Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMicrosoft Intune’s Detected malware report is the starting point for seeing which organizational devices have reported malware, how those devices are classified, and what threat details are available. In the Intune admin center, go to Reports > Microsoft Defender Antivirus, open the Reports tab, select Detected malware, and choose Generate report (or Generate again for an existing report).
The report is an organizational view based on data supplied through the Defender Configuration Service Provider (CSP). It is useful for an overall device-state picture, but its device count is not interchangeable with a total detection count, a distinct-malware count, or the number shown in every Defender portal view. The sections below show how to read each measure and how to find the name and state of a specific threat.
As an Amazon Associate I earn from qualifying purchases.
Open and generate the Detected malware report
Use the following path in the Microsoft Intune admin center:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Sign in to the Microsoft Intune admin center with an account that can view Intune reports.
- Select Reports in the navigation pane, then choose Microsoft Defender Antivirus.
- Open the Reports tab and select Detected malware.
- Select Generate report. If a report has already been created and you need another retrieval, select Generate again.
Microsoft describes this as a report of the malware state of your organization’s devices. The generated page includes a pie chart showing the number of devices in each malware state. You can filter the results, search within them, move between pages, and sort columns. “Generate” is part of the retrieval workflow; Microsoft does not publish a guaranteed refresh interval, so do not describe the result as a real-time feed.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Because the report is built from Defender CSP information, a device must have reported usable data through that integration before it can appear. A blank or unexpectedly small report therefore needs to be checked against device enrollment, Defender reporting, and the selected filters rather than assumed to mean that no endpoint has ever seen malware.
What the organizational report tells you
Device state at a glance
The main report answers an organizational question: how many reportable devices are in each malware state? The pie chart is a device-oriented summary, not a list of every detection event. A single device can have more than one detection, and the same malware family can be present on multiple devices. Those events and distinct threat names require the malware overview data or a detailed device view.
Searchable report rows
Use filtering and search to narrow the organization-wide results before investigating an individual endpoint. Paging and sorting are especially important in larger tenants: a threat may not be visible on the first page, and sorting by a state or count column can expose devices that need immediate attention. Record the report generation time and active filters when exporting or sharing findings so another administrator can reproduce the same view.
What “state” does not mean
A state label is not automatically a statement that a threat is currently executing. Execution state, threat state, remediation state, and the broader malware state are separate properties in the device-level data. Treat the pie chart as triage context, then inspect the per-threat fields before deciding whether a device needs isolation, remediation, or simply monitoring.
Separate device counts, detection totals, and distinct threats
The Microsoft Graph windowsMalwareOverview resource defines several measures that are often incorrectly shortened to “the malware count.” The resource and its summary collections are documented in the Microsoft Graph windowsMalwareOverview reference.
| Measure | What it represents | How to use it |
|---|---|---|
malwareDetectedDeviceCount |
Devices with malware detected in the last 30 days. | Use it to estimate the recent affected-device population. It is not the number of detections. |
totalMalwareCount |
All malware detections across devices. | Use it when the question is how many detection occurrences were recorded, including repeated detections. |
totalDistinctMalwareCount |
Distinct malware identified across devices. | Use it to understand threat variety rather than the number of affected endpoints. |
| Summary collections | Breakdowns by state, active severity, execution state, category, malware name, and operating-system version. | Use these groupings to find concentration by threat, severity, platform, or execution condition. |
These values can legitimately differ. For example, one device with the same threat detected several times contributes one device to malwareDetectedDeviceCount, several events to totalMalwareCount, and one entry to totalDistinctMalwareCount if no other malware is present. When reporting a number to management, name the measure and its time window instead of saying only “there are 25 malware items.”
The Graph documentation also states that the Intune malware overview requires an active Intune license for the tenant. The license requirement concerns access to this Intune reporting resource; it does not establish a particular subscription price or guarantee that every endpoint will provide identical telemetry.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Find the detected threat on a particular device
For per-device investigation, use the Microsoft Graph windowsDeviceMalwareState resource. Its documented properties are described in the windowsDeviceMalwareState reference. Unlike the overview resource, this model describes an individual device’s threat records.
| Field or property | What it helps you determine |
|---|---|
| Display name | The human-readable name presented for the detected threat. |
| Severity | The severity classification associated with the threat record. |
| Execution state | Whether and how the threat was associated with execution on the device. |
| State and threat state | The malware record’s state and the security service’s threat-specific status. |
| Initial detection date/time | When the threat was first recorded for that device record. |
| Last state change date/time | When the status most recently changed. |
| Detection count | How many detections are associated with that device-level threat record. |
| Category | The malware category assigned to the detection. |
| Additional-information URL | A link supplied with the record for more threat information, when present. |
Read the timestamps together with the detection count. A high count with a recent state change may indicate repeated detection or an unresolved condition, while an older initial detection with a later state change can indicate a remediation or status transition. The fields describe what the service recorded; they do not, by themselves, prove that a file is still running at the moment you open the report.
