Question

You are the Microsoft 365 administrator for Contoso. Your security team reports that the Microsoft Defender XDR portal's 'Devices at risk' and 'Threat protection status' reports have not updated for the past three days, even though the Microsoft Defender for Endpoint sensor on devices shows an 'Active' health state. Alerts and incidents are still generating normally in real time. You need to determine the most likely cause of the stale report data before opening a support ticket. What should you investigate first?

Accepted Answer

Whether the reporting data connector or the report's underlying data refresh has an issue, indicated on the Microsoft Defender XDR service health / message center and report banners

Answer

Whether the Defender for Endpoint onboarding package has expired and needs to be redeployed to all devices

Answer

Whether tamper protection is blocking the sensor from sending telemetry to the cloud

Answer

Whether the affected devices have exceeded their Defender Vulnerability Management license entitlement