Forum Widgets
Latest Discussions
Device* tables missing from Advanced Hunting schema despite M365 E5 license
We have an M365 E5 trial (with Microsoft Defender for Endpoint service plan enabled) and a standalone Defender for Cloud Apps trial on the same tenant. Two devices are onboarded and show as Active in Device Inventory. one Windows 11 VM hosted on mac m4 and one Windows Server 2019 Azure VM. The issue: the entire Devices section is missing from the Advanced Hunting schema. No DeviceInfo, DeviceNetworkEvents, DeviceEvents, DeviceProcessEvents, etc. The schema only shows Alerts & behaviors, Apps & identities, Email & collaboration, Defender Vulnerability Management, and Exposure Management. Additionally: - The device Timeline tab does not appear on device pages (not in visible tabs or overflow menu) - "Go hunt" from a device page only generates a query against IdentityLogonEvents, not any Device* tables - Settings → Microsoft Defender XDR does not show an "Advanced hunting" option for managing data sources - The MDE Client Analyzer on the Azure VM passes all EDR cloud connectivity checks (CnC, Cyber, AutoIR, SampleUpload, MdeConfigMgr all Succeeded 200) - Settings → Endpoints → Optional features loads with all toggles including the Defender for Cloud Apps integration - Cloud Discovery via MDA works (discovered apps visible on the device page) - The Tenant ID and Org ID shown in XDR settings are different values The tenant originally had only the Defender for Cloud Apps standalone trial. The E5 trial was added afterward. It appears the MDE data source was never deployed/activated in Defender XDR despite the license and onboarding being in place. I've opened a support case but wanted to ask here as well, has anyone resolved this issue? I've found several older posts describing the same problem but none with a confirmed fix. Any guidance would be appreciated.
Location of Defender for Identity Entry in Defender Tables
Our GRC group wants an automated report on windows servers and workstations over 7 days old not onboarded for Defender for Endpoint. A change in our environment (not sure if it was MS or us) has caused an additional entry in a column named "DiscoverySources" for Defender for Identity. It's my understanding that D4I is only used on domain controllers, but we get entries on non-DCs as well. This identifier does not appear on the device dashboard, nor can I add it in with the custom column tab. Furthermore, if a machine requires onboarding for D4E, it will show them both in the same column, it separates them with a comma in the same field. Right now, I have to do this process manually and with the overhead involved, it takes me about 30 minutes to run the reports, filter out the false positives and forward them to the appropriate staff. They want this every day, and I can't do this operationally. I'd welcome the opportunity to create a Logic App based on a query to perform this function and route it. Can someone point me in the direction of the table which contains the DiscoverSources column? I haven't been able to find it. That would help me to perform the necessary KQL and Logic App to automate this process. Long time listener. First time publisher. Thanks
EnableConvertWarnToBlock will not enable - stays False
We have a GPO applied to Windows 11 Pro machine - fully patched and onboarded to MDE. The GPO enables "EnableConvertWarnToBlock" as follows: The GPO is applied to the machine and the following registry key is populated: But when I check the status on the client - it will not enable: I have enabled troubleshooting mode and disabled tamper protection in case this is blocking but nothing seems to work. Its as if MDAV/MDE is not even looking/reading that registry key. Anyone else have the same issue or ideas on resolution?
New Blog | Microsoft Defender for Endpoint’s Safe Deployment Practices
By jweberMSFT For customers it is key to understand that software vendors use safe deployment practices that help them build resilient processes that maintain productivity. This blog addresses Microsoft Defender for Endpoint’s architectural design and its approach to delivering security updates, which is grounded in Safe Deployment Practices (SDP). Microsoft Defender for Endpoint helps protect organizations against sophisticated adversaries while optimizing for resiliency, performance, and compatibility, following best practices for managing security tools in Windows. Security tools running on Windows can balance security and reliability through careful product design, as described in this post by David Weston. Security vendors can use optimized sensors which operate within kernel mode for data collection and enforcement, limiting the risk of reliability issues. The remainder of the security solution, including managing updates, loading content, and user interaction, can occur isolated within user mode, where any reliability issues are less impactful. This architecture enables Defender for Endpoint to limit its reliance on kernel mode while protecting customers in real-time. Read the full post here: Microsoft Defender for Endpoint’s Safe Deployment Practices
Inconsistent Microsoft Defender Behaviour
Hi everyone, We have an issue whereby across several intune managed devices with identical defender AV policy, signature version, and platform version, we've found inconsistent detection/remediation behaviour. Some devices block malicious files instantly on download (expected and correct). Others only detect on open rather than on write, or log a successful detection/remediation action without the file actually being removed from disk, it remains fully accessible indefinitely. Since this occurs despite identical config, we're concerned this is a genuine gap in automatic remediation reliability that could affect real threats, not just our test files. Troubleshooting completed, issue persists: - Ruled out exclusions (path/extension/process) - Confirmed PUA protection, real-time protection, tamper protection, and all granular protection flags enabled/healthy - Removed orphaned third-party AV registrations from WSC (previously caused Defender to show as "snoozed") - Confirmed filter driver (WdFilter) loaded correctly, no conflicts - Cleared stuck "detected but not remediated" threat entries - Ruled out file locks preventing remediation - Cleared cached signature state, forced fresh signature pull - Attempted full platform reset - Confirmed cloud protection/MAPS enabled and reachable - Increased CloudBlockLevel to test enforcement aggressiveness Does anyone have any idea what could be happening here? ThanksMDVM - Patch Publication Date
Dear Microsoft MDVM Development Team, Please could you as quickly as possible implement the "Patch Publication Date" for the vulnerabilities you report on. Any major Vulnerability management platform has this simple field/record please advise you are implementing this and the timeframe for it? Kind Regards, Graeme
Defender Web Content filtering for Chrome/Firefox
Hello all, We have recently configured Web Content Filtering. I am struggling with finding what is required to have the setup effect on Chrome and Firefox, exactly as it is seen via Edge. Has anyone had success with this? Any information would be greatly appreciated. thank you.Understanding AI workloads on Linux
Hi everyone, I’m a PM working on security for Linux environments and trying to better understand how AI workloads are actually showing up in production today. Would appreciate hearing from folks here: Are you running any AI workloads on Linux today? Or actively exploring? What does your deployment/setup look like — e.g., model training/inference, agents, MCP servers, data pipelines, etc.? How are you thinking about securing this stack, if at all? If you’re open to a quick 30-min chat, I’d love to learn more from your experience as well. Thanks in advance — this will directly help shape where we invest next.
