Share via

Defender for Endpoint: Can be onboarded

David Vosswinkel 1 Reputation point
Jun 18, 2021, 8:46 AM

106880-endpoint.jpgHello
I installed Microsoft Defender for Endpoint on multiple machines with use of WindowsDefenderATPLocalOnboardingScript.cmd.
We also have sccm.

Some of the machines have the Status "can be onboarded". See attached screenshot.
Some have the status "onboarded".

Why is that? I however see that when I try to run eicar test virus on a machine that has status "can be onboarded" not email notification about that is being generated. With "onboarded" machines i get the notification.

Some cloud machines without sccm and ad also have the status onboarded, so i think it has nothing to do whether the machine has sccm or not.

Can you please point me in the right direction.
Thanks a lot

Microsoft Configuration Manager
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. AllenLiu-MSFT 47,081 Reputation points Microsoft Vendor
    Jun 21, 2021, 8:50 AM

    Hi,
    Thank you for posting in Microsoft Q&A forum.
    According to your description, the issue is not related to SCCM. You attached a SCCM tag, you may try to post a new thread with the tag azure-security-center, you will get a better support from there.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.