This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 7.000000000000001%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EY7%3C/text%3E%3C/svg%3E)
Endpoint security -> Antivirus -> Unhealthy endpoints page In Microsoft Intune,
The value of "Signature update overdue" is always true. Even if I update the endpoint(laptop) up to the date, the value is still True.
Signature version in Microsoft official page is almost same value with the one on our laptop.
How does Intune judge this value as True?
I really appreciate if someone knows this and share information with me.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 35%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZM%3C/text%3E%3C/svg%3E)
@Yaco-7602,Thanks for posting in Q&A
From your description, I know that you want to know how does Intune judge value of "Signature update overdue".
Based on my research, I found that there is a delay in reporting in Intune. Even if you update the device up to date, it will take some time to get the latest report, or you can also generate an Antivirus agent status report to see the status of the device. Location: Report > Microsoft Defender Antivirus > Reports
Hope this can be helpful.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Thank you for your information!
I created a report and compared files but information looks same. It seems that the file which you showed me shows everything and the one which I mentioned shows only devices which are recognized as unhealthy. This is the result of exported file which you showed me, but even the device which has the earlier version has True value on SignatureUpdateOverdue. There is discrepancy...
@Yaco-7602,Thanks for your reply.
Please check whether the update date up to the latest in the Report, if no, please wait for a short time, because it will take Intune some time to get new report.
Meanwhile, please go to the device check whether the Signature version is same as the Signature version in Intune.
Moreover, you can use command Update-MpSignature to update Signature version and check Signature version status in Intune after a while.
Please try above information. If there is any update, feel free to contact me.
Thank you for your reply!!
But what I want to know is what Intune checks. What does Intune compare with Signature version information from a device information? For what is Signature update overdue for Intune?
@Yaco-7602,Sorry for the misunderstanding.
Based on my researching, I found that Intune checks signature update overdue by comparing the signature version and date of the device with the latest available signature version and date from Microsoft. If the device has an older signature version or date than the latest one, Intune will show a message that the device is out of date and needs to update its signature.
Moreover, Signature update overdue is a message that indicates that the endpoint protection program on a device has not received the latest security intelligence updates for a certain period of time. This may affect the device’s ability to detect and prevent malware and other threats.
Hope this can be helpful.
Thank you for your comment,
I think I understand why this discrepancy occurs. But this function should be enhanced because this security information is really important but most of our devices are shown in Intune as overdue though those devices are actually recognized as up to date on their OS... and I can't find a way to fix it...
But anyway, thank you for your researching. I understand that we should not trust Intune's information on this so far. I hope this will be improved soon.
Sincerely yours.
@Yaco-7602,Thansk for your kind understanding.
If there is anything else we can do in Intune in the future, feel free to contact me.