Get-DefenderEndpointOnboardingReport

<#
.SYNOPSIS
    Finds Intune managed devices not onboarded to Defender for Endpoint.

.DESCRIPTION
    Compares Intune managed device inventory against devices reporting
    into Defender for Endpoint, flagging any device that is enrolled and
    managed but not actually sending endpoint security telemetry.

.EXAMPLE
    .\Get-DefenderEndpointOnboardingReport.ps1

.NOTES
    Requires Microsoft.Graph.DeviceManagement and
    Microsoft.Graph.Security with an active Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$managedDevices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" -All
$defenderDevices = Get-MgSecurityDeviceMachine -All -ErrorAction SilentlyContinue

$defenderNames = $defenderDevices.ComputerDnsName

$notOnboarded = $managedDevices | Where-Object { $_.DeviceName -notin $defenderNames }

$notOnboarded | Select-Object DeviceName, UserPrincipalName, LastSyncDateTime | Format-Table -AutoSize
Write-Warning "$($notOnboarded.Count) of $($managedDevices.Count) managed Windows device(s) are not reporting into Defender for Endpoint."