Created by Claude - please verify

MDE onboarding - Defender for Endpoint machines API (separate token audience) joined with Intune managed devices on the Entra device id.

Required Microsoft Graph permissions

WindowsDefenderATP: Machine.Read.All (application permission on the 'WindowsDefenderATP' API) DeviceManagementManagedDevices.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Defender for Endpoint P1/P2 or Defender for Business.

Endpoints: GET https://api.security.microsoft.com/api/machines · GET /v1.0/deviceManagement/managedDevices (cached)

This report calls the Defender for Endpoint API with its own token audience. Add the permission under 'APIs my organization uses' > WindowsDefenderATP in the app registration.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Defender for Endpoint Onboarding Gaps

Every Windows and macOS device Intune manages should be onboarded to Defender for Endpoint and reporting. Devices that are not onboarded have no EDR; onboarded devices with an inactive or impaired sensor are blind spots. Defender Health covers antivirus state only.