We are facing delays when triggering manual sync from the Intune device page, often taking more than an hour, and policy deployment status is not always reported correctly. How can this be mitigated?

Additionally, Defender AV scans are not running as per the defined schedule and sometimes show as “Cancelled by NT AUTHORITY\SYSTEM”, even though the device is online. How can we identify the root cause?

Finally, for Defender Application Control for Business, we do not receive centralized alerts when apps are blocked and currently rely on local Event Viewer logs. Is there a centralized way to monitor and report these events?