Comparison between devices in Intune and MDE

Description

This query lists the devices that are onboarded in Intune and classifies them based on the status of Defender For Endpoint. You can select your own SearchPeriod in this query. The MDE data is based on a process activities seen in the search window, if that is the case then the device is classified as MDE Onboarded. This can help determine which devices have not yet been onboarded to MDE.

Query · kql

let SearchPeriod = 30d;
let MDEDevices = DeviceProcessEvents
    | where TimeGenerated > ago(SearchPeriod)
    | extend DeviceNameWithoutDomain = tostring(split(DeviceName, ".", 0)[0])
    | distinct DeviceNameWithoutDomain;
IntuneDevices
| where todatetime(LastContact) > ago(SearchPeriod)
| summarize arg_max(TimeGenerated, DeviceName, LastContact) by DeviceId
| extend MDEStatus = iff(DeviceName in~ (MDEDevices), "MDE Onboarded", "Not Onboarded")
| summarize Total = count(), Devices = make_set(DeviceName) by MDEStatus
Raw source Comparison between devices in Intune and MDE · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Comparison between devices in Intune and MDE

## Query Information

#### Description
This query lists the devices that are onboarded in Intune and classifies them based on the status of Defender For Endpoint. You can select your own *SearchPeriod* in this query. The MDE data is based on a process activities seen in the search window, if that is the case then the device is classified as *MDE Onboarded*. This can help determine which devices have not yet been onboarded to MDE.

### References
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/intunedevices

## Sentinel
```KQL
let SearchPeriod = 30d;
let MDEDevices = DeviceProcessEvents
    | where TimeGenerated > ago(SearchPeriod)
    | extend DeviceNameWithoutDomain = tostring(split(DeviceName, ".", 0)[0])
    | distinct DeviceNameWithoutDomain;
IntuneDevices
| where todatetime(LastContact) > ago(SearchPeriod)
| summarize arg_max(TimeGenerated, DeviceName, LastContact) by DeviceId
| extend MDEStatus = iff(DeviceName in~ (MDEDevices), "MDE Onboarded", "Not Onboarded")
| summarize Total = count(), Devices = make_set(DeviceName) by MDEStatus
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.