How to find devices running DfE via MMA

Tilman Schmidt 270 Reputation points
2026-10-07T12:55:33.9233333+00:00

When I log into the Defender Portal I am greeted with a yellow warning banner:

User's image

I am not aware that we ever installed MMA anywhere.

How can I find out which devices the banner is referring to?

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rauh, Alexander 160 Reputation points
    2026-10-07T20:50:38.16+00:00

    Hello Tilman,

    The banner doesn't necessarily mean you have MMA devices. I get the exact same banner in two test tenants: one with no onboarded devices and one with only Windows 11 devices.

    Only Windows 8.1, and Windows 7 SP1, Server 2008 R2, 2012 R2 or 2016 that haven't been moved to the new agent still use MMA. Windows 10 and 11 and Server 2019+ have the sensor built in, you can read it here.

    With Defender for Endpoint Plan 2 (or E5) the recommendation "Update Microsoft Defender for Endpoint core components" under Exposure management > Recommendations lists the 2012 R2 and 2016 servers that still need the move to the new agent.

    If this answer helped you please Accept the Answer so others find the Answer quicker :)

    Best regards

    Alex

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.