Event banner

Defender for Endpoint AMA: The next evolution of automatic attack disruption

Event Ended
Tuesday, Oct 31, 2023, 09:00 AM PDT
In-Person

Event details

Defenders need every edge they can get in the fight against ransomware. We're excited to share that Microsoft Defender for Endpoint customers will now be able automatically to disrupt human-operated ...
Trevor_Rusher
Updated Oct 24, 2023
Defender for Endpoint
momkenanna's avatar
momkenanna
Copper Contributor
Oct 20, 2023

Hi, can I know if there is any way to generate reports from the Microsoft 365 admin center portal, that can show device information to users who log in? I can't find such a report that has the device security status with the user who is logged in.

usually, I can access the Device health reports from the security portal >> reports >> Device Health page >> Microsoft Defender Antivirus health 
but am unable to find a user login to the related device.


thanks and regards

yairts's avatar
yairts
Icon for Microsoft rankMicrosoft
Oct 31, 2023

 

Hi Raja, this functionality does not exist today. However, you can generate a report from Microsoft 365 Defender by querying Advanced Hunting to identify which users have been logged to which devices.

This information can be queried from either DeviceLogonEvents which are being logged by Microsoft Defender for Endpoint, or IdentityLogonEvents if you have Microsoft Defender for Identity in your environment.

 

AH query example:

DeviceLogonEvents
| where ActionType == "LogonSuccess"
| where AccountSid startswith "S-1-5-21" and DeviceName != AccountDomain // for domain users only
| project Timestamp, DeviceId, DeviceName, LogonType, AccountSid, AccountDomain, AccountName

Location
Microsoft Tech Community
Date and Time
Oct 31, 20239:00 AM - 10:00 AM PDT