Why Microsoft Defender Antivirus Status Differs from Advanced Hunting AVMode
Question details
The user is experiencing a reporting discrepancy where Microsoft Defender device inventory shows the antivirus status as 'Not Supported' or 'Unknown,' while Advanced Hunting queries report it as 'Active' or 'Passive.'
- Product
- Microsoft Defender
- Device & OS
- not provided
- Scenario
- Reviewing endpoint security compliance and investigating antivirus status reporting discrepancies across different Microsoft Defender portals.
- Observed behavior
- Defender device inventory and Advanced Hunting AVMode display conflicting antivirus status reports for the exact same Device ID.
Before troubleshooting, ensure you have the necessary permissions to access both the Microsoft 365 Defender portal's device inventory and the Advanced Hunting query editor.
Analyze Data Sources and Verification Timestamps
Reconcile the differences by understanding how each reporting tool pulls data and checking for synchronization delays.
Device inventory and Advanced Hunting use different data sources, update schedules, and evaluation logic. Because they do not sync simultaneously, direct mapping often leads to perceived discrepancies. It is best to treat the inventory status and Advanced Hunting results as separate indicators rather than expecting a one-to-one match.
Export your Device Inventory list and your Advanced Hunting query results to CSV, ensuring you include the Device ID column in both.
Check the timestamp column in both reports to see if one data source was generated significantly earlier than the other, which can cause mismatched statuses.
Check the platform update version and security intelligence timestamp to determine if the endpoint is currently offline or pending a localized update check.
Review Configuration Assessment IDs
Investigate the specific security configuration assessment (TVM) IDs that dictate antivirus status evaluation.
Analyze Security Logs Effortlessly with WPS Office
When investigating system security and Microsoft Defender configurations, IT administrators often need to manage and merge complex data reports using functions like VLOOKUP on exported CSV logs. WPS Office provides a lightweight, highly compatible, and completely free alternative to Microsoft Office, perfect for analyzing large security logs in Spreadsheets.
- 1. Download and Install: Download WPS Office from the official website and follow the quick installation prompts.
- 2. Open Exported CSV Logs: Launch WPS Spreadsheet and open the CSV files exported from your Microsoft Defender portal.
- 3. Merge Data with VLOOKUP: Use the built-in VLOOKUP function to map the Device ID from the Advanced Hunting log to the Device Inventory log for easy comparison.
Frequently Asked Questions
Why does Microsoft Defender show my AV mode as 'Unknown'?
The 'Unknown' status typically appears when the device hasn't reported its health status to the Microsoft 365 Defender portal recently, or if there is a communication error with the Defender sensors on the endpoint.
Can I use VLOOKUP to merge Advanced Hunting and Device Inventory logs?
Yes, you can export both reports to CSV and use the Device ID column as your unique identifier to merge the datasets with VLOOKUP in a spreadsheet application like WPS Spreadsheet.
What do scid-2010 and scid-2011 refer to in Advanced Hunting?
These are specific Configuration IDs within the DeviceTvmSecureConfigurationAssessment table used to evaluate the security posture and Threat and Vulnerability Management (TVM) state of Microsoft Defender Antivirus on a device.
