTTP traffic, devices onboarded to another tenant (check the OrgId), and servers outside Azure that need Azure Arc plus Defender for Servers. Result: from 60% to 98% of devices protected.
What the video covers
- 20 of 50 devices not protected (0:00)
- 4 causes (0:09)
- Who gets hurt (0:15)
- Read the device inventory (0:29)
- KQL 1: count every state (0:50)
- Cause 1: the package never arrived (1:01)
- Cause 2: the proxy blocks the sensor (1:19)
- Cause 3: onboarded to the wrong tenant (1:38)
- Cause 4: servers outside Azure (2:00)
- KQL 2: onboarded but not Active (2:18)
- Inactive is not always broken (2:27)
- The result: 60% to 98% (2:41)
- The checklist (2:56)
Every command from the video
// KQL 1: every onboarding and sensor state (Advanced hunting)
DeviceInfo
| where Timestamp between (ago(30d) .. now())
| summarize arg_max(Timestamp, *) by DeviceId
| summarize Devices = dcount(DeviceId) by OnboardingStatus, SensorHealthState
// KQL 2: onboarded but not Active (your to-do list)
DeviceInfo
| where Timestamp between (ago(30d) .. now())
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == "Onboarded" and SensorHealthState != "Active"
| project DeviceName, OSPlatform, SensorHealthState, Timestamp
// On the device: WinHTTP proxy the sensor uses
netsh winhttp show proxy
// On the device (PowerShell): Sense service and which tenant it reports to
Get-Service -Name Sense
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" | Select-Object OnboardingState, OrgId
Sources (Microsoft Learn, checked 2026-11-01)
- Fix unhealthy sensors: https://learn.microsoft.com/en-us/defender-endpoint/fix-unhealthy-sensors
- Device inventory field reference: https://learn.microsoft.com/en-us/defender-endpoint/device-inventory-field-reference
- DeviceInfo table: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceinfo-table
- Troubleshoot onboarding: https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-onboarding
- Defender for Endpoint integration in Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
Lab names and made-up numbers only (contoso.com, LAB-WIN11-xx).
What percent of your devices are really Active? Run KQL 1 and tell me in the comments, or watch the full video here: https://youtu.be/15fH5RftAYA
Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:
- ▶️ YouTube (daily Shorts + explainers): CD Security Lab
- 💼 LinkedIn: Cuong Do
- 📘 Facebook: CD Security Lab
- 📸 Instagram: @cdsecuritylab
- 📝 More posts like this: Dev.to
Got a question about your own tenant? Drop it in the comments.
Top comments (0)