Intune Endpoint Security Summary Inactive agent count

Question

Hi,

I would be happy to understand how Inactive devices are counted in Intune under Endpoint security | Antivirus Summary ? (the same question regarding pending updates too)

For example:

• I go to Endpoint security | Antivirus -> Summary and see that let's say I have 1 Inactive agent.
• If I will got to Reports | Microsoft Defender Antivirus -> Antivirus agent status -> export data and sort by LastReportedDateTime I will found out that for example I have more than one agent not checked in for more than 7 days.

I expected to see in Security summary all inactive agents, which have not checked-in longer than 7days.
Also I expected to see in Pending updates all agents with SignatureVersion older than 3 days to be in the list.

Is my expectations unfair, or is there anything I have missed?

I would be happy to know is there any not painful way how I can quickly determine the real count of all inactive agents and all agents with pending updates?

Thank you in advance!

Answer 1

@Anonymous ,Based on my checking, for the Microsoft Defender Antivirus report, it gets the report via "Get deviceManagementCachedReportConfiguration".
https://learn.microsoft.com/en-us/graph/api/intune-reporting-devicemanagementcachedreportconfiguration-get?view=graph-rest-beta

For Antivirus Summary under Endpoint security, it gets the information from deviceManagementConfigurationPolicy,
https://learn.microsoft.com/en-us/graph/api/intune-deviceconfigv2-devicemanagementconfigurationpolicy-get?view=graph-rest-beta

From your description, it seems the information in two sides is not the same. To check on this, we need to check in the background. Here, we suggest to open case to look into it. Here is a link with the detailed steps to open case:
https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding and have a nice day!

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.