How to find devices not seen recently in Microsoft Defender

Before you start

Use an account that can run advanced hunting in the Microsoft Defender portal. The PowerShell example requests ThreatHunting.Read.All, the only permission Microsoft lists for the hunting API; your organisation may require administrator consent. The tenant needs Defender for Endpoint with onboarded devices: where it isn't deployed, queries on the table return nothing.

A device reports only while it's on and connected, so a laptop that's switched off goes quiet too. Microsoft keeps a device's profile in the inventory for up to 180 days. The examples read and export and change nothing.

Option 1

Find devices not seen recently with PowerShell

Install the module once, then connect, run the query through Microsoft Graph and export the devices.

# Install once, if the module is not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$days = 7
Connect-MgGraph -Scopes 'ThreatHunting.Read.All' -NoWelcome
try {
    # The latest record of each device, kept when it's older than $days.
    $query = 'DeviceInfo | where isnotempty(OSPlatform)' +
        ' | summarize arg_max(Timestamp, *) by DeviceId' +
        " | where OnboardingStatus == 'Onboarded' and Timestamp < ago($($days)d)" +
        " | extend DaysUnseen = datetime_diff('day', now(), Timestamp)" +
        ' | project DeviceName, OSPlatform, SensorHealthState, LastSeen = Timestamp, DaysUnseen' +
        ' | order by DaysUnseen desc'
    $body = @{ Query = $query; Timespan = 'P30D' } | ConvertTo-Json
    $uri = 'https://graph.microsoft.com/v1.0/security/runHuntingQuery'
    $request = @{ Method = 'POST'; Uri = $uri; Body = $body; ContentType = 'application/json' }
    $response = Invoke-MgGraphRequest @request
    $rows = @($response.results | ForEach-Object { [pscustomobject]$_ })
    if ($rows.Count -eq 0) {
        Write-Output "Every onboarded device was seen in the last $days days."
    } else {
        $rows | Select-Object DeviceName, OSPlatform, SensorHealthState, LastSeen, DaysUnseen |
            Export-Csv -Path './devices-not-seen.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) onboarded devices were last seen more than $days days ago."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each device, the longest unseen first, with its last time in UTC. Raise or lower $days to widen or narrow it. A device silent for more than 30 days has no record within reach, so it isn't in the file. Microsoft says the portal, its API and advanced hunting update at different rates, so a device that has just come back can differ between them.

Option 2

Review inactive devices in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Assets > Devices and select the Computers & mobile tab.
3. Filter on Sensor health state and choose Inactive.
4. Sort by Last device update to bring the longest silent to the top. Microsoft says it refreshes up to daily, so it can trail the times advanced hunting shows.
5. Select Export for a CSV. Microsoft says the file holds every device in the organisation, whatever filters are on screen.

This suits a look in Microsoft's own wording, and it reaches devices silent for longer than 30 days. The filters aren't in the export, so a list in the same shape each month takes PowerShell or a report.

Common questions

Why is a device someone uses every day on the list?

Check whether it was reinstalled or renamed. Microsoft says either creates a new device in the portal and leaves the old one, which turns Inactive. Search for the device's current name: it should be reporting normally under that.

Why does the portal show a device the script doesn't?

Advanced hunting looks back 30 days at most. A device that has sent nothing for longer has no DeviceInfo record to find, but the inventory keeps its profile for up to 180 days. An offboarded device also turns Inactive 7 days after it stops reporting.

How do I check the devices Intune manages?

Defender sees devices onboarded to Defender for Endpoint, and Intune sees those it manages, by their last check-in. A device can be current in one and silent in the other. See how to find stale devices in Microsoft Intune.