Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Tenant-attached Configuration Manager devices can appear in Intune’s endpoint security and Microsoft Defender Antivirus reports when the site’s cloud attach settings enable Microsoft Defender for Endpoint data upload for reporting. Microsoft documents this reporting capability beginning with Configuration Manager version 2303. The four reports are Unhealthy endpoints, Active malware, Antivirus agent status, and Detected malware.
Which Intune report should you use?
The four reports are split between two areas of the Intune admin center. The Endpoint security reports support operational checks; the Microsoft Defender Antivirus reports provide organizational status and malware details.
| Intune location | Report | What it helps answer |
|---|---|---|
| Endpoint security | Unhealthy endpoints | Which endpoints are reported as unhealthy? |
| Endpoint security | Active malware | Which devices have active malware requiring attention or remediation? |
| Reports > Microsoft Defender Antivirus | Antivirus agent status | What is the device’s antivirus protection and agent state, including real-time and network protection, Defender Antivirus, tamper protection, device type, and unhealthy device, user, or severity details? |
| Reports > Microsoft Defender Antivirus | Detected malware | What malware state and related device and severity details are reported? |
Microsoft describes the information as timely and allows administrators to generate or refresh the Antivirus agent status report. Its documentation does not specify a fixed refresh interval or end-to-end reporting latency, so do not interpret these views as guaranteed real-time monitoring. See Microsoft’s Cloud attach overview and Intune Reports documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable reporting for tenant-attached devices
Uploading Configuration Manager device records to Intune is not, by itself, the reporting opt-in. In the Cloud Attach configuration, enable the separate Microsoft Defender for Endpoint data upload option.
#1 Best Overall
- [This is a Copilot+ PC] — The fastest, most intelligent Windows PC ever, with built-in AI tools that help you write, summarize, and multitask — all while keeping your data and privacy secure.
- [The Power of a Laptop, the Flexibility of a Tablet] — Surface Pro 12” is a 2-in-1 device that adapts to you. Use it as a tablet for on-the-go tasks, prop it up with the built-in kickstand, or attach the Surface Pro Keyboard (sold separately) to turn it into a full laptop.
- [Incredibly Fast and Intelligent] — Powered by the latest Snapdragon X Plus processor and an AI engine that delivers up to 45 trillion operations per second — for smooth, responsive, and smarter performance.
- [All Day Battery Life] — Up to 16 hours of battery life[1] means you can work, stream, and create wherever the day takes you — without reaching for a charger.
- [Brilliant 12” Touchscreen Display] — The PixelSense display delivers vibrant color and crisp detail in a sleek design — perfect for work, entertainment, or both.
- Confirm tenant attach and device upload. For an already co-managed environment, open Configuration Manager’s Cloud Attach properties. For an environment that is not co-managed, use the Cloud Attach Configuration Wizard. Select the device collection to upload; selecting a collection also includes its child collections.
- Turn on Defender reporting data. In the upload settings, select Enable Uploading Microsoft Defender for Endpoint data for reporting on devices uploaded to Microsoft Intune admin center.
- Check the device scope. Confirm the target device belongs to the selected upload collection. Also verify that your Intune permissions and role-based access controls allow you to view the device and reports.
- Open the relevant report. Use Endpoint security for Unhealthy endpoints or Active malware. Use Reports > Microsoft Defender Antivirus for Antivirus agent status or Detected malware; generate or regenerate the report where needed.
Microsoft’s setup instructions are in Enable Microsoft Intune tenant attach. Tenant-attached devices use the default Intune scope tag; if that tag is removed, the device will not appear in the admin center.
Troubleshoot missing or unexpected report data
Check the path from Configuration Manager to the report rather than assuming the report is broken. Work through these checks:
Rank #2
- Laptop Size: This renewed Microsoft Surface Pro 7+ Tablet, has a screen size of 12.3 " and touch display. The 2736 X 1824 Pixel anti-glare screen, mostly reduces fatigue when using it, allowing you to focus on work. With a light weight, this Microsoft Surface refurbished laptop is a great choice for your Business and entertainment.
- Processor: This Renewed Surface Pro 7 Plus Tablet is installed with Intel Core i5-1135 G7 (2.4GHz-4.2GHz, 4Cores, 8Threads, 8 MB Intel Smart Cache), meeting the fast and stable operation of most programs.
- Powerful Memory: This refurbished Tablet has installed 8GB of RAM running memory and 256GB of Solid State Drive for you, allowing you to run multiple software and browsers at the same time with confidence, the Microsoft Surface powerful hard drive gives you enough space to download files!
- Multiple Ports:USB 3.0, microSD card reader(Optional), Headphone jact, Mini DisplayPort, Cover port, Charging port, this Microsoft SurfaceTablet allows you to fully enjoy the pleasure brought by technology.
