Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Microsoft Defender for Endpoint - Agent inventory updates

Copper Contributor

Hello,

 

I'm new to Microsoft Defender for Endpoint. Recently I enabled Microsoft Defender for Endpoint and onboarded test devices. In the device inventory on "Last Device update" there are (i) which states -

A device typically sends a full report every 24 hours.

 

Eduards_0-1621577814991.png

 

Which means that for example I have security recommendations to resolve. I create and deploy policy to test workstation. And only after 24 hours I will see that recommendations is solved..?

Is there a way to enforce client to send reports immediately ?

3 Replies
best response confirmed by Eduards (Copper Contributor)
Solution
No, you will see those applied mitigations much faster. The device sends various data throughout the day, but not everything all the time as one big chunk. There used to be a setting to put a device in a "POC mode" (only for testing purposes) to expedite sending events - not sure this set of data would be part of it though.
Hello, thank you for the answer.
1 best response

Accepted Solutions
best response confirmed by Eduards (Copper Contributor)
Solution
No, you will see those applied mitigations much faster. The device sends various data throughout the day, but not everything all the time as one big chunk. There used to be a setting to put a device in a "POC mode" (only for testing purposes) to expedite sending events - not sure this set of data would be part of it though.

View solution in original post