Duplicate entries in Defender ATP

Question

Hello,

Thanks in advance for any information on this issue.

As you can see we have duplicate entries in the Security Center showing up. In the below example, there are 4 total entries for this VM. These VMs are deployed through a pipeline. For some reason some are showing up in the workgroup, some are domain joined. The top 2 are domained and you can see the bottom 2 are not. I've purposely marked through any sensitive information but any help on this is happening is appreciated. My thought is that initially through the pipeline they are onboarded and onboarded as workgroup and when they are domained and the GPO hits them, they onboard again but I may be wrong.

Answer 1

Any update about this ?