Defender Antivirus Health

The question it answers: Which Windows devices have Defender Antivirus off, real-time or tamper protection disabled, outdated signatures or a pending reboot?

Windows devices whose Microsoft Defender Antivirus is off, has real-time or tamper protection disabled, runs on outdated signatures, or needs a reboot to finish remediation - as reported to Intune. A device with protection off is the first place ransomware lands.

Note

Protection state is only available per device, so it comes from an on-demand scan: one Graph call per Windows device, 4 in flight.

At a glance

Where in the app	Intune › Endpoint Security & Readiness › Defender Antivirus Health
Workload	Intune
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Intune (Windows devices with Microsoft Defender Antivirus).
Report id (API and MCP)	intune.endpoint.defender-health

Columns

Column	Key	Type
Device	DeviceName	Link
User	UserPrincipalName	Text
Findings	Findings	Status
State	DeviceState	Text
Signatures	SignatureVersion	Text
Last reported	LastReportedDateTime	Date

Filters

Filter	Key (API)	On when the page opens
Only devices with a finding	findings	Yes

What it needs

Licence: Microsoft Intune (Windows devices with Microsoft Defender Antivirus).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /beta/deviceManagement/managedDevices
• GET /v1.0/deviceManagement/managedDevices/{id}/windowsProtectionState (scan)

Through the API and MCP

GET /ir-api/v1/reports/intune.endpoint.defender-health?size=100
GET /ir-api/v1/reports/intune.endpoint.defender-health?filter=findings
POST /ir-api/v1/reports/intune.endpoint.defender-health/scan

An AI assistant reads it with the MCP tool get_report and the id intune.endpoint.defender-health. The client needs the Run scan grant for Intune. See Using the API.