iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft Intune’s Detected malware report shows the malware state of devices reported through the Microsoft Defender integration. Use it for an organization-wide view, then use Intune’s Active malware data or Microsoft Graph when you need a threat name, severity, execution state, detection count, or timestamps for a particular device. Device totals, detection events, and distinct malware names are different measures, so a count is meaningful only when you identify the report surface and its time window.
What the Detected malware report tells you
The report is an organizational summary built from details available through the Defender CSP (configuration service provider). Microsoft describes it as providing “the malware state of your organization’s devices.” It is useful for answering questions such as how many devices are represented in each malware state and whether detections are concentrated in a particular severity, category, operating-system version, or threat name.
The report is not a single incident record and it is not a universal real-time malware counter. Its totals depend on the data returned by the Defender integration and on when you generated the report. For device-level investigation, you need the underlying malware-state records rather than only the summary chart.
How to open and generate the report in Intune
- Sign in to the Microsoft Intune admin center with an account that can view reports.
- Open Reports > Microsoft Defender Antivirus.
- Select the Reports tab and choose Detected malware.
- Select Generate report. If a report has already been created, choose Generate again to retrieve a new result set.
Microsoft’s report documentation explains the workflow and the report’s Defender CSP data source at Microsoft Intune Reports. The portal labels can change as the cloud service evolves, so use the current navigation shown in your tenant if a label is slightly different.
#1 Best Overall
After generation, the report supports filtering, searching, paging, and sorting. Those controls let you narrow the organization-wide result before exporting or inspecting records, but they do not change the definitions of the underlying counts.
What appears in the organizational view
Device state distribution
The report includes a pie chart showing the count of devices in each malware state. This is a device-oriented view: one device can have more than one detection, but it is still represented as a device in the state distribution. Treat the chart as a status overview, not as the number of malware files or incidents.
Searchable and sortable report rows
Filtering and sorting help you isolate a state, operating-system version, severity, or other available dimension. If you need the actual threat name and the dates associated with a device’s state changes, use the detailed malware-state data described below; the organizational chart alone is not designed to expose every per-threat field.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How to read the malware counts
Microsoft Graph’s windowsMalwareOverview resource separates three figures that are often incorrectly called “the malware count.” The definitions are:
Rank #2
| Graph measure | What it measures | How to use it |
|---|---|---|
malwareDetectedDeviceCount |
Devices with malware detected in the last 30 days. | Use it for a recent affected-device count. It is not the number of detections. |
totalMalwareCount |
All malware detections across devices. | Use it to quantify detection events or records, including multiple detections on one device. |
totalDistinctMalwareCount |
Distinct malware across devices. | Use it to understand how many different malware identities are represented, not how many devices are affected. |
The same overview resource also provides summary collections for malware state, active severity, execution state, category, malware name, and operating-system version. These collections add context to the totals but do not turn the three measures into interchangeable values. The complete field definitions are in Microsoft Graph’s windowsMalwareOverview documentation.
For example, one device with three detections can increase the device count by one while increasing the total-malware count by three. If two devices report the same threat, the distinct-malware count can remain one even though the device and detection totals both rise. Always label a dashboard or ticket with the measure you used.
Finding the threat name and device-level state
The Graph windowsDeviceMalwareState resource represents malware state for an individual device and threat record. Its documented fields include:
- Display name: the human-readable threat name shown for the record.
- Severity: the severity assigned to the malware state.
- Execution state: information about whether the threat was executed or otherwise associated with execution.
- State and threat state: status fields describing the malware condition and its handling state.
- Initial detection date and time: when the threat was first detected for that record.
- Last state-change date and time: when the recorded state most recently changed.
- Detection count: how many detections are associated with that device-level record.
- Category: the malware category supplied by the service.
- Additional-information URL: a link supplied with the record for more context.
These are per-device details, whereas windowsMalwareOverview is a tenant-level summary. Consult the field list and permissions in the windowsDeviceMalwareState resource documentation when building an export or an automated investigation workflow.
Why the Defender portal may not show the malware name
Administrators sometimes open the Defender portal’s Devices with malware detections view and see a device but no malware name. Microsoft’s documented workaround is to use Intune: open Antivirus > Active malware, then inspect the Malware name column. That view is intended to expose the active threat identity that is missing from the portal list in this situation.
Do not infer that a blank name means the device is clean. It means that the particular portal view has not supplied the name in the displayed record. Verify the device in Intune’s Active malware data or retrieve the device-level state through Graph before closing an investigation.
