Defender Says "Not Onboarded"? 4 Reasons Your Devices Aren't Protected

In my lab, Defender was paid for on 50 devices, but 20 of them were not protected and no alert said so. I read the device inventory, count every onboarding and sensor state with one KQL query, and walk through the four causes I found: the Intune EDR policy assigned to the wrong group, a proxy that blocks the sensor's WinHTTP traffic, devices onboarded to another tenant (check the OrgId), and servers outside Azure that need Azure Arc plus Defender for Servers. Result: from 60% to 98% of devices protected. What the video covers 20 of 50 devices not protected (0:00) 4 causes (0:09) Who gets hurt (0:15) Read the device inventory (0:29) KQL 1: count every state (0:50) Cause 1: the package never arrived (1:01) Cause 2: the proxy blocks the sensor (1:19) Cause 3: onboarded to the wrong tenant (1:38) Cause 4: servers outside Azure (2:00) KQL 2: onboarded but not Active (2:18) Inactive is not always broken (2:27) The result: 60% to 98% (2:41) The checklist (2:56) Every command from the video // KQL 1: every onboarding and sensor state (Advanced hunting) DeviceInfo | where Timestamp between (ago(30d) .. now()) | summarize arg_max(Timestamp, *) by DeviceId | summarize Devices = dcount(DeviceId) by OnboardingStatus, SensorHealthState // KQL 2: onboarded but not Active (your to-do list) DeviceInfo | where Timestamp between (ago(30d) .. now()) | summarize arg_max(Timestamp, *) by DeviceId | where OnboardingStatus == "Onboarded" and SensorHealthState != "Active" | project DeviceName, OSPlatform, SensorHealthState, Timestamp // On the device: WinHTTP proxy the sensor uses netsh winhttp show proxy // On the device (PowerShell): Sense service and which tenant it reports to Get-Service -Name Sense Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" | Select-Object OnboardingState, OrgId Sources (Microsoft Learn, checked 2026-11-01) Fix unhealthy sensors: https://learn.microsoft.com/en-us/defender-endpoint/fix-unhealthy-sensors Device inventory field reference: https://learn.microsoft.com/en-us/defender-endpoint/device-inventory-field-reference DeviceInfo table: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceinfo-table Troubleshoot onboarding: https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-onboarding Defender for Endpoint integration in Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint Lab names and made-up numbers only (contoso.com, LAB-WIN11-xx). What percent of your devices are really Active? Run KQL 1 and tell me in the comments, or watch the full video here: https://youtu.be/15fH5RftAYA Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along: ▶️ YouTube (daily Shorts + explainers): CD Security Lab 💼 LinkedIn: Cuong Do 📘 Facebook: CD Security Lab 📸 Instagram: @cdsecuritylab 📝 More posts like this: Dev.to Got a question about your own tenant? Drop it in the comments.