MS Graph - where to find detectedAppID for windowsProtectionState

Kahr Michael 5 Reputation points


We are currently building a reporting system for all Client / Server Systems, which should contain Intune Configs / State and Defender Informations. All our Clients (win 10 / 11) are intune managed with Defender Policies + ATP Onboarded.

As far as I got, I'm able to get all intune managed devices with basic infos via

Then I tried to retreive the Protection state, but I need a "detectedAppId" before I can retreive the state per unique device id. I tried to get the AppId via below graph call, but I got nothing in return (only 200 OK)$filter=displayName eq 'Windows Defender Antivirus'

    "@odata.context": "$metadata#deviceManagement/detectedApps",
    "@odata.count": 0,
    "": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET deviceManagement/detectedApps?$select=deviceCount,displayName",
    "value": []

When I check the "Discovered Apps" in Intune, I don't see any entry for Defender nor AntiVirus nor AntiMalware or something else.

Which "detectedAppId" is required for the below graph call?{detectedAppId}/managedDevices/{managedDeviceId}/windowsProtectionState

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,401 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,730 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. CarlZhao-MSFT 40,226 Reputation points

    Hi @Kahr Michael

    You can try listing the detectedApps directly and it should return the corresponding detectedAppId for you.

    User's image

    Hope this helps.

    If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

  2. Kahr Michael 5 Reputation points

    I have now created a list of all detected Apps (26.928 entries), but only found 5 entries for defender and all of them are for Apple Mac, nothing for windows OS.

    How can I get the status of the applied policies (Defender as minimum) to windows clients from intune?

    0 comments No comments