Manage and report on Defender Antivirus Signature update versions through Microsoft Endpoint Manager

Microsoft Endpoint Manager provides a ton of functionality for managing Defender Antivirus. In a previous post we dived into configuring Defender Antivirus, so today we’ll be reviewing some of the specifics around Signature updates. Maybe your organization needs to quickly verify or update the signature version across all devices – if so, you’ve come to the right place!

Signature update configuration

As always, head over to the Microsoft Endpoint Manager admin center. If you’ve configured your devices to receive Defender Antivirus policy from MEM (as opposed to Group Policy or Configuration Manager), you can go to:

Endpoint security > Antivirus > select your antivirus policy

Antivirus policies in Microsoft Endpoint Manager

Once you’ve selected your policy, click Properties and under Configuration settings > Updates, you’ll see the Signature update settings you have in place:

Defender AV Policy properties

If you need to update a setting, click Edit next to Configuration settings.

Quick note: notice the “Internal definition update server” option under “Define the order of sources for downloading definition updates.” Are you wondering how to set the internal definition update server location? As far as I can tell, you can’t set the internal definition update server via Microsoft Endpoint Manager. The internal definition update server option is referencing the group policy setting Specify Intranet Microsoft Update Service Location, which is set either via Group Policy for WSUS deployments or using the Configuration Manager agent. So this option would really only be used for hybrid Azure AD joined or co-managed devices using an on-premises update platform.

If you haven’t configured this policy before, check out our previous Defender Antivirus blog post! Head over to: Configure Microsoft Defender Antivirus with Intune – Device Advice

Signature update manual sync

If you want a device to check in sooner than it’s update interval, you can manually push a signature update check via the Microsoft Endpoint Manager admin center. Go to:

Devices > All devices > select the device you’d like to update

All devices view

Then in the overview pane, click the overflow icon and select Update Windows Defender security intelligence:

Update Windows Defender security intelligence

And click Yes to confirm:

Signature update confirmation

In a few seconds, you’ll see it checking for updates on the client itself:

Signature update check

Signature update reporting

Need to create a report of all the Signature versions within the organization? No problem! In the Microsoft Endpoint Manager admin center, go to:

Reports > Microsoft Defender Antivirus (Preview) > Antivirus agent status:

Reports in Microsoft Endpoint Manager

Even if you’ve never run this report, click Generate again:

Defender Antivirus agent status

And that’s it! Even if you have thousands of devices, the report should only take minutes. It will even be able to report on Defender Signature version even if the AV policy isn’t managed by Microsoft Endpoint Manager.

Defender Signature version report

Happy reporting! ?

You may also like...

1 Response

  1. Krishna says:

    nice write-up.

Leave a Reply

Your email address will not be published. Required fields are marked *