Defender Antivirus status "not updated"

[Niels van Dijk]

Antivirus intelligence updates are updated multiple times a day. Our W10 endpoint update successfully, but still the Defender for Endpoint AV status shows "not updated" on a large amount of endpoints. When I manually check these endpoints some are behind maybe max. a day. 

When (after how many days or missed updates) does Defender AV show endpoints as "not updated"?

(Note, the number of days before definitions are considered out of date is set to default - 14 days)

[#2]

@Niels van Dijk 

We spoke with our devs regarding your questions/issues.  They confirmed that it can take up to 24 hours for a newer signature to appear in the MDE portal.  The process looks like this:

1. MsSense.exe collects version info via IWscProduct::get_SignatureStatus API method
2. TVM will then collect this info anywhere from 12-24 hours and feed it to the DB servers (MDE Portal)

Our devs are looking at reducing this time, but doing so may introduce performance related issues.

If you need accurate/up-to-date Def/Sig information from your clients, you should not be using MDE for this.  You should use Intune or SCCM.

For Intune, please see this link:

Announcing new Endpoint Security Antivirus reports!

https://techcommunity.microsoft.com/t5/intune-customer-success/announcing-new-endpoint-security-anti...

For SCCM, please see this link:

How to Monitor Endpoint Protection in Configuration Manager

https://docs.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/hh508769(v=te...

For the “Antivirus status” column, Updated means the last time TVM pulled the data had the most current Def/Sig that it was aware of.  Not Updated means the sig/def was old.