- System: Windows 11 Pro is recognized as the most stable operating system, which is mostly for both commercial and professional users. Windows 11 Pro provides more security and management features for this used Surface Pro 7 (+) Tablet, as well as supporting virtualization and remote access. Meanwhile, it supports multiple languages, including English, French, Spanish, German, etc.
- Tenant attach: Confirm the site is attached and the device record uploads successfully.
- Collection scope: Verify the device is included in the selected upload collection or one of its child collections.
- Reporting opt-in: Confirm the Microsoft Defender for Endpoint data upload option for reporting is enabled.
- Access and scope tags: Check role-based access and confirm the default Intune scope tag has not been removed from the tenant-attached device.
- Report generation: For the organizational Antivirus reports, check the report’s generation state and regenerate or refresh it as appropriate.
- Device identity and source: In Intune’s device inventory, uploaded Configuration Manager devices are identified as ConfigMgr in the Managed by column. Make sure you are checking the tenant-attached Configuration Manager record rather than a separate Intune-managed device record.
- Client reporting: If the device is in scope and reporting is enabled but data remains absent or unexpected, investigate Configuration Manager client reporting and tenant attach health.
Reporting is separate from endpoint security policy deployment
These reports show antivirus or malware information; their availability does not establish which endpoint security policy configured a device setting. Policy assignment has additional requirements: the target Configuration Manager collection must be synchronized and enabled for endpoint security policies, and the profile must support the device’s operating system.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFor Microsoft Defender Antivirus policy support, Microsoft lists Windows 10 and later (x86, x64, ARM64), Windows Server 2019 and later (x64), Windows Server 2016 (x64), Windows 8.1 (x86, x64), and Windows Server 2012 R2 (x64). This platform list applies to the Antivirus policy guidance, not every endpoint security profile; support varies by profile. Check Microsoft’s endpoint security policy setup guidance for the applicable profile and Configuration Manager requirements.
Rank #3
- A PREMIUM PERFORMANCE 2-IN-1 LAPTOP & TABLET — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Plus), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease — ready for even your most demanding tasks.
- A STUNNING 13" OLED TOUCHSCREEN — Sharp colors, real detail, and smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, draw, or pinch to zoom — whichever feels right for streaming, sketching, or daily work.
- 15.5 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 15.5 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge a season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Version, data handling, and subscription considerations
Microsoft identifies Configuration Manager version 2303 as the starting point for opting tenant-attached devices into Endpoint Security reports in Intune. Treat this as the documented version threshold, and confirm current requirements in Microsoft’s Cloud attach overview before implementation.
Attaching a Configuration Manager site to an Intune tenant sends additional data to Microsoft. Review Microsoft’s tenant attach setup and data collection information as part of privacy and governance planning. Intune is a separate product, and subscription entitlements depend on the organization’s agreement and current Microsoft terms; reporting enablement should not be taken as proof that a particular Intune or Defender entitlement is included. Microsoft provides additional context in Deploy, manage, and report on Microsoft Defender Antivirus.
Quick Recap
Best Value
- Microsoft Surface Pro 7+ 12.3" Tablet 2-in-1 Laptop, Amazon Renewed, Core i3 with 128GB SSD and 8GB RAM
- More ways to connect, with both USB-C and USB-A ports for connecting to displays, docking stations and more, as well as accessory charging, Platinum Silver Color
- Standout design that won’t weigh you down — ultra-slim and light Surface Pro 7+ starts at just 1.70 pounds. Aspect ratio: 3:2
- Intel Core i3-1114G5 (1.70-3.0Ghz) | 128GB SSD | 8GB RAM | Windows 11 Professional Installed
- Screen: 12.3” PixelSense Display | Resolution: 2736 x 1824 (267 PPI) | Faster than Surface Pro 6, with a 10th Gen Intel Core Processor – redefining what’s possible in a thin and light computer. Wireless : Wi-Fi 6: 802.11ax compatible. Bluetooth Wireless 5.0 technology
Rank #4
- Intel Core i5-1035G4 3.70GHz processor, 128GB SSD Drive
- 8GB RAM, Wireless: 802.11a/b/g/n/ac Wi-Fi, Bluetooth 4.0
- Ports: Full-size USB 3.0; microSD card reader; Headphone jack; Mini DisplayPort; Cover port; Charging port, Camera: 5MP front-facing and 8MP rear-facing cameras with 1080p HD video recording
- Display: 12.3-inch PixelSense touchscreen display; 2736 x 1824 resolution, Stereo speakers with Dolby Audio-enhanced sound
- Operating System: Windows 10 Home, Intel Iris Plus Graphics
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
