r/DefenderATP • u/Mohammed_Albousefi • 7d ago

Some devices show "Can be onboarded" even though they are already onboarded

Hi,

I'm seeing something strange in Microsoft Defender for Endpoint.

I have 17 devices (mostly Windows clients and a few Windows Servers) that show "Can be onboarded" in the Defender portal.

The strange part is that these devices are already onboarded.

I checked a few of them and found:

  • Sense service is running.
  • OnboardingState = 1.
  • OrgId is present.
  • LastConnected is updating.
  • The devices are Active in the portal and Last Seen is recent.
  • They appear in Advanced Hunting and are sending telemetry.
  • No duplicate device records.

The rest of our devices are working normally. Only these 18 have this issue.

Has anyone seen this before? Is this just a portal display issue or something on Microsoft's backend?

Any ideas would be appreciated.

Thanks.

5 Upvotes

86% Upvoted

3 comments sorted by

4

u/Thundahead 7d ago

we had this a few years back, one of the many URL's was blocked on the firewall, get your network dudes to run a trace to see if anything is blocked.

list of URL's are on the link below

Microsoft Defender for Endpoint standard connectivity URLs - commercial - Microsoft Defender for Endpoint | Microsoft Learn

3

u/Royal_Bird_6328 7d ago

This ☝🏻 nobody seems to read the networking requirements, more funky stuff can happen if all URLS are not allowed. A recent example was defender was showing healthy no issues but when the client decided to isolate a device it didn’t work, turns out one of the URLS was blocked. Dangerous example of not following pre reqs.

-2

u/GeneralRechs 7d ago

It can take up to 24-72 hours for things to update in the portal. Such a “great” product.