Share via

Azure Arc-Enabled Windows Servers managed by MDE - AV Policies Stuck "Pending" for 5 days

SysTek 51 Reputation points
2025-03-25T14:49:10.61+00:00

We have about 45 Windows servers ranging from Server 2012 to Server 2025 added into Azure Arc. These servers are enrolled in MDE management, which is confirmed working. Our initial test deployment of 6 Windows VMs received all AV policies successfully.

On Thursday morning last week, we added the remaining 39 Windows server Intune objects to the Entra group assigned to the MDE AV policy and Attack Surface Reduction policy. All 39 of those VMs are still not receiving the policies, show no conflicts, and have the policy status as "pending" in Intune. I have ran the client analyzer tool on a selection of working and not working VMs and found the results to be identical. There were no errors shown in either test. Running Get-MpComputerStatus on working and non-working VMs also show the same results. The VMs have all checked in with Intune within the last 24 hours.

The VMs are also receiving the AV Exclusion policies and Security Experience policies without issue. This is only a problem with the AV policy and Attack Surface Reduction policies.

Any ideas as to what is happening or tests I can run?

Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
491 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Crystal-MSFT 53,821 Reputation points Microsoft External Staff
    2025-03-26T02:05:01.8366667+00:00

    @SysTek, Thanks for posting in Q&A. From your description, I know the 39 windows servers show pending status on AV policy and Attack Surface Reduction policy.

    Based on my checking this applies to Windows Server 2012 R2 and later. For Windows server 2912, it will affect. Please upgrade to the supported version.

    https://learn.microsoft.com/en-us/intune/intune-service/protect/mde-security-integration

    When a device receives a policy, the Defender for Endpoint components on the device enforce the policy and report on the device's status. For Pending status, it seems the device status isn't reported back from the device.

    Please ensure the following endpoint are allowed to access:

    • *.dm.microsoft.com - The use of a wildcard supports the cloud-service endpoints that are used for enrollment, check-in, and reporting, and which can change as the service scales.

    In addition, I find there's an issue where the AllowOnAccessProtection and DisableLocalAdminMerge settings might at times require end users to restart their devices for these settings to update. Please restart your affected device to see if the status will be changed.

    Please try the above suggestion to see if it can work.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.