Check every device is onboarded and its sensor is healthy¶
Licence and role
Microsoft Defender for Endpoint Plan 1 or Plan 2, or Defender for Business. Sensor health report: View Data permission under TVM.
Why it matters¶
A device that is not onboarded, or whose sensor stopped reporting, is invisible to Defender: no alerts, no ASR reports, no response actions. Microsoft calls out impaired communications and missing sensor data as risks that warrant investigation.
Steps¶
- Microsoft Defender portal > Reports > Device health and compliance > Sensor health & OS: filter on Inactive, Impaired communications and No sensor data. Export the list.
- Compare the device count with Intune (or your CMDB): every Windows device you manage should appear in Defender.
- On a sample device, run the read-only check: the Sense service should be Running and the onboarding status should be 1.
- Fix each gap (re-run the onboarding package or Intune onboarding policy) and record it in the tracker.
Impact on users¶
None. Reports and the check only read data.
Rollback¶
Nothing to roll back.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Windows with Microsoft Defender Antivirus (Defender PowerShell module is built in). No tenant connection.
Run on 3-5 sample devices per device type (laptops, kiosks, servers) as administrator.
Tenant-wide views are in the Microsoft Defender portal (Reports > Device health; Advanced hunting) as described in each control.
Get-Service -Name Sense | Select-Object Name, Status, StartType | Format-List | Out-String
$s = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -ErrorAction SilentlyContinue
"OnboardingState (1 = onboarded): $($s.OnboardingState)"
How to verify¶
No managed Windows device is missing from Defender or shows Inactive / Impaired communications / No sensor data for more than 7 days.
Sources¶
This control is in the Defender for Endpoint and ASR Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 15 controls.