How to check antivirus health in Microsoft Defender

Before you start

For the portal report, Microsoft lists the View Data permission for vulnerability management in Defender for Endpoint's roles. The PowerShell example reads Intune, so use an account with an Intune role that can read devices, such as Read Only Operator, in a tenant with an active Intune licence. It requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

Know how fresh it is. A device reports its antivirus state while it's online, and Microsoft marks a device's update status Unknown when it hasn't reported for more than 7 days. The examples read and export; they change nothing and start no scan.

Option 1

Check antivirus health with PowerShell

Install the modules once, then connect, read each Windows device's protection state and export the ones that need a look.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    $properties = 'id', 'deviceName', 'userPrincipalName', 'operatingSystem'
    $devices = @(Get-MgDeviceManagementManagedDevice -All -Property $properties |
        Where-Object { $_.OperatingSystem -eq 'Windows' })
    $report = @(foreach ($device in $devices) {
        $id = $device.Id
        $state = $null
        try {
            $state = Get-MgDeviceManagementManagedDeviceWindowsProtectionState -ManagedDeviceId $id
        } catch {
            Write-Warning "$($device.DeviceName): no protection state was read."
        }
        $problems = @()
        if ($null -eq $state) { $problems += 'No protection state' } else {
            if (-not $state.MalwareProtectionEnabled) { $problems += 'Antimalware off' }
            if (-not $state.RealTimeProtectionEnabled) { $problems += 'Real-time protection off' }
            if ($state.SignatureUpdateOverdue) { $problems += 'Security intelligence out of date' }
            if ($state.QuickScanOverdue) { $problems += 'Quick scan overdue' }
        }
        if ($problems.Count -gt 0) {
            [pscustomobject]@{
                Device = $device.DeviceName
                User = $device.UserPrincipalName
                NeedsALook = $problems -join '; '
                DeviceState = $state.DeviceState
                LastQuickScan = $state.LastQuickScanDateTime
                LastReported = $state.LastReportedDateTime
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "Defender Antivirus is current on all $($devices.Count) Windows devices."
    } else {
        $report | Sort-Object Device |
            Export-Csv -Path './antivirus-health.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($devices.Count) Windows devices need a look."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script makes 1 call for each Windows device, so it takes a while on a large tenant. NeedsALook lists every reason a device is in the file. Intune sets SignatureUpdateOverdue and QuickScanOverdue from what the device reports, and LastReported says when that was, so an old date means the rest is old too.

Option 2

Review the antivirus health report in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Select Reports, then open Device health and compliance.
3. Select the Microsoft Defender Antivirus health tab.
4. Read Antivirus mode for devices in passive, disabled or other modes, Recent antivirus scan results for failed or cancelled scans, and Security intelligence updates for devices out of date.
5. Select a bar on a card to list its devices, or select Export at the top for the whole report as a CSV, up to 500,000 rows.

This suits a look across every onboarded device, in Microsoft's own terms. The cards show the state today, so for a list to keep and compare month to month, export it or use a report.

Common questions

Why does the device inventory export say Not-Supported for antivirus?

Microsoft says the inventory's export doesn't carry antivirus status and shows it as Not-Supported. Use the antivirus health report's own export instead.

Is a device in passive mode a problem?

It can be. In passive mode Defender Antivirus isn't the device's main antivirus, and it runs that way only on devices onboarded to Defender for Endpoint. Microsoft says devices in passive mode, limited periodic scanning or off are a potential security risk and should be investigated.

Why does a device show Unknown instead of up to date?

It hasn't reported for more than 7 days, so Microsoft can't say. Find out why it's quiet first: see how to find devices not seen recently in Microsoft Defender.