Unified Defence System

Defender overview

Microsoft Defender health, policy, and detections across endpoints.

Healthy —

Warning / Critical —

RT protection off —

Stale signatures —

Agent overrides —

Detections (7d) —

Defender policy changes apply on the agent policy sync cycle (typically within ~60 seconds).

Defender policy

Organisation settings apply to all agents. Agent overrides merge on top for one machine only.

Baseline Defender configuration for the whole organisation.

Defender clients

Live Defender state from agents. Click a row to focus that endpoint; use Details for scans, quarantine, and response tasks.

	Endpoint	Health	Realtime	Defender	Signatures	Updated	Detections (7d)

Rows per page

Recent Defender alerts

Recent threat events. Click a row to focus the endpoint; use inline actions for quick response.

No Defender alerts found.

Time	Endpoint	Threat	File path	Action	Message	Actions

Rows per page

No response tasks yet.

Requested	Action	Status	Progress	Findings	Message

Live threats Defender is tracking on this endpoint.

No active or quarantined threats reported by Defender.

Detected	Threat	Resource	Status	Actions

Items reported when a quick/full scan job completes.

No threat detections recorded from scan jobs yet.

Detected at	Threat	File path	Action success	Actions

No Defender events found.

Time	Threat	File path	Event ID	Action	Message

These are recent Defender threat detections on the endpoint, not necessarily newly found during this scan.

No threat detections were reported when this scan completed.

Detected at	Threat	File path	Action success	Actions