Defender for Endpoint Onboarding Gaps

The question it answers: Which Intune-managed devices are not onboarded to Defender for Endpoint, or have an inactive or impaired sensor?

Every Windows and macOS device Intune manages should be onboarded to Defender for Endpoint and reporting. Devices that are not onboarded have no EDR; onboarded devices with an inactive or impaired sensor are blind spots. Defender Health covers antivirus state only.

Note

This report calls the Defender for Endpoint API with its own token audience. Add the permission under ‘APIs my organization uses’ > WindowsDefenderATP in the app registration.

At a glance

Where in the app	Tenant › Defender & Security Operations › MDE Onboarding Gaps
Workload	Security
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed).
Licence	Microsoft Defender for Endpoint P1/P2 or Defender for Business.
Report id (API and MCP)	tenant.secops.mde-onboarding

Columns

Column	Key	Type
Severity	Severity	Status
State	Category	Text
Device	Subject	Link
Check	Setting	Text
Sensor health	Value	Text
Finding	Finding	Text
Detail	Detail	Text
Last seen	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: Microsoft Defender for Endpoint P1/P2 or Defender for Business.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Machine.Read.All	WindowsDefenderATP	Read all machine profiles	application permission on the ‘WindowsDefenderATP’ API
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET https://api.security.microsoft.com/api/machines
• GET /beta/deviceManagement/managedDevices (cached)

Through the API and MCP

GET /ir-api/v1/reports/tenant.secops.mde-onboarding?size=100

An AI assistant reads it with the MCP tool get_report and the id tenant.secops.mde-onboarding. The client needs the Read grant for Security. See Using the API.