Tenant-attached Configuration Manager devices can appear in Intune’s endpoint security and Microsoft Defender Antivirus reports when Microsoft Defender for Endpoint data upload for reporting is enabled. Microsoft documents support beginning with Configuration Manager version 2303. The four reports are Unhealthy endpoints, Active malware, Antivirus agent status, and Detected malware.
Which Intune reports cover tenant-attached devices?
The reports are split between two areas of the Intune admin center. The first pair gives operational views; the second provides organizational reporting on Antivirus status and malware. Microsoft lists these reports for tenant-attached devices when reporting is enabled. See Microsoft’s Cloud attach overview.
As an Amazon Associate I earn from qualifying purchases.
| Intune location | Report | What it helps answer |
|---|---|---|
| Endpoint security | Unhealthy endpoints | Which endpoints are reported as unhealthy? |
| Endpoint security | Active malware | Where is malware active, and where may remediation be needed? |
| Reports > Microsoft Defender Antivirus | Antivirus agent status | What is the Antivirus agent and protection state, including real-time and network protection and tamper protection? |
| Reports > Microsoft Defender Antivirus | Detected malware | What malware state and related device, severity, and malware details are reported? |
For Antivirus agent status, Microsoft documents device type and unhealthy device, user, and severity details as well as protection fields. The reports can be generated or refreshed to retrieve current data. Microsoft describes the information as timely but does not specify a fixed refresh interval or end-to-end reporting latency; do not treat a report as a real-time feed. Details are in Microsoft Intune Reports.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What must be enabled before the data appears?
Uploading Configuration Manager device records to the Intune admin center does not, by itself, enable the Antivirus reporting data. In the Cloud Attach configuration, enable the Microsoft Defender for Endpoint data upload option for reporting, and ensure the devices are within the upload scope. Microsoft’s configuration guidance is in Enable Microsoft Intune tenant attach.
#1 Best Overall
- Confirm tenant attach and device upload. For an already co-managed environment, configure upload in Configuration Manager’s Cloud Attach properties. For an environment that is not co-managed, use the Cloud Attach Configuration Wizard. You can scope upload to a device collection; selecting a collection also uploads its child collections.
- Turn on Defender reporting data upload. In the upload settings, select Enable Uploading Microsoft Defender for Endpoint data for reporting on devices uploaded to Microsoft Intune admin center. Microsoft identifies this option as necessary for the Endpoint Security reports.
- Check device scope and administrator access. Verify that the device belongs to the upload scope and that role-based access controls and permissions allow the administrator to view it and its report. Tenant-attached devices use the default Intune scope tag; if that tag is removed, the device will not appear in the admin center.
- Open the matching report. Use the reports under Endpoint security for unhealthy endpoints or active malware. For Antivirus agent status or Detected malware, go to Reports > Microsoft Defender Antivirus and generate or regenerate the report.
What to check if a device or report is missing
Work through the configuration in order rather than assuming a missing report means the device has no protection or malware findings.
- Check tenant attach health and confirm the Configuration Manager device was uploaded.
- Verify that the device is included in the selected upload scope and that Defender for Endpoint reporting data upload is enabled.
- Confirm the administrator can see the device under the applicable role-based access controls and scope tag.
- Check the report’s generation or refresh state. Microsoft does not publish a guaranteed refresh interval in the reporting guidance.
- Confirm the device identity and management source in Intune inventory. Uploaded Configuration Manager devices appear as ConfigMgr in the Managed by column.
- Review Configuration Manager client reporting if data remains unexpected after the upload and report settings are checked.
How reporting differs from Antivirus policy management
Report availability and policy assignment are separate. Seeing a device’s Antivirus status in a report does not establish which policy set a particular setting. To assign endpoint security policies to tenant-attached devices, the relevant Configuration Manager collection must be synchronized and enabled for endpoint security policies, and the profile must support the device’s operating system.
Rank #2
Microsoft’s tenant-attached Antivirus policy guidance lists support for Windows 10 and later (x86, x64, ARM64), Windows Server 2019 and later (x64), Windows Server 2016 (x64), Windows 8.1 (x86, x64), and Windows Server 2012 R2 (x64). These are platform details for the Antivirus policy guidance, not a guarantee that every endpoint security profile supports every listed platform. Check the current endpoint security policy setup guidance for the target profile and Configuration Manager version.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesVersion and data considerations
Microsoft’s Cloud Attach overview identifies Configuration Manager version 2303 as the starting point for opting into Intune Endpoint Security reports for tenant-attached devices. Treat 2303 as the documented starting version, not as a claim that later requirements or portal labels cannot change; consult the current Microsoft documentation when configuring a site.
Attaching a Configuration Manager site to an Intune tenant sends additional data to Microsoft. Review Microsoft’s tenant attach data collection documentation linked from its configuration guidance as part of your organization’s privacy and governance review. Intune subscription and Defender entitlements depend on the organization’s agreement and current Microsoft terms; reporting setup alone does not establish licensing coverage. Microsoft’s overview of Defender Antivirus deployment, management, and reporting is available at Deploy, manage, and report on Microsoft Defender Antivirus.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
