This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 46%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
Hey Community,
i have a little bit trouble to unterstand which Logs are written to table "ProtectionStatus".
Can someone help me?
Thanks.
Regards,
Phil
A cloud-native solution that protects workloads across hybrid and multi-cloud environments with threat detection and security recommendations
Okay i unterstand now that this table hosts the Devices with installed Antimaleware Solution.
How can i get the devices in Azure they have installed Defender for Endpoint?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Phil Thank you for reaching out to us, let me research on your ask and revert back.
You can look in the M365D portal (security.microsoft.com).
You can filter the Defender for Cloud inventory by installed applications.
ProtectionStatus is a MDEF table...so all listed are Azure or Azure Arc systems.
Thanks for your Answer.
Yes this with the M365D Portal is possible. But i dont have access to this Portal.
Can i see the Devices over the Azure Logs?
ProtectionStatus is a MDEF table...so all listed are Azure or Azure Arc systems.
So you mean all Systems with Azure Defender or general all Azure and Azure Arc Systems?
When i check the list i have 77 from 150 Devices. So its not possible...
I am not sure I follow the comment/question fully.
You might try doing a filter for MDE on the Defender for Cloud inventory if that is in use. It may also be possible to use KQL to query using the Resource Graph Explorer. It does appear the MDE status is synchronized to Azure, the most likely location for this information is the resource graph. You might also look over the agent and server health workbooks provided by Azure Monitor. I think I remember seeing one that listed MDE status.
@Phil Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Thanks a lot.
Yes i know about the ResourceGraph Explorer but not about the correct table and the correct syntax.
But i will check it the next time.