Why Intune and Defender counts differ
Different Microsoft views use different populations, date windows, and measures. Microsoft documents the following distinctions:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Surface | Population and window | Primary purpose | Typical detail |
|---|---|---|---|
| Intune Detected malware report | Organizational report based on Defender CSP data; the reviewed documentation does not specify a guaranteed fixed refresh interval. | Organization-wide malware-state summary. | Device-state distribution, searchable and sortable report data. |
| Intune Active malware | Active-malware records available in Intune; the exact display population depends on the current service data. | Inspect current active threats and their names. | Includes a Malware name column for investigation. |
| Defender portal Devices with malware detections | Devices active in the last 24 hours that had detections in the last 15 days. | Defender-focused device detection view. | Can omit a malware name in the displayed view. |
Graph windowsMalwareOverview |
malwareDetectedDeviceCount covers detections in the last 30 days; other totals follow their documented aggregate definitions. |
Programmatic tenant-level counts and summaries. | Counts and collections by state, severity, category, name, and OS version. |
The Defender time filters are documented in Microsoft’s review-detected-threats guidance. Because one view requires device activity in the last 24 hours and detections in the last 15 days, while the Graph device count uses a 30-day detection window, the totals can legitimately disagree. A report generated at a different time can also contain a different set of service data.
Rank #4
A practical method for reconciling a discrepancy
- Name the source. Record whether the number came from Intune Detected malware, Intune Active malware, the Defender portal, or Graph.
- Write down the measure. Specify devices, all detection records, or distinct malware names. Do not call all three “detections.”
- Record the window. Note the 30-day Graph device window or the Defender portal’s 24-hour active-device and 15-day detection conditions when those apply.
- Regenerate the Intune report. Use Generate again and record the time, since the service does not promise a universal refresh interval for this report.
- Check the device-level record. Use Antivirus > Active malware for the malware name, then review severity, state, detection count, and timestamps in the device-level data when needed.
- Compare like with like. A device count should be compared with another device count, not with total detection events or distinct threat identities.
This process prevents a normal scope difference from being mistaken for missing telemetry. It also leaves an audit trail showing which report definition supported the number used in an incident or compliance report.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Data source, licensing, and freshness limits
Defender integration
Intune’s organizational report relies on information made available by the Defender CSP. If the endpoint is not reporting the expected state through that integration, the Intune report cannot add details that the source has not supplied. The report should therefore be interpreted as integrated Defender telemetry presented by Intune, not as an independent malware scanner.
Intune entitlement
Microsoft Graph’s Intune malware overview requires an active Intune license for the tenant. Intune itself requires a subscription that includes Intune or a standalone subscription or add-on; the exact entitlement and price depend on the tenant’s agreement. Microsoft’s endpoint-security overview describes the broader licensing context at Endpoint security in Microsoft Intune.
Recommended Free Tools
Refresh expectations
Microsoft documents the generate and regenerate workflow but does not provide a guaranteed refresh interval for the organizational Detected malware report in the referenced guidance. For time-sensitive response, record when the report was generated and corroborate the result with the current Active malware or Defender data instead of promising real-time accuracy.
Common interpretation mistakes
- Equating devices with detections: one device can produce several detection records.
- Equating distinct threats with total threats: repeated reports of one malware identity do not create additional distinct names.
- Mixing report windows: a 15-day Defender view and a 30-day Graph device count answer different questions.
- Assuming a missing name means no threat: check Intune Active malware or the device-level resource.
- Ignoring report generation time: a newly generated report and an older saved result may not contain the same service data.
- Using a summary chart for incident detail: retrieve severity, execution state, timestamps, category, and detection count from the device-level record.
Using the report in an investigation or dashboard
For a management dashboard, present the device count, total detection count, and distinct malware count as separate tiles with their definitions and windows. Add the report-generation time and source name beside each tile. For an analyst queue, include the device identifier, display name, severity, state, execution state, initial detection time, last state-change time, category, and detection count so that a reviewer can distinguish a new event from a persistent state.
When an alert is escalated, preserve the original source and window in the case notes. A later comparison is only meaningful if the next analyst knows whether the first number came from Intune’s organizational report, Active malware, Defender’s filtered device view, or Graph.
Bottom line
Use Intune’s Detected malware report for an organization-wide device-state picture, Intune Active malware to recover a missing threat name, and Microsoft Graph malware resources for precise aggregate and per-device fields. Explain every number with its measure, source, and time window; that is the key to interpreting malware status accurately across Microsoft’s reporting surfaces.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
