'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Defender for Endpoint Tables Missing in Advanced Hunting
Question details
The user is unable to view Microsoft Defender for Endpoint schemas, such as DeviceProcessEvents and DeviceNetworkEvents, in the Advanced Hunting interface.
- Product
- Microsoft Defender for Endpoint
- Device & OS
- not provided
- Scenario
- Querying endpoint security data in the Microsoft 365 Defender portal using Advanced Hunting.
- Observed behavior
- Specific endpoint schemas are missing or not generating data in the portal despite the devices being onboarded via Intune.
Ensure you have the appropriate security administrator or global administrator rights in the Microsoft 365 Defender portal to verify role-based access settings and licensing.
Verify Defender Licensing and Role Permissions
Missing Advanced Hunting tables are frequently caused by insufficient licensing or incorrect Role-Based Access Control (RBAC) permissions.
Advanced Hunting capabilities and detailed endpoint telemetry schemas are only available with Microsoft Defender for Endpoint Plan 2 or comprehensive E5 licenses. Plan 1 does not include these advanced features.
Log in to the Microsoft 365 admin center, navigate to 'Billing' > 'Licenses', and verify that your organization holds active Defender for Endpoint Plan 2 or Microsoft 365 E5 licenses.
Open the Microsoft 365 Defender portal and navigate to 'Settings' > 'Endpoints' > 'Roles'.
Select the role assigned to your user account and ensure that the 'View Data' and 'Advanced Hunting' permissions are explicitly enabled.
Check Device Onboarding Status and Sensor Health
If devices are not communicating correctly with the Microsoft service, their telemetry will not populate the Advanced Hunting tables.
Open a Microsoft Support Request
If licensing, permissions, and device health are verified but schemas remain unavailable, contact Microsoft for backend investigation.
Looking for a Lightweight Alternative to Microsoft Office?
While troubleshooting Microsoft enterprise security configurations, you may also be looking for ways to streamline your organization's document management. WPS Office is a highly compatible, free, and lightweight alternative to Microsoft Office that easily handles your enterprise documents, spreadsheets, and presentations.
- 1. Visit the Official Website: Go to the official WPS Office website to access the free download page.
- 2. Download the Installer: Click the 'Free Download' button to get the setup file tailored for your operating system.
- 3. Install and Edit: Follow the simple on-screen instructions to install WPS Office and seamlessly open your Microsoft Office documents.
Frequently Asked Questions
Why are DeviceNetworkEvents missing in Advanced Hunting?
These event schemas require a Microsoft Defender for Endpoint Plan 2 license. If your organization only holds Plan 1, advanced hunting capabilities and specific endpoint telemetry schemas will not be available in the portal.
Does a third-party antivirus affect Defender for Endpoint telemetry?
Yes. If a third-party antivirus is running in active mode and the Defender AV is forced into passive or EDR block mode, it may interfere with the Defender sensor's ability to natively collect and report specific process and network events.
How long does it take for Advanced Hunting tables to populate after onboarding?
After successfully onboarding a device via Intune, it can take anywhere from a few hours up to 24 hours for complete telemetry data to populate the Advanced Hunting tables in the Defender portal.
Can I use Advanced Hunting without Global Admin rights?
Yes, but your user account must be assigned a custom role in Defender for Endpoint with 'View Data' and 'Advanced Hunting' permissions enabled through Role-Based Access Control (RBAC).
