Location of Defender for Identity Entry in Defender Tables

Hi Michael,

The column you're looking for is in the DeviceInfo table under advanced hunting. DiscoverySources lists every product or service that has seen/reported the device, along with when it last reported it, which is why you're seeing D4I and D4E stacked together in the same field with a comma separator when both apply.

Since it's a dynamic/multi-value string field rather than a discrete column, it won't show up as a filterable option in the device dashboard or the custom column picker, that's expected behavior, not a bug on your end.

For your use case, something like this should get you close:

DeviceInfo
| where Timestamp > ago(1d)
| where OnboardingStatus != "Onboarded"
| where isnotempty(DiscoverySources)
| where DeviceType in ("Windows server", "Workstation")
| summarize arg_max(Timestamp, *) by DeviceId

You'll then want to parse DiscoverySources with split() or has_cs/contains to isolate the D4I-only entries you consider false positives versus the ones that also flag D4E onboarding gaps, since it's stored as a comma delimited string, not an array.

This should slot cleanly into a Logic App on a daily schedule using the Advanced Hunting API as the trigger source.