WHEN was device onboarded to defender?

Question

Hello

I am attempting to see WHEN our devices were onboarded to defender, like a date and time.

I can see there is a "First Seen" but that refers to a "when the device was first seen in the network or when it's first reported by the Microsoft Defender for Endpoint sensor" . We have enrolled many servers into defender last week but some of them shown as being seen in the beginning of February.

Is there a way to see when the device in question was onboarded specifically and not just when it was first witnessed?

Answer 1

@Aaron Thank you for reaching out to us, researched on your ask - WHEN devices were onboarded to defender, like a date and time, not first seen.

As per this document - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide which you already referred as well and in the mde portal I see only first seen schema has data & time related to the device.

Have you integrated defender for cloud with defender for endpoint? - Defender for Endpoint sensor is automatically enabled on Windows Servers that are onboarded to Microsoft Defender for Cloud.

As far I am aware this info is not possible to get as we don't have such schema defined in MDE for this ask/we have only first seen defined in schema to give details when the device was reported to MDE.

Would recommend to post the same ask over here -https://techcommunity.microsoft.com/t5/microsoft-defender-xdr/bd-p/MicrosoftThreatProtection and also you can share the feedback - From any part of the portal, select Give feedback regarding the same.