Endpoint DLP onboarding: fixing Windows devices that show Not updated or Not available

Endpoint DLP can only protect a Windows device that is onboarded, healthy and holding the current policy. When one of those is missing, the device list in Microsoft Purview says so in two small columns that are easy to misread. In this post I'll explain how onboarding works, what Not updated and Not available really mean, how to fix the usual causes, and how to prove a device is ready.

Symptoms#

• The device isn't in Settings › Device onboarding › Devices in the Microsoft Purview portal, or it is listed with one of these values:

Configuration status: Not updated
Configuration status: Not available
Policy sync status: Not updated
Policy sync status: Not available

• Activity explorer shows no endpoint events for the device, and copying a matching test file to USB triggers nothing.
• In advanced hunting, the device's DlpInfo data shows "IsDlpConfigurationValid": false, "IsDefenderRealTimeProtectionEnabled": false or "IsDefenderBehaviorMonitoringEnabled": false.

Why it happens#

Device onboarding is shared between Microsoft Purview and Microsoft Defender for Endpoint. A device onboarded to Defender for Endpoint appears in the Purview list without extra steps, and onboarding from Purview also onboards it to Defender for Endpoint. The two status columns then measure different things:

The usual root causes:

• Defender prerequisites. The anti-malware client must be 4.18.2110 or newer, and versions older than N-2 lose support when new ones ship. Microsoft's requirement is that Windows Security components don't need to be active, but real-time protection and behavior monitoring must be enabled. A configuration that turns them off, for example alongside another antivirus product, leaves the device Not updated.
• Unsupported OS or join state. Supported builds include Windows 10 22H2 and Windows 11 21H2 through 24H2 with the required updates, plus Windows Server 2019 and 2022. Devices must be Microsoft Entra joined, hybrid joined or registered.
• Connectivity. A proxy that doesn't let the device reach the cloud DLP service, or a firewall, antivirus or application control product that blocks MpDlpService.exe.
• No policy, or offline. Without an endpoint DLP policy, policy sync shows Not available. Devices must be online to receive updates, and the list can take up to 2 hours to refresh.
• Servers. Endpoint DLP isn't enabled for onboarded Windows servers by default; you must turn on endpoint DLP support for servers first.

How to fix it#

1. Turn on device onboarding#

In the Purview portal go to Settings › Device onboarding › Devices and choose Turn on device onboarding. It usually takes about 60 seconds; Microsoft says to allow up to 30 minutes before contacting support. Device management accepts Microsoft Entra roles only (Security Administrator, Compliance Administrator or Global Administrator), not Purview role groups.

2. Onboard the devices that aren't listed#

Devices already in Defender for Endpoint need nothing more. For the rest, choose Onboarding, pick a deployment method (Intune, Configuration Manager, Group Policy, local script or VDI) and download the package. With Intune, onboarding through Defender for Endpoint covers both products; see onboarding Windows devices to Defender for Endpoint with Intune. If onboarding itself fails, use Defender for Endpoint onboarding failures and SENSE event IDs, and on Windows 11 24H2 check the missing Sense client issue.

3. Check Defender and join state on the device#

Get-MpComputerStatus |
  Select-Object AMProductVersion, AMEngineVersion, AMRunningMode,
                RealTimeProtectionEnabled, BehaviorMonitorEnabled
dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|WorkplaceJoined"

Good looks like AMProductVersion at 4.18.2110 or later (and current), both protection values True, and the device Entra joined, hybrid joined or registered. Update the platform through Windows Update (KB4052623) and fix whichever Intune, Group Policy or third-party setting disables real-time protection or behavior monitoring.

4. Fix connectivity#

Configure the device proxy as described in Microsoft's endpoint DLP proxy guidance and allow MpDlpService.exe through firewalls, third-party antivirus and application control. If you route Defender traffic through a proxy, streamlined connectivity for Defender for Endpoint helps you validate it.

5. Give the device a policy and a valid user#

Create at least one DLP policy with the Devices location, even in audit mode. The device details pane shows Valid user, which tells you whether the signed-in user has a Microsoft Entra account and is in scope of a device policy. If you scope a policy by users and devices, explicitly exclude users or devices that don't meet the requirements to avoid unintended enforcement.

6. Wait for the device, then read the details pane#

Select the device to see Last seen, Last policy sync time, Defender engine version and Endpoint DLP status, plus the remediation steps Purview suggests. If the status doesn't move, check Last seen: an offline device can't sync. Still stuck? Record the OS, Defender engine and client versions, MDATP device ID and Valid user value, run the Defender for Endpoint client analyzer, and open a support case.

Verify the fix#

Both columns should show Updated. To check every device at once, run this in the Microsoft Defender portal under Investigation & response › Hunting › Advanced hunting:

DeviceInfo
| where DlpInfo != ""
| summarize arg_max(Timestamp, *) by DeviceId
| extend Dlp = parse_json(DlpInfo)
| where tobool(Dlp.IsDlpConfigurationValid) == false
    or tobool(Dlp.IsDefenderRealTimeProtectionEnabled) == false
    or tobool(Dlp.IsDefenderBehaviorMonitoringEnabled) == false
| project DeviceName, Timestamp, Dlp

An empty result means every reporting device is healthy. Then copy a dummy sensitive file to a USB drive on a pilot device and confirm the event under the Endpoint DLP activities filter set in Activity explorer.

Prevent it next time#

• Keep the Defender platform current; versions older than N-2 lose support, and newer endpoint DLP features need newer clients.
• Run the hunting query regularly, or feed DlpInfo into your own dashboard.
• Devices stay in the list for 180 days after they go offline, so check Last seen before chasing a stale entry.
• Once devices are healthy, configure endpoint DLP settings for USB, printers and cloud uploads, and for Macs see endpoint DLP on macOS.

References#

• Onboard Windows devices into Microsoft 365 overview (Microsoft Learn)
• Troubleshooting endpoint DLP configuration and policy sync (Microsoft Learn)
• Get started with endpoint data loss prevention (Microsoft Learn)