Forum Discussion
M365 Defender - Recently seen by?
Does anyone know what "Recently seen by" under network activity actually means? We have a number of unusual device names keep popping up in our Defender inventory list, which are showing as runni...
My guess is this might be the Device Discovery, showing devices that have been detected on the network. What is the onboarding status shown for these devices?
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide#device-inventory
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide#device-inventory
- They're all showing as 'Can be onboarded'. I have since done some further digging and I am now pretty sure that they are new laptops that have failed the task sequence during imaging. My main query now is what 'Recently seen by' means. It is changing each time I look at the device page, and it showing real, current devices in our domain.
- In that case, I would assume this list shows the onboarded devices that recently detected the device in question, through the use of Device Discovery.
- Hi Jonhed, firstly, thank you for taking the time to reply to me.
I think you are right on this. Do you know what the 'Recently seen by' is though? I wonder why a newly discovered device that failed during the imaging process is 'Recently seen by' genuine devices on the domain.