windows-itpro-docs/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md

title, description, keywords, search.product, search.appverid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic, ms.date

title	description	keywords	search.product	search.appverid	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.author	author	ms.localizationpriority	manager	audience	ms.collection	ms.topic	ms.date
Check the health state of the sensor in Microsoft Defender ATP	Check the sensor health on machines to identify which ones are misconfigured, inactive, or are not reporting sensor data.	sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communications, communication	eADQiWindows 10XVcnh	met150	w10	deploy	library	security	macapara	mjcaparas	medium	dansimp	ITPro	M365-security-compliance	article	04/24/2018

Check sensor health state in Microsoft Defender ATP

Applies to:

• Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

Want to experience Microsoft Defender ATP? Sign up for a free trial.

The sensor health tile is found on the Security Operations dashboard. This tile provides information on the individual machine’s ability to provide sensor data and communicate with the Microsoft Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.

There are two status indicators on the tile that provide information on the number of machines that are not reporting properly to the service:

• Misconfigured - These machines might partially be reporting sensor data to the Microsoft Defender ATP service and might have configuration errors that need to be corrected.
• Inactive - Machines that have stopped reporting to the Microsoft Defender ATP service for more than seven days in the past month.

Clicking any of the groups directs you to Machines list, filtered according to your choice.

You can also download the entire list in CSV format using the Export to CSV feature. For more information on filters, see View and organize the Machines list.

You can filter the health state list by the following status:

• Active - Machines that are actively reporting to the Microsoft Defender ATP service.
• Misconfigured - These machines might partially be reporting sensor data to the Microsoft Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
  • No sensor data - Machines has stopped sending sensor data. Limited alerts can be triggered from the machine.
  • Impaired communications - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work.
• Inactive - Machines that have stopped reporting to the Microsoft Defender ATP service.

You can view the machine details when you click on a misconfigured or inactive machine.

In the Machines list, you can download a full list of all the machines in your organization in a CSV format.

Note

Export the list in CSV format to display the unfiltered data. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is.

Related topic

• Fix unhealthy sensors in Microsoft Defender ATP