Windows-CustomCompliance-MDE-Onboardingstate.md

Microsoft Intune - Custom Compliance - Defender for Endpoint - Onboarding State

Check the following registry key to check whether a device is onboarded in Microsoft Defender for Endpoint:

HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status\OnboardingState

Value	Onboardingsate
0 (default)	Not onboarded
1	Onboarded

• WindowsAdvancedThreatProtection CSP
• Configure Microsoft Defender for Endpoint in Intune

Intune Configuration Policy

Defender for Endpoint onboarding confgigration settings is configured within the Endpoint and response policy. Endpoint security | Endpoint detection and response

• Microsoft Defender for Endpoint client configuration package type

Intune Compliance Detection Script

Defender for Endpoint Onboarding State

Intune Compliance JSON

Defender for Endpoint Onbaording State Compliance Policy

For compliance the expected results are:

• OnboardingState:1

Check Compliance Results

Run the below command in PowerShell to check the compliance script results on the device.

# Trigger Intune Synch
Start-Process -FilePath "C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe" -ArgumentList intunemanagementextension://synccompliance

# Chck the logs
Get-Content -Path "c:\programdata\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log" | Select-String -Pattern '"OnboardingState":'
Get-Content -Path "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\HealthScripts.log" | Select-String -Pattern '"OnboardingState":'