Comparison between devices in Intune and MDE
Comparison Intuneand MDE Devices
Query
let SearchPeriod = 30d;
let MDEDevices = DeviceProcessEvents
| where TimeGenerated > ago(SearchPeriod)
| extend DeviceNameWithoutDomain = tostring(split(DeviceName, ".", 0)[0])
| distinct DeviceNameWithoutDomain;
IntuneDevices
| where todatetime(LastContact) > ago(SearchPeriod)
| summarize arg_max(TimeGenerated, DeviceName, LastContact) by DeviceId
| extend MDEStatus = iff(DeviceName in~ (MDEDevices), "MDE Onboarded", "Not Onboarded")
| summarize Total = count(), Devices = make_set(DeviceName) by MDEStatusAbout this query
Comparison between devices in Intune and MDE
Query Information
Description
This query lists the devices that are onboarded in Intune and classifies them based on the status of Defender For Endpoint. You can select your own SearchPeriod in this query. The MDE data is based on a process activities seen in the search window, if that is the case then the device is classified as MDE Onboarded. This can help determine which devices have not yet been onboarded to MDE.
References
Sentinel
Explanation
This query is designed to compare devices managed by Intune with those onboarded to Microsoft Defender for Endpoint (MDE). Here's a simple breakdown of what it does:
-
Search Period: The query looks at data from the last 30 days (you can adjust this period).
-
MDE Devices: It identifies devices that have been active in MDE by checking for any process activity within the specified search period. These devices are considered "MDE Onboarded."
-
Intune Devices: It retrieves a list of devices that have contacted Intune in the last 30 days.
-
Comparison: For each device in Intune, it checks if the device is also in the list of MDE onboarded devices. It then classifies each device as either "MDE Onboarded" or "Not Onboarded."
-
Summary: Finally, it provides a count of devices in each category ("MDE Onboarded" or "Not Onboarded") and lists the device names in each category.
This helps you quickly see which devices managed by Intune are also protected by MDE and which ones are not.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators