Intune - Devices reported as without ATP-sensor

Chned 51

So we activated Defender ATP within Intune and connected it with Microsoft Defender Security Center:

I can see the devices at https://securitycenter.windows.com/machines

But Intune reports them as devices without ATP-sensor:

Also Defender Security Center states: "Device not found in Azure ATP"

I don't know why this is, because I made a Device configuration profile for onboarding the devices in ATP:

I looked at the SENSE log at Microsoft-Windows-SENSE/Operational, but don't see any errors there:

only informational entry's >>

Does anyone know where to look for now?

James Hamil 24,926 Reputation points Microsoft Employee

2020-09-29T22:27:46.527+00:00

Hi, we are looking into this issue and will update you shortly!

10 answers

Chned 51 Reputation points

2020-09-29T14:32:05.427+00:00

By the way, the following setting is enabled within Intune:
Please sign in to rate this answer.
Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-09-30T03:07:27.497+00:00

@Chned , From your description, I know we configure the Device Configuration profile to onboard the devices in ATP. But it is not working. If there's any misunderstanding, feel free to let us know.

From Intune side, we can check the affected Device configuration profile , click Device status to see if the profile is applied successfully on these two devices. meanwhile, please click the " devices without ATP-sensor" and see what is the detailed status.

Please check the above information and if there's anything unclear, feel free to let us know.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Chned 51 Reputation points

2020-09-30T09:17:12.813+00:00

For these 2 devices I always see the following Error for System account? I assume this sensor isn't relying on any account?

Below is the Error information

Following is what I see after choosing "List of devices without ATP sensor"
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee

2020-09-30T12:45:33.917+00:00

@Chned Can you confirm if the device configuration profile was created before establishing the connection as if we do that the package file needs to be uploaded separately. Also try targeting the Device Config policy for the Device Group as the evaluation is done in Device context. So you would not see different UPNs and system accounts.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Chned 51 Reputation points

2020-09-30T13:20:50.747+00:00

This current profile was created AFTER making the Microsoft Intune connection in Microsoft Defender Security Center. I then choose for "Create a device configuration profile to configure ATP sensor" at the bottom of the "Microsoft Defender ATP"-page.
This profile is assigned to two groups and the Members in those groups are only those Devices.
Please sign in to rate this answer.
Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-02T03:19:02.977+00:00

@Chned , For the error code 0x87d1fde8, based on my research, the possible cause seems that Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields. We can see more detaisl in the following link:
https://learn.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding#microsoft-intune-error-codes-and-oma-uris

From your dexscrption in previous reply. it seems there's no error in Windows-SENS log. Given the situation, we suggest to open a case to look into more logs to troubleshoot on it.
https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support

Thanks for the understanding and have a nice day!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Chned 51 Reputation points

2020-10-06T13:07:25.223+00:00

So here we go... I just deleted this onboarding device configuration profile again (for the 3rd time, as a last effort) and made it again (just the same way as I did this before) and now it is working! It's a really simple profile and you can't really mess up anything here..

Very strange/buggy behaviour here..
Please sign in to rate this answer.
Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-07T02:44:17.097+00:00

@Chned , Thanks for the update. i am glad that it is working now. From the phenomenon, The device configuration profile is applied successfully. But the status is not changed. I guess it may have some synchronization issue in the background. If we face such issue in the future, open case to check logs in the background to find more information may help

Thanks again for your time and have a nice day!

Chned 51 Reputation points

2020-10-08T09:00:25.767+00:00

Unfortunately it isn't working consistently; I wiped the devices again (for testing purposes) and after enrollment it isn't working anymore.... Same settings et cetera..

The SENSE log still doesn't show any errors:

But I do see the errors with "System account":

Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-09T05:46:00.883+00:00

@Chned , Based as I know, for some settings in device configuration profile, it can be only applied to the user login the device. Could you confirm if the error is there with system account when it is working before?

Chned 51 Reputation points

2020-10-09T07:02:09.747+00:00

I think so, but how to be 100% sure? (since devices got wiped, I can't see those statusses anymore) Maybe in some log?

Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-09T09:09:50.503+00:00

@Chned , To check the device configuration policy applied status, on client side, we can see the MDM Diagnostic log or event log to check. We can see if the setting is under Diagnostic logs or if there's any related error under event log. To find the log, we can refer to the following links
https://learn.microsoft.com/en-us/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10
https://osddeployment.dk/2017/10/22/what-is-new-in-mdm-diagnostic-in-windows-10-1709/
Note: Non-Microsoft link, just for the reference.

Hope it can help.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Chned 51 Reputation points

2020-10-09T11:26:58.14+00:00

Unfortunately, like I said: the device got wiped already so I can't see those logs anymore..

Problem is that ATP-sensor doesn't work anymore. What could be the cause?
Please sign in to rate this answer.
Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-12T05:25:42.893+00:00

@Chned , If so, we suggest to open a case to Microsoft to check the logs in the background to know more.
https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support

Chned 51 Reputation points

2020-10-13T15:19:17.107+00:00

What logs are you aiming for?

Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-14T08:18:14.637+00:00

@Chned , For the logs on client side, we can enroll the device into Intune, collect MDM Diagnostic log, event log and provide them to Microsoft support engineer to analyze. For the intune side background log, only support engineer can check.

Thanks for the understanding and have a nice day!

Chned 51 Reputation points

2020-10-14T08:20:12.41+00:00

What can I check further on my side except for the things I already checked (SENSE-log)?
And what to look for then?

Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-15T06:57:37.11+00:00

@Chned Chned-6770, As we don't have ATP in my environment, we can't check the logs for you. Here, I have done research and find the following article. You can see if there's any other log we can check
https://learn.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding#troubleshoot-onboarding-issues-using-microsoft-intune

Hope it can help.

Chned 51 Reputation points

2020-10-15T07:17:34.657+00:00

Look at my startpost, I already gave information about the SENSE-log >> that looks all fine. Also device is to find in https://securitycenter.windows.com/

What to look for in the MDM Diagnostic Information log? When I search for Defender I find the following: 32548-log.txt

Crystal-MSFT 49,271 Reputation points Microsoft Vendor

2020-10-16T06:08:53.057+00:00

@Chned , Thanks for the reply.

As a reminder, to protect the customer information, please ensure there's no privacy information included.

For the MDM Diagnostic report, we can check if there's any keyword like onboarding. If not, maybe we can check the event log under Applications and Services Logs\Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider to see if any event with the CSP:
./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding
https://learn.microsoft.com/en-us/windows/client-management/mdm/windowsadvancedthreatprotection-csp

Meanwhile, for the error under system account, after doing more and more research, I find a similar case is fixed after login the device with a local account. maybe we can try. After that, we can check if the error will go away and if the device will be put into the "Devices with ATP sensor."

Hope it can help.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Intune - Devices reported as without ATP-sensor

10 answers

Your answer