Features
Microsoft Defender dashboard features for lean teams
Checking Windows devices one by one hides detections, protection gaps, and the context your team needs.
Bring those signals into one tenant-scoped workspace for a more focused daily review.
Free account access. Email verification and an administrator-run PowerShell agent are required before endpoint data appears.
01 / Detections
Centralized Defender detections
- The pain
- Detections are scattered across individual PCs. Finding what happened means opening each device and piecing the evidence together.
- The solution
- Collect Microsoft Defender Antivirus detections in one workspace, with hostname, threat, severity, status, and timestamps when reported.
The result: Start with a shared detection view and follow the evidence back to the affected endpoint.
02 / Protection status
Endpoint posture visibility
- The pain
- A quiet detection list can hide disabled protection, old signatures, or a scan that has not run recently.
- The solution
- Review reported protection controls, signature versions and update times, and the latest quick and full scan timestamps alongside device activity.
The result: Identify endpoints that need a closer check, even when they have no recent detections.
03 / Daily review
Focused detection review
- The pain
- Older findings and low-severity events compete with fresh detections, making a long list difficult to work through.
- The solution
- Search detections by hostname and filter by severity, Defender status, and time range. Inspect the reported action and resource-path context.
The result: Narrow your review to the devices and findings that need attention first.
04 / Follow-up
An alert list for findings that need review
- The pain
- New detections or disabled protection can get lost between dashboard visits, leaving the next review without a clear starting point.
- The solution
- Use in-app alerts for newly collected detections and reported disabled antivirus or real-time protection. Filter open and closed alerts, and close items after review.
The result: Keep a visible list of open items for your next triage session.
05 / Device groups
Tags that make endpoint reviews manageable
- The pain
- A growing device list makes it harder to review a particular site, device role, or deployment group.
- The solution
- Apply tenant-scoped tags to individual devices or a bulk selection, then filter the Devices view by a tag.
The result: Work through a relevant group of endpoints without searching the entire device list.
06 / Built into Windows
Works with free Microsoft Defender
- The pain
- Defender is already on your Windows endpoints, but local device views leave your team without a shared reporting workflow.
- The solution
- Collect available Defender Antivirus data with a configured PowerShell agent. DefenderReporter account access is free and does not require premium Defender licensing.
The result: Start reporting with the Defender data you already have.
Collected Evidence
See the details behind each reported endpoint
Device views show protection controls, Defender engine and signature versions, signature update time,
recent scan timestamps, agent version, and related detections. Detection views retain threat, severity,
status, action, time, hostname, and resource-path context when Defender reports those values.
Start collecting endpoint data
Create and verify your account, sign in, then download the installer that already contains your tenant configuration. Run it as Administrator on each Windows endpoint you want to report, and confirm the first check-in.
Endpoints require Windows, PowerShell, Task Scheduler, administrator access for installation, and HTTPS access to DefenderReporter.
Start Free Review Installation Requirements
