How to find devices not onboarded in Microsoft Defender

Before you start

Use an account that can run advanced hunting in the Microsoft Defender portal. The PowerShell example requests ThreatHunting.Read.All; your organisation may require administrator consent. The tenant needs Defender for Endpoint with onboarded devices, and device discovery finds the others only on the networks those devices are on.

Advanced hunting looks back 30 days at most, so a device not seen in that time isn't in the results. Microsoft keeps a discovered device in the inventory for longer while an onboarded device on the same network still sees it. The examples read and export and change nothing.

Option 1

Find devices not onboarded with PowerShell

Install the module once, then connect, run the query through Microsoft Graph and export the devices.

# Install once, if the module is not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'ThreatHunting.Read.All' -NoWelcome
try {
    # The latest record of each device, without merged records, kept when it isn't onboarded.
    $query = 'DeviceInfo | summarize arg_max(Timestamp, *) by DeviceId' +
        ' | where isempty(MergedToDeviceId)' +
        " | where isnotempty(OnboardingStatus) and OnboardingStatus != 'Onboarded'" +
        ' | project DeviceName, OnboardingStatus, DeviceCategory, DeviceType, OSPlatform,' +
        ' Vendor, Model, LastSeen = Timestamp' +
        ' | order by OnboardingStatus asc, DeviceName asc'
    $body = @{ Query = $query; Timespan = 'P30D' } | ConvertTo-Json
    $uri = 'https://graph.microsoft.com/v1.0/security/runHuntingQuery'
    $request = @{ Method = 'POST'; Uri = $uri; Body = $body; ContentType = 'application/json' }
    $response = Invoke-MgGraphRequest @request
    $rows = @($response.results | ForEach-Object { [pscustomobject]$_ })
    if ($rows.Count -eq 0) {
        Write-Output 'Every device seen in the last 30 days is onboarded.'
    } else {
        $columns = 'DeviceName', 'OnboardingStatus', 'DeviceCategory', 'DeviceType', 'OSPlatform',
            'Vendor', 'Model', 'LastSeen'
        $rows | Select-Object $columns |
            Export-Csv -Path './devices-not-onboarded.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) devices seen in the last 30 days aren't onboarded."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each device, grouped by status, with its category, type and platform and the last time it was recorded. Vendor and Model are filled only where device discovery learned enough about the device. A device merged into a newer record is left out, so it isn't listed twice. To keep only the devices you can onboard, change the third line of the query to where OnboardingStatus == 'Can be onboarded'.

Option 2

Filter the device inventory in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Assets > Devices and select the Computers & mobile tab.
3. Filter on Onboarding status and choose Can be onboarded. Add Unsupported and Insufficient info to see the rest.
4. Read Discovery sources to see how each device was found, and select Export for a CSV.

This suits a look in Microsoft's own wording, and it keeps devices longer than advanced hunting does. Microsoft says the Can be onboarded count can differ from the onboarding recommendation and the devices to onboard widget, which leave out short-lived and guest devices.

Common questions

What do the onboarding statuses mean?

Can be onboarded is a device on a supported system that has no sensor. Unsupported is a device Defender for Endpoint can't onboard. Insufficient info means it couldn't tell; Microsoft suggests standard discovery on more devices to learn more about it.

Why is a device listed that left the network months ago?

Microsoft says a device that isn't onboarded stays in the portal for more than 180 days when an onboarded device on the same network still finds it. The query above looks back only 30 days, so it shows such a device only while it's still being recorded.

How do I find onboarded devices that stopped reporting?

Those show as Onboarded with an inactive sensor. See how to find devices not seen recently in Microsoft Defender.