"0 Servers" Displayed Under Defender for Servers Plan 1

Dear @Yashaswini Mahadeva (CP, IN)

The key point is that Microsoft Defender for Endpoint onboarding and Defender for Servers coverage are two separate concepts.

Microsoft Defender for Endpoint can be deployed in different licensing scenarios. A server may be onboarded using a standalone Microsoft Defender for Endpoint license, or it may be protected through Microsoft Defender for Cloud with Defender for Servers.

Therefore, successful MDE onboarding does not, by itself, mean that the server will be counted under the Defender for Servers Plan 1 server count.

If the servers were onboarded directly to MDE using a standalone MDE entitlement, they can be fully operational and visible in the MDE portal without necessarily being included in the Defender for Servers Plan 1 count.

If these servers are expected to be counted under Defender for Servers Plan 1, I would recommend verifying the following:

1. Defender for Servers Plan 1 is enabled for the relevant Azure subscription.
2. The servers are visible in Defender for Cloud → Inventory.
3. The servers are associated with the Azure subscription/resource scope where Defender for Servers is enabled.
4. Defender for Servers provisioning is enabled for the relevant resources.
5. Sufficient time has passed for Defender for Cloud inventory and licensing information to synchronize.

The first thing to establish is therefore how the servers were onboarded and under which licensing model they are covered. Once this is confirmed, it should be clear whether they are expected to appear in the Defender for Servers Plan 1 server count.

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

@Yashaswini Mahadeva (CP, IN) Apologies for the delayed response.

We confirmed that successful onboarding to Microsoft Defender for Endpoint and the server count displayed in Microsoft Defender for Cloud represent two different stages of processing.

Successful MDE onboarding confirms that the Defender for Endpoint sensor registered with the service and is reporting telemetry. The Server – Defender for Endpoint count in Defender for Cloud is populated separately through the Direct Onboarding and Defender Vulnerability Management inventory pipeline.

For non-Azure servers onboarded directly through MDE, Defender for Cloud must associate the server with the subscription selected under Defender for Cloud > Environment settings > Direct onboarding. Microsoft advises that this synchronization can take up to 24 hours.

Please complete the following checks:

1. In the Microsoft Defender portal, open Assets > Devices and confirm that the affected servers show:

• Onboarding status: Onboarded

• Sensor health: Active

• A recent Last seen timestamp

2. In Microsoft Defender for Cloud, go to Environment settings > Direct onboarding and verify that Direct Onboarding is enabled and that the expected subscription is selected.
3. Confirm that Defender for Servers Plan 1 or Plan 2 is enabled on that subscription.
4. Allow up to 24 hours after enabling Direct Onboarding or onboarding the servers.
5. If the count remains zero after 24 hours, run the following Azure Resource Graph query against the designated subscription:

securityresources

| where type =~ "microsoft.security/assessments"

| where name == "44d12760-2cf2-4e6d-8613-8451c11c1abc"

| summarize MdeMachineCount = count() by subscriptionId

If this query also returns zero while the devices remain active in MDE, the servers have not reached the Defender for Cloud inventory-assessment pipeline. Microsoft Support will need the tenant ID, designated subscription ID, affected MDE device IDs, onboarding timestamps, sensor health/last-seen values, and confirmation of whether the machines were previously connected through Azure Arc.

If the machines were migrated from Azure Arc to Direct Onboarding, please mention this when opening the support request, because a retained Azure resource identity can prevent the machines from being classified as directly onboarded resources.

Microsoft Learn references

1. Connect your non-Azure servers to Microsoft Defender for Cloud with Defender for Endpoint

Documents Direct Onboarding, the designated subscription, required permissions, supported plans, and the up to 24-hour inventory delay.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/onboard-machines-with-defender-for-endpoint

2. Defender for Endpoint/Defender Vulnerability Management integration

Explains that Defender for Cloud resource discovery and MDE onboarding are separate processes, along with inventory and agent-health behavior.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint

3. Explore devices in the device inventory

Documents onboarding status, sensor health, device counts, filters, and inventory behavior.

https://learn.microsoft.com/en-us/defender-endpoint/machines-view-overview

4. Check service health at Microsoft Defender for Endpoint

Explains Active, Inactive, Misconfigured, No sensor data, and Impaired communications states.

https://learn.microsoft.com/en-us/defender-endpoint/check-sensor-status

Let me know if you have any further questions or if this response is not helpful/issue still persists, feel free to share your details via private message option, so that we can connect offline.