Skip to main content
{ Endpoint Security }

Microsoft Defender for Endpoint Sensor Remediation

Provides a ranked queue of Defender for Endpoint devices whose sensor is inactive or impaired, or whose antivirus runs in passive mode or out of date.

What this agent does

This read-only agent finds the Microsoft Defender for Endpoint devices that do not protect the device as expected. It checks every onboarded device for sensor health, last full report, and antivirus mode and update state. It ranks the unhealthy devices into one remediation queue, grouped by platform and device group so each owner gets the devices they can fix.

The challenge

A device with the sensor installed counts as onboarded in most reports. The sensor can stop reporting, lose its connection to the cloud service, or send no sensor data. On Windows Server, antivirus stays in passive mode after the product it deferred to is removed. A console count still shows these devices as protected, so teams find the gaps only after an incident.

The solution

The agent checks each device against a small set of health conditions and ranks the failures by severity and age. It separates sensor problems from antivirus problems. Each one has a different owner and a different fix. It reports a device that leaves Defender as out of scope, never as fixed, to enable defenders to close sensor gaps before an attacker finds them.

Workflow

  1. 01

    Read devices

    Read every onboarded device with its health status, last full report time, platform, device group, and antivirus mode and update state.

  2. 02

    Check health

    Flag inactive, impaired, and no sensor data states, devices with no full report in 30 days, and passive, disabled, or out of date antivirus.

  3. 03

    Rank

    Order the queue by severity, then by age, and group it by platform and device group for routing.

  4. 04

    Report

    Publish the queue and condition counts with devices replaced by stable pseudonyms.

Agent template 

# Microsoft Defender for Endpoint Sensor Remediation

## Measurable outcomes

Every Defender for Endpoint device with an unhealthy sensor or antivirus state is in the ranked remediation queue with the condition that put it there. Track the count for each condition on every run. The counts fall as teams remediate devices.

## Procedure

Read every onboarded device in the tenant. Flag the health statuses the API reports: inactive, impaired communications, no sensor data, and no sensor data with impaired communications. An inactive sensor has sent no signal for 7 days, so treat inactive as the warning tier. Mark a device critical when its last full report is more than 30 days old, unless I set another threshold. Read the antivirus health report. Flag devices where antivirus runs in passive mode or is off, and devices where the report marks the platform, the engine, or the security intelligence as not up to date. Rank no sensor data, antivirus off, and critically stale conditions above impaired communications, passive mode, not up to date, and inactive. Break ties by age. Group the queue by platform and device group for routing. A device that disappears from Defender has left scope. Never count it as remediated. A device that device discovery found but that is not onboarded belongs to the posture report, not this queue.

## Requirements

It needs read access to Defender for Endpoint devices and the antivirus health report, through an app registration with the Machine.Read.All permission, and nothing more. Onboarded devices are the denominator, so it never claims to find unmanaged assets. It never onboards, offboards, isolates, or changes a device, device group, or policy. Reports replace devices with stable pseudonyms.