All eligible endpoints are onboarded to Microsoft Defender for Endpoint

Overview

Microsoft Defender for Endpoint provides next-generation antimalware, endpoint detection and response, and threat and vulnerability management on Windows, macOS, Linux, iOS, and Android devices. When an endpoint is not onboarded, the device has no sensor reporting behavioral telemetry back to the service. An adversary who reaches that device can disable local security tools, harvest credentials, move to adjacent systems, and stage destructive or exfiltration activity without generating any alert in the Defender XDR portal. The unmonitored host becomes a stable foothold precisely because the security operations team has no visibility into what is happening on it. The risk is not limited to the individual device: because an attacker can use the blind spot to pivot into monitored segments undetected, a single onboarding gap can undermine the detection coverage of the entire environment. Onboarding every eligible endpoint ensures that the EDR telemetry pipeline has no gaps, that automated investigation and response can act on threats wherever they appear, and that the security team’s mean time to detect remains bounded across the full device estate.

Remediation

• Onboard devices to Microsoft Defender for Endpoint
• Onboard Windows client devices
• Onboard non-Windows devices to Microsoft Defender for Endpoint
• Run a detection test on a newly onboarded device
• Fix unhealthy sensors in Microsoft Defender for Endpoint

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1685 Disable or Modify Tools, T1003 OS Credential Dumping, T1021 Remote Services
Licence	WINDEFATP, MDE_LITE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.