Microsoft Defender for Endpoint - Device Groups
MDE Device Groups
Query
//let OS = dynamic(["Windows10","Windows11"]);
DeviceInfo
| where TimeGenerated > ago(30d)
//| where OSPlatform has_any (OS)
| where OnboardingStatus == 'Onboarded'
| summarize arg_max(TimeGenerated,*) by DeviceId
| summarize DeviceCount = count() by OSPlatform, MachineGroup
| evaluate pivot(MachineGroup, sum(DeviceCount))
| order by OSPlatform ascAbout this query
Explanation
This KQL query set is designed to analyze and manage Windows 10 and Windows 11 devices within Microsoft Defender for Endpoint, specifically focusing on how these devices are grouped and identifying those that are unassigned. Here's a simple breakdown of what each part of the query does:
-
Total Devices by OS per Device Group:
- This query counts the number of devices by their operating system (OS) and device group over the past 30 days.
- It filters for devices that are onboarded and organizes the data into a pivot table, showing the count of devices for each OS platform within each device group.
- The results are sorted by OS platform.
-
Detailed List of Devices and Device Groups:
- This query provides a detailed list of devices, including their device group, OS platform, device name, and logged-on users.
- It focuses on onboarded devices from the last 30 days and sorts the results by device group, OS platform, and device name.
-
Device Group Overview with Count on Onboarding Status:
- This query summarizes the number of devices in each onboarding status (Onboarded, Can be onboarded, Unsupported, Insufficient info) for each device group.
- It calculates the total number of devices in each group by adding up all the statuses.
-
Detailed Device Information about Unassigned Onboarded Devices:
- This query lists detailed information about devices that are onboarded but remain in the "UnassignedGroup".
- It provides the timestamp, device ID, device name, machine group, and OS platform for these unassigned devices.
Overall, these queries help administrators identify and manage devices within Microsoft Defender for Endpoint, ensuring that devices are properly assigned to groups and highlighting any that are not.
Details
Alex Verboon
Released: December 19, 2025
Tables
Keywords
Operators