Intune Endpoint Security Summary Inactive agent count

Anonymous
2022-04-26T13:31:28.53+00:00

Hi,

I would be happy to understand how Inactive devices are counted in Intune under Endpoint security | Antivirus Summary ? (the same question regarding pending updates too)

For example:

  • I go to Endpoint security | Antivirus -> Summary and see that let's say I have 1 Inactive agent.
  • If I will got to Reports | Microsoft Defender Antivirus -> Antivirus agent status -> export data and sort by LastReportedDateTime I will found out that for example I have more than one agent not checked in for more than 7 days.

I expected to see in Security summary all inactive agents, which have not checked-in longer than 7days.
Also I expected to see in Pending updates all agents with SignatureVersion older than 3 days to be in the list.

Is my expectations unfair, or is there anything I have missed?

I would be happy to know is there any not painful way how I can quickly determine the real count of all inactive agents and all agents with pending updates?

Thank you in advance!

Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,406 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Crystal-MSFT 43,721 Reputation points Microsoft Vendor
    2022-04-27T02:09:11.783+00:00

    @Anonymous ,Based on my checking, for the Microsoft Defender Antivirus report, it gets the report via "Get deviceManagementCachedReportConfiguration".
    https://learn.microsoft.com/en-us/graph/api/intune-reporting-devicemanagementcachedreportconfiguration-get?view=graph-rest-beta

    For Antivirus Summary under Endpoint security, it gets the information from deviceManagementConfigurationPolicy,
    https://learn.microsoft.com/en-us/graph/api/intune-deviceconfigv2-devicemanagementconfigurationpolicy-get?view=graph-rest-beta

    From your description, it seems the information in two sides is not the same. To check on this, we need to check in the background. Here, we suggest to open case to look into it. Here is a link with the detailed steps to open case:
    https://learn.microsoft.com/en-us/mem/get-support

    Thanks for your understanding and have a nice day!

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments