Intune Four Antivirus Reports: Tenant Devices

Intune does not produce a single report called “four antivirus reports” that lists all tenant-attached devices. Instead, it offers several distinct antivirus and endpoint protection reports in the Microsoft Intune admin center, and the exact set you see depends on your licensing (Microsoft 365 Business Premium, E3, E5, or standalone Intune) and whether devices are enrolled as mobile device management (MDM) or mobile application management (MAM). The four most commonly referenced reports are the Antivirus report, the Windows Defender Firewall report, the Windows Exploit Guard report, and the Endpoint Analytics security report (or the older Antimalware and Security updates reports). This article explains what each report shows, how to access them, and how to interpret the data for tenant-attached devices.

Background: How Intune Antivirus Reporting Evolved

Intune’s antivirus reporting has changed significantly since the classic Microsoft Endpoint Manager console. Originally, administrators relied on the Antimalware and Security updates reports under the “Device compliance� section. Those reports showed the status of real-time protection, signature versions, and last scans for Windows 10/11 devices. In 2021, Microsoft consolidated these into a more modern set of reports under Endpoint security > Antivirus. The newer reports pull data from the Windows Security Center APIs via the Intune Management Extension and the Microsoft Defender for Endpoint (if you have that license).

For tenant-attached devices—meaning any device that has an Intune enrollment record, whether it is corporate-owned, bring-your-own-device (BYOD), or co-managed with Configuration Manager—the reports aggregate data from the device’s Windows Security Center. If a device is not actively checking in, it will appear as “Pending� or “Unknown� in the reports. That is a common source of confusion: the report does not show real-time status; it shows the last known state from the device’s last check-in.

How to Access the Four Antivirus Reports

All four reports are in the Microsoft Intune admin center (intune.microsoft.com) under Endpoint security > Antivirus. The exact tabs may vary slightly based on your tenant’s configuration, but you will typically see:

Antivirus – Shows the status of Windows Defender antivirus (or third-party antivirus if you use a security extension) for each device: real-time protection, signature version, last scan, and threat count.
Windows Defender Firewall – Displays firewall status and profile settings (Domain, Private, Public) for each device.
Windows Exploit Guard – Reports the state of exploit protection settings, including ASLR, DEP, and Control Flow Guard.
Endpoint Analytics security – (Under Reports > Endpoint analytics) Shows a security score based on antivirus status, OS updates, and other security baselines. This is not strictly an antivirus report but is often grouped with the others because it includes antivirus health.

If you have Microsoft Defender for Endpoint (MDE) licenses, you will also see a Defender Antivirus report under the MDE portal, but that is separate from Intune’s native reports. The four reports above are the ones you see directly in Intune without additional licensing.

What Each Report Actually Measures

Each report uses a different data source and shows different fields. Understanding what each column means is critical to avoiding false alarms.

Antivirus report: Columns include Device name, Antivirus status (e.g., “Enabled�, “Disabled�, “Unknown�), Signature version, Real-time protection, Last full scan, Last quick scan, and Threat count. The status is based on the Windows Security Center’s health report, which updates every 24 hours or on demand.
Firewall report: Shows Firewall status (On/Off), Profile (Domain, Private, Public), and Last update. It does not show firewall rules.
Exploit Guard report: Lists each device and whether exploit protection is Enabled, Disabled, or Not applicable. It also shows the number of rules that are active.
Endpoint Analytics security: Gives a score from 0 to 100 based on the percentage of devices that have up-to-date signatures, real-time protection enabled, and no active threats. It also includes OS update compliance.

How to Read the Results and Spot Problems

The most common issue is seeing “Unknown� or “Pending� status. That means the device has not checked in recently. Intune devices check in every 8 hours by default, but the antivirus health data is refreshed only when the device runs a scheduled scan or when the Intune Management Extension pushes a policy. If a device is offline for more than 30 days, it will show as “Inactive� and may be removed from the report.