When the Defender portal does not show the malware name
Administrators sometimes open the Defender portal’s Devices with malware detections view and see a device but no malware name. Microsoft’s troubleshooting guidance directs you to Intune for the missing detail: open Antivirus > Active malware and inspect the Malware name column. The workflow is covered in Review detected threats using the Microsoft Defender for Endpoint Antivirus and Intune integration.
- In the Intune admin center, open Antivirus under the endpoint-security reporting area.
- Select Active malware.
- Search for the device, then read the Malware name column and the associated state or severity fields.
- Use the device-level record or its additional-information URL for deeper analysis.
This is not necessarily a data-loss error in the Defender portal. The two surfaces expose different views, and the portal’s device list can omit the name even though Intune’s Active malware view has it.
Why Intune and Defender show different numbers
A count is meaningful only when you identify the report surface, population, measure, and date window. Microsoft documents materially different selection rules for the Defender portal and Intune/Graph views.
| Surface | Population and time basis | Primary detail |
|---|---|---|
| Intune Detected malware organizational report | Organizational device malware state based on Defender CSP data; the report is generated or regenerated in Intune. A guaranteed refresh interval is not published. | Device-state distribution, with filtering, search, paging, and sorting. |
| Intune Active malware | Active-malware view used to inspect current threat records and the malware-name column. | Per-device active threat details. |
| Microsoft Defender portal Devices with malware detections | Devices active in the last 24 hours that had detections in the last 15 days. | Portal device list; a malware name may be absent. |
Graph windowsMalwareOverview |
malwareDetectedDeviceCount covers detections in the last 30 days; other totals describe detections or distinct malware across the overview data. |
Tenant-level counts and summary groupings. |
Suppose a device reported a detection 20 days ago but has not been active in the last 24 hours. It can contribute to the Graph 30-day device count while being excluded from the Defender portal’s active-device view. Conversely, a recently active device can appear in the portal’s 15-day detection population while not matching a different Intune filter or generated-report snapshot. These are different denominators, not automatically contradictory telemetry.
When documenting a discrepancy, write the number with its context: for example, “12 devices in the Defender portal’s 24-hour-active/15-day-detection view” or “18 devices in the Graph 30-day malware-detected measure.” Avoid adding the values together or subtracting them unless the populations and definitions have first been normalized.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
A practical investigation workflow
1. Establish the scope
Decide whether the question concerns affected devices, detection events, distinct malware, or currently active threats. Select the matching report before collecting numbers. If the request came from an incident ticket, note the device name, operating system, and time range supplied by the ticket.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Generate the organizational view
Run Detected malware from the Intune report path and record the generation time. Review the state distribution and use filters or search to isolate the relevant device population.
3. Identify the threat
For a missing name, move to Antivirus > Active malware and read the Malware name column. If programmatic reporting is in use, retrieve the device-level malware-state data and inspect display name, severity, state, execution state, category, timestamps, and detection count.
4. Check timing before escalating
Compare the initial detection time and last state-change time with the report’s date basis. A record outside a portal’s 15-day detection window may still be present in a 30-day Graph measure. An inactive endpoint may also be absent from the portal’s 24-hour active-device population.
5. Preserve evidence
Save the report name, generation or regeneration action, filters, device identifier, threat name, timestamps, and source URL. This makes later comparisons possible even if portal labels or the device’s state change.
Recommended Free Tools
Access, licensing, and freshness limits
Intune reporting is available only to tenants with an Intune entitlement. Microsoft’s Endpoint security in Microsoft Intune documentation explains that Intune requires a subscription that includes Intune or a standalone Intune subscription or add-on. The documentation used here does not establish your organization’s specific license assignment or current price, so verify entitlement in your tenant and licensing records.
The report-generation workflow retrieves data available from the Defender CSP, but Microsoft does not specify a guaranteed refresh latency for the organizational report. Treat the displayed result as a generated reporting snapshot, not a promise of instantaneous endpoint status. For an active incident, corroborate the record with the endpoint’s latest Defender telemetry and the timestamps shown in the malware-state data.
Common interpretation errors to avoid
- Calling every number “devices affected.” Use the exact field: device count, total detections, or distinct malware.
- Comparing portal totals without their windows. Always include the Defender portal’s 24-hour active-device and 15-day detection conditions when using that view.
- Assuming a missing portal name means no name exists. Check Intune’s Antivirus > Active malware view.
- Treating a state as execution proof. Read execution state and threat state separately.
- Promising real-time freshness. The sources do not publish a guaranteed refresh interval for the generated organizational report.
- Ignoring report generation. Select Generate report or Generate again before relying on the displayed organizational data.
Bottom line for administrators
Use Intune’s Detected malware report for the organization-wide device-state picture, Graph’s windowsMalwareOverview for clearly defined aggregate measures, and windowsDeviceMalwareState or Intune’s Active malware view for the actual threat name and per-device details. If a Defender portal total does not match Intune, first compare the population, date window, measure, detail level, and report-generation state. Once those definitions are aligned, most apparent discrepancies become explainable differences between reporting surfaces rather than evidence that one system is necessarily wrong.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
