MDE Unified Agent Deployment Status
MDE Unified Agent
Query
DeviceInfo
| where OnboardingStatus == "Onboarded"
| where isnotempty(OSPlatform)
| summarize arg_max(Timestamp,*) by DeviceName
| where isnotempty(OSPlatform) and isnotempty(DeviceName)
| where OSPlatform contains "WindowsServer2012R2" or OSPlatform contains "WindowsServer2016"
| extend Agent = case(ClientVersion startswith "10.3720", "MMA", ClientVersion startswith "10.8", "UnifiedClient","Other")
| summarize by DeviceName, OSPlatform, OnboardingStatus, Agent, ClientVersion
| sort by ClientVersion asc
| summarize TotalServers = count(), MMA = make_set_if(DeviceName, Agent == "MMA"),
Unified = make_set_if(DeviceName, Agent == "UnifiedClient"),
Other = make_set_if(DeviceName, Agent == "Other")
by OSPlatform
| extend TotalMMA = array_length(MMA)
| extend TotalUnified = array_length(Unified)
| extend TotalOther = array_length(Other)
| project OSPlatform, TotalServers, TotalMMA, TotalUnified, TotalOtherAbout this query
Explanation
The query is used to gather information about the deployment status of the Microsoft Defender for Endpoint - Unified Agent on downlevel servers. It provides details about the agent status, client versions, and operating system platforms. It also includes information about missing patches and security control compliance. The query results are summarized by operating system platform, total servers, total MMA agents, total Unified agents, and total other agents. Additionally, it provides an overview of the server OS versions and their patch status.
Details
Alex Verboon
Released: June 4, 2023
Tables
DeviceInfo
Keywords
DevicesIntuneUser
Operators
whereisnotemptysummarizearg_maxbycontainsextendcaseorstartswithmake_set_ifsortcountarray_lengthprojectletjoindistinctonmake_setdcountiftoint