How to notify if any of the MDE sensor going to "INACTIVE" state

%3CLINGO-SUB%20id%3D%22lingo-sub-2705851%22%20slang%3D%22en-US%22%3EHow%20to%20notify%20if%20any%20of%20the%20MDE%20sensor%20going%20to%20%22INACTIVE%22%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2705851%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20can%20get%20notification%20if%20any%20of%20the%20Microsoft%20Defender%20Endpoint%20(MDATP%20aka%20MDE)%20sensors%20going%20to%20%22INACTIVE%22%20state.%20This%20will%20be%20an%20proactive%20approaches%20that%20will%20help%20to%20avoid%20assets%20flagging%20related%20to%20S360%20KPI%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2739001%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20notify%20if%20any%20of%20the%20MDE%20sensor%20going%20to%20%22INACTIVE%22%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2739001%22%20slang%3D%22en-US%22%3EEndpoint%20reporting%20to%20MDE%20will%20go%20inactive%20state%20if%20endpoint%20failed%20to%20connect%20MDE%20tenant%20for%207%20consecutive%20days.%20You%20can%20generate%20device%20inventory%20report%20or%20use%20KQL%20to%20get%20the%20Lastdeviceupdate%20date%20and%20time.%3C%2FLINGO-BODY%3E
Microsoft

How can get notification if any of the Microsoft Defender Endpoint (MDATP aka MDE) sensors going to "INACTIVE" state. This will be an proactive approaches that will help to avoid assets flagging related to S360 KPI 

1 Reply
Endpoint reporting to MDE will go inactive state if endpoint failed to connect MDE tenant for 7 consecutive days. You can generate device inventory report or use KQL to get the Lastdeviceupdate date and time.