Another common problem is a device showing “Enabled� but with an old signature version. That can happen if the device is not connected to the internet or if the Windows Update service is disabled. The report will show the signature version (e.g., 1.377.1234.0), but it does not tell you if that version is current. You need to compare it to the latest version published by Microsoft. If you see a threat count greater than zero, that does not mean the device is infected; it means Windows Defender has detected and quarantined a threat. The report does not show the threat name—you need to go to the device’s local Windows Security app for that.

Common Problems and How to Fix Them

If a device does not appear in any of the four reports, it is likely not enrolled correctly. Check the device’s enrollment status under Devices > All devices. If it shows “Enrolled� but the antivirus reports are empty, try the following:

Ensure the device is running Windows 10 1903 or later (or Windows 11). Older versions may not report antivirus data.
Verify the Intune Management Extension is installed. You can check in the device’s local registry under HKLM\SOFTWARE\Microsoft\Intune\ManagementExtension.
Run a manual sync from the device: Settings > Accounts > Access work or school > select your account > Info > Sync.
Check if the device is co-managed with Configuration Manager. If you have co-management, the antivirus workload must be set to “Intune� or “Pilot Intune� for the reports to populate.
If the device is a Windows Server, it may not support all four reports. Server OS is supported for antivirus but not for Exploit Guard in some versions.

How to Choose Which Report to Use

Your choice depends on what you need to know:

If you want a quick health check, use the Antivirus report to see if real-time protection is on and signatures are recent.
If you are troubleshooting a firewall issue, use the Firewall report to see if the firewall is off on a specific device.
If you are checking security baselines, use the Exploit Guard report to confirm that exploit protection settings are applied.
If you want an overall security posture score, use Endpoint Analytics security. This is the only one that gives a numeric score, which is useful for executive reporting.

Costs and Licensing Considerations

The four reports themselves are free with any Intune license. However, the data source differs: the Antivirus, Firewall, and Exploit Guard reports work with Microsoft Defender Antivirus, which is built into Windows 10/11. If you are using a third-party antivirus, you need to integrate it via the Intune Security Extensions, which may require a separate license. Endpoint Analytics is included with Intune, but some features (like the security score) require Microsoft 365 E3 or E5. There is no extra cost for the reports themselves, but you must have an active Intune license for each device that you want to report on.

Alternatives and Additional Tools

If the four built-in reports are not enough, you can use the Microsoft Graph API to pull antivirus data into your own dashboards. The deviceManagement/deviceCompliancePolicies endpoint includes antivirus status. You can also export the reports to CSV from the admin center. For more advanced threat hunting, you would use Microsoft Defender for Endpoint, which provides real-time threat analytics, but that is a separate product with its own licensing.

Frequently Asked Questions

Why does my antivirus report show “Unknown� for some devices?

“Unknown� means the device has not sent antivirus health data to Intune in the last 24 hours. This typically happens when the device is offline, has not had the Intune Management Extension installed, or is running an older Windows version. Check the device’s last check-in time under Devices > All devices. If it is older than 24 hours, the device is likely offline.

Can I see antivirus reports for devices that are not enrolled in Intune?

No. The four reports only include devices that have an active Intune enrollment. If you have devices that are Azure AD joined but not enrolled, they will not appear. You need to enroll them via MDM or use co-management with Configuration Manager to see them.

Do the reports show real-time protection status for third-party antivirus?

Only if you have integrated the third-party antivirus with Intune using the Security Extensions. Without that integration, the reports will show “Not applicable� or “Unknown� for third-party AV. Microsoft Defender Antivirus is the only one that works out of the box.

How often does the antivirus report update?

The report refreshes every 24 hours. You can force a refresh by clicking the “Refresh� button in the report, but that only updates the data from Intune’s cache, not from the device. To get fresh data from the device, you must sync the device manually.

Why does the Endpoint Analytics security score not match my antivirus report?

The security score includes more than antivirus status—it also factors in OS updates, firewall, and other security settings. So a device with perfect antivirus status but missing OS updates will lower the score. The two reports measure different things.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →