Share via

WHEN was device onboarded to defender?

Aaron 0 Reputation points
2024-03-12T06:28:51.8233333+00:00

Hello

I am attempting to see WHEN our devices were onboarded to defender, like a date and time.

I can see there is a "First Seen" but that refers to a "when the device was first seen in the network or when it's first reported by the Microsoft Defender for Endpoint sensor" . We have enrolled many servers into defender last week but some of them shown as being seen in the beginning of February.

Is there a way to see when the device in question was onboarded specifically and not just when it was first witnessed?

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,281 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 30,931 Reputation points Microsoft Employee
    2024-03-13T10:29:30.1133333+00:00

    @Aaron Thank you for reaching out to us, researched on your ask - WHEN devices were onboarded to defender, like a date and time, not first seen.

    As per this document - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide which you already referred as well and in the mde portal I see only first seen schema has data & time related to the device.

    Have you integrated defender for cloud with defender for endpoint? - Defender for Endpoint sensor is automatically enabled on Windows Servers that are onboarded to Microsoft Defender for Cloud.

    As far I am aware this info is not possible to get as we don't have such schema defined in MDE for this ask/we have only first seen defined in schema to give details when the device was reported to MDE.

    Would recommend to post the same ask over here -https://techcommunity.microsoft.com/t5/microsoft-defender-xdr/bd-p/MicrosoftThreatProtection and also you can share the feedback - From any part of the portal, select Give feedback regarding the same.

    0 comments