M365 Defender Medium risk does not honor Compliance rule in Intune

Question

M365 Defender Medium risk does not honor Compliance rule in Intune

Pavel yannara Mirochnitchenko 13,336 MVP

I have device onboarderd to M365 Defender and the risk level is now Medium. My Compliance policy requires low risk level to be compliant. Still, device is compliant and can access O365 apps which I deny for non-compliant devices. This situation I tracked down had lasted this entire day.

Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-12T18:34:02.82+00:00

I see that risk score rule is not applied....
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-12T19:09:35.507+00:00

I re-created Compliant policy, now I see the Defender risk score is also applied but still it says compliant, same time device
has medium level in Defender monitoring.

I also discovered, that M365 Defender thinks my device OS is not updated, but it actually is (security recommendations) and Edge outdated too, which is not.

4 answers

Your answer

Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-12T18:34:02.82+00:00

I see that risk score rule is not applied....
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-12T19:09:35.507+00:00

I re-created Compliant policy, now I see the Defender risk score is also applied but still it says compliant, same time device
has medium level in Defender monitoring.

I also discovered, that M365 Defender thinks my device OS is not updated, but it actually is (security recommendations) and Edge outdated too, which is not.

Answer 1

Crystal-MSFT 53,991 Microsoft External Staff

@Pavel yannara Mirochnitchenko , From your description, it seems the the machine risk score is not synchronized to the Intune for this device from security center. We can wait for some time to see if it can synced.

However, If the issue still persists after we monitoring 1 day, please collect the following information to clarify:

Could you let us know how many devices are affected? What are the enrollment method?
Is there any device working well? What is the difference between the working devices and not working devices?
Try to click sync on the device to get the latest policies to see if the result will be different.

If there's any update, feel free to let us know.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-13T05:34:28.53+00:00

Thanks @Crystal-MSFT I will keep monitoring this more. The challenge here is, that some of these machines are test machines, and are not in use 8 hours a day. I am actually on my way to clean onboarded devices, that only in-use devices will stay there, but unfortunatelly I have to wait because there is no way to manually delete device from Defender, or is there?
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2021-10-13T06:40:13.63+00:00

@Pavel yannara Mirochnitchenko , Without MDATP at hand, I have done some research. And find there's no option to remove the device in MDATP now. But find the method to offboard it. Here is a link for the reference:
https://amitmalik.net/defender-for-endpoint-delete-device/
Note: Non-Microsoft link, just for the reference.

Answer 2

Rahul Jindal [MVP] 10,911 MVP

The status against security recommendations in Defender can take 24 hrs to update.

Answer 3

Pavel yannara Mirochnitchenko 13,336 MVP

I start to see this as a massive problem on multiple machines, which has been in use for entire day. Defender classifies them as Medium risk, compliant policy requires Low and they still are compliant. I could open support case via M365 portal to solve this out...

Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2021-10-14T01:42:47.617+00:00

@Pavel yannara Mirochnitchenko , Thanks for the reply. Open case can be a better option for our issue. We can check in the background to see if there's any more information to find.
https://learn.microsoft.com/en-us/mem/get-support

Answer 4

Rahul Jindal [MVP] 10,911 MVP

Have you checked why the devices are showing medium risk? Are the alerts\incidents recent?

Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-14T10:42:40.277+00:00

No alerts, but it claims that Windows 10 10.0.19043.1237 is obsoloted. Actually maybe that's why all machines turned to Medium, because I have 3 day defer after MS releases Cumulative Update.
Rahul Jindal [MVP] 10,911 Reputation points MVP

2021-10-14T22:23:57.43+00:00

It is possible. Recommendations from security center should confirm this.
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-15T05:11:23.473+00:00

@Rahul Jindal [MVP] I am not worried about are my devices low or medium, that part I can solve one way or another, through Recommendations. I am worried, why devices are still compliant and has access to my system. :)
Rahul Jindal [MVP] 10,911 Reputation points MVP

2021-10-15T06:54:24.627+00:00

Honestly I have never experienced this kind of a mismatch in the compliance. There must be some part of your configuration or something within your tenant isn't right. Maybe opening a case with support will be the right course of action for you.
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-17T16:44:05.243+00:00

@Rahul Jindal [MVP] do you use defender risk score in your compliance policies? So are you saying that excact the same config works for you like I would want it to behave?
Rahul Jindal [MVP] 10,911 Reputation points MVP

2021-10-17T17:06:37.443+00:00

I am currently using the risk score as medium in the compliance policy and not seeing any issues.
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-18T05:35:27.487+00:00

@Rahul Jindal [MVP] do you have any high risk machines in your enviroment which do not pass the compliance?
Rahul Jindal [MVP] 10,911 Reputation points MVP

2021-10-18T08:28:42.247+00:00

It is a mix bag. I am seeing devices with High risk level reporting as non-compliant, but some are also reporting as compliant. Some of them are yet to report updated status, so it could be a case of stale reporting, but I am going to be monitoring this.

This may be a case of miss-reporting here and you may be on to something. I think opening a support case would be the right course of action for you. In the meantime, if I come across something, I will update this thread.
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP

2021-10-18T08:41:23.78+00:00

Thanks, I will also post here how the support case will flow.

Share via

M365 Defender Medium risk does not honor Compliance rule in Intune

4 answers

Your answer