Question

You have created an Intune endpoint detection and response (EDR) policy that references the Microsoft Defender for Endpoint connector and assigned it to a group of Windows 11 devices. In the Microsoft Defender portal, the affected devices show a Windows Defender Antivirus 'Sensor health status' of 'Inactive' and do not appear as onboarded. You confirm the Intune connector to Defender for Endpoint shows as 'Enabled' and the connection status is healthy. What is the most likely cause that must be corrected so the devices become onboarded?

Accepted Answer

The EDR policy has not been successfully applied because the devices are not yet enrolled in Intune or have not checked in to receive the policy

Answer

A Windows security baseline must be assigned before any EDR policy can take effect

Answer

The Defender for Endpoint connector must be reconfigured to allow Intune to receive compliance information from Android devices

Answer

Tamper protection is blocking the onboarding package from being written to the devices