Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Assess Devices

4 September 2026Doc update+17 / −8 lines

In brief

The page now lists licensing, onboarding, and portal-permission prerequisites. It also updates queries for identifying unmanaged devices, their discovering onboarded devices, and recent network connections.

What Defender admins need to know

Administrators get clearer requirements and query guidance for reviewing discovered devices and validating their network activity.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

ms.collection:

  • m365-security
  • tier1 ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-10141016 ms.topic: how-to ms.date: 06/16/07/03/2026 appliesto:
    • Microsoft Defender for Endpoint Plan 2

Prerequisites

Before you can review and assess discovered devices, make sure the following requirements are met:

  • Your organization has a Microsoft Defender for Endpoint Plan 2 license.
  • You have at least one device onboarded to Defender for Endpoint. Onboarded devices act as network sensors and data sources for discovering non-onboarded devices.
  • You have access to the Microsoft Defender portal with appropriate permissions to view the device inventory and run advanced hunting queries.

Supported operating systems

Device discovery supports the following operating systems:

Explore devices in the network

You can useUse the following advanced hunting query to get more context about each network name described in the networks list. The query lists all theidentify onboarded devices that were connected to a certainspecific network. The query retrieves devices with connected network withindata from the last seven days.days, filtered by network name from the networks list in the device discovery settings. 

DeviceNetworkInfo
| summarize arg_max(Timestamp, *) by DeviceId

Get device information on device

You can use the following advanced hunting query to get the latest complete information on a specific device.

Query details for discovered devices

Run thisThe following query onretrieves the DeviceInfo tablelatest known record for each discovered device that isn't onboarded, excluding invalidated or merged entries. Use it to return all discoveredidentify unmanaged devices along with theand review their most up-to-date details for each device:details:

DeviceInfo

By invoking the **SeenBy** function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network.

The following query retrieves the latest record for each non-onboarded device, excludes merged entries, and invokes the **SeenBy** function to show which onboarded device discovered it:

```query
DeviceInfo
| where OnboardingStatus != "Onboarded"
- ConnectionAttempt - An attempt to establish a TCP connection (syn)
- ConnectionAcknowledged - An acknowledgment that a TCP connection was accepted (syn\ack)

This meansThese connection types mean that when a non-onboarded device attempts to communicate with an onboarded Defender for Endpoint device, the attempt generates a DeviceNetworkEvent and the  non-onboarded device activities can be seen on the onboarded device timeline, and through the Advanced hunting DeviceNetworkEvents table.

YouThe following query returns the 10 most recent connection attempts and acknowledged connections, so you can try this example query:verify which non-onboarded devices are communicating with onboarded endpoints:

```textkusto
DeviceNetworkEvents
| where ActionType == "ConnectionAcknowledged" or ActionType == "ConnectionAttempt"
| take 10