Skip to content

machine.md

Latest commit

 

History

History
53 lines (49 loc) · 2.89 KB

machine.md

File metadata and controls

53 lines (49 loc) · 2.89 KB

title: Machine resource type description: Learn about the methods and properties of the Machine resource type in Microsoft Defender for Endpoint. ms.service: defender-endpoint ms.author: painbar author: paulinbar ms.localizationpriority: medium manager: bagol audience: ITPro ms.collection:

  • m365-security
  • tier3
  • must-keep ms.topic: reference ms.subservice: reference ms.custom: api search.appverid: met150 ms.date: 12/11/2025 appliesto:
    • Microsoft Defender for Endpoint
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Business

Machine resource type

[!INCLUDE Prerelease information]

Properties

Property Type Description
id String machine identity.
computerDnsName String machine fully qualified name.
firstSeen DateTimeOffset First date and time where the machine was observed by Microsoft Defender for Endpoint.
lastSeen DateTimeOffset Time and date of the last received full device report. A device typically sends a full report every 24 hours.
NOTE: This property doesn't correspond to the last seen value in the UI. It pertains to the last device update.
osPlatform String Operating system platform.
onboardingstatus String Status of machine onboarding. Possible values are: onboarded, CanBeOnboarded, Unsupported, and InsufficientInfo.
osProcessor String Operating system processor. Use osArchitecture property instead.
version String Operating system Version.
osBuild Nullable long Operating system build number.
lastIpAddress String Last IP on local NIC on the machine.
lastExternalIpAddress String Last IP through which the machine accessed the internet.
healthStatus Enum machine health status. Possible values are: Active, Inactive, ImpairedCommunication, NoSensorData, NoSensorDataImpairedCommunication, and Unknown.
rbacGroupName String Machine group Name.
rbacGroupId String Machine group ID.
riskScore Nullable Enum Risk score as evaluated by Microsoft Defender for Endpoint. Possible values are: None, Informational, Low, Medium, and High.
aadDeviceId Nullable representation Guid Microsoft Entra Device ID (when machine is Microsoft Entra joined).
machineTags String collection Set of machine tags.
exposureLevel Nullable Enum Exposure level as evaluated by Microsoft Defender for Endpoint. Possible values are: None, Low, Medium, and High.
deviceValue Nullable Enum The value of the device. Possible values are: Normal, Low, and High.
ipAddresses IpAddress collection Set of IpAddress objects. See Get machines API.
osArchitecture String Operating system architecture. Possible values are: 32-bit, 64-bit. Use this property instead of osProcessor.