Microsoft Defender XDR Hunting Tables and Timeline Missing Despite Full E5 & Device Onboarding

Question

Description: We are encountering a backend schema ingestion failure. Our device (bhtnitin01) is fully onboarded to Microsoft Defender for Endpoint, with Defender AV and sensor running in Normal mode.

The device is visible in the MDE device inventory

Defender AV: ✅ Normal

Sense service: ✅ Running

Real-time protection: ✅ Enabled

User has full E5 license and is a Global + Security Admin

However:

• No timeline events are available for the device

Advanced Hunting shows no DeviceInfo, DeviceEvents, or MDE-related tables

We’ve confirmed it’s not an RBAC, license, or AV issue

Request: Force re-ingestion of MDE telemetry into Microsoft 365 Defender unified portal and repair broken schema sync.Description:

We are encountering a backend schema ingestion failure. Our device (bhtnitin01) is fully onboarded to Microsoft Defender for Endpoint, with Defender AV and sensor running in Normal mode.

The device is visible in the MDE device inventory

Defender AV: ✅ Normal

Sense service: ✅ Running

Real-time protection: ✅ Enabled

User has full E5 license and is a Global + Security Admin

However:

No timeline events are available for the device

Advanced Hunting shows no DeviceInfo, DeviceEvents, or MDE-related tables

We’ve confirmed it’s not an RBAC, license, or AV issue

Request: Force re-ingestion of MDE telemetry into Microsoft 365 Defender unified portal and repair broken schema sync.

Answer 1

@Nitin Nagar I hope you are doing well,

Welcome to Microsoft Q&A

Looks like a issue with the backend telemetry please Open a Microsoft Support Case

If telemetry is still not reaching Defender XDR, after you did those troubleshooting's steps

• Re-ingest missing telemetry
• Repair schema link between MDE and Defender XDR
• Review RBAC, License and AV issues

Use this link to start: Microsoft Support for Defender (https://learn.microsoft.com/en-us/defender-endpoint/contact-support)

Choose issue: “Data not appearing in Advanced Hunting” or "Device timeline missing".

And thats all for open the case...

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!