Microsoft Defender for Endpoint Onboarding Script Fails: Troubleshooting Guide
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
When the MDE onboarding script runs without throwing an error but the device never appears in the Microsoft Defender portal, the failure is usually silent. The script copied a configuration file, but the Windows SENSE service either did not start or cannot reach the MDE cloud backend. This guide covers every common onboarding failure pattern: Sense service failures, proxy blocks, license gaps, wrong script version, and device-already-offboarded edge cases.
For configuring MDE policies after successful onboarding, see the Microsoft Defender for Endpoint Deployment and Hardening Guide. If the device is MDE-enrolled but showing high CPU usage, see the Microsoft Defender for Endpoint High CPU Troubleshooting Guide.
Causes of MDE Onboarding Script Failures
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Diagnosing the Failure
Start on the device, not the portal. The portal reflects the last state reported by the SENSE service and can lag or be blank if onboarding never completed.
Step 1: Check the onboarding registry key
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' `
-ErrorAction SilentlyContinue | Select-Object OnboardingState, OrgId
Expected: OnboardingState: 1 and a valid OrgId GUID matching your tenant. If this key is absent or OnboardingState: 0, the script did not write the configuration, or wrote it but Sense rejected it.
Step 2: Check the SENSE service state
Get-Service -Name Sense | Select-Object Name, Status, StartType
Expected: Status: Running. If Stopped, check why:
# Check the Windows event log for SENSE service errors
Get-WinEvent -LogName 'Microsoft-Windows-SENSE/Operational' -MaxEvents 20 `
| Select-Object TimeCreated, Id, Message | Format-List
Key event IDs:
- Event 1: SENSE service started
- Event 2: SENSE service stopped
- Event 5: Connected to cloud backend -- onboarding successful
- Event 10: SENSE service cannot connect to cloud -- proxy/network issue
- Event 15: Device offboarding initiated
- Event 84: Device successfully onboarded
- Event 25: SENSE service connectivity test failed
Step 3: Run the MDE connectivity test
Microsoft provides a PowerShell-based connectivity test script in the onboarding package as TestCloudConnection.cmd. Run it as administrator:
TestCloudConnection.cmd
The output shows each required URL and whether it is reachable. Any FAILED line identifies the specific blocked endpoint. For SSL-inspection proxies, the test may show SUCCESS but with an unexpected certificate chain, which SENSE will reject at runtime.
Step 4: Confirm the portal region matches the onboarding package
In the Microsoft Defender portal (security.microsoft.com), go to Settings > Endpoints > Advanced features and confirm the data storage region. Download the onboarding package specifically for that region. Using a Commercial package on a GCC tenant, or vice versa, produces a silent failure.
Step 5: Check the script output and Windows event log for errors
After running the onboarding script as administrator, check:
# Check the application event log for Sense-related errors
Get-WinEvent -LogName 'Application' `
| Where-Object {$_.ProviderName -like '*Sense*' -or $_.ProviderName -like '*WDATP*'} `
| Select-Object TimeCreated, Id, Message `
| Format-List
# Check Windows Defender Operational log
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 20 `
| Select-Object TimeCreated, Id, Message | Format-List
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Fixes by Root Cause
SENSE service not starting
If the service is stopped or in an error state:
# Start the SENSE service (requires administrator)
Start-Service -Name Sense
# If start fails, check dependencies
Get-Service -Name Sense | Select-Object -ExpandProperty DependentServices
# Verify Windows version meets minimum requirement
(Get-WmiObject Win32_OperatingSystem).Caption
# Must be Windows 10 1607+ or Windows Server 2016+
If the service fails to start with Access Denied errors, a third-party security product is likely blocking it. Temporarily stop the conflicting product, start Sense, then configure the conflicting product to exclude the Sense service from interference.
Proxy blocking MDE cloud endpoints
MDE requires direct HTTPS access or proxy access to these URL patterns (Commercial cloud):
*.endpoint.microsoft.com*.ods.opinsights.azure.com*.oms.opinsights.azure.com*.blob.core.windows.net*.wdcp.microsoft.com*.wdcpalt.microsoft.comevents.data.microsoft.comcrl.microsoft.com
Configure proxy bypass for all of these in your proxy. For SSL-inspection proxies, add these URLs to the SSL inspection bypass list -- MDE performs certificate pinning on its cloud connections and will reject connections with unexpected certificate chains.
To configure a static proxy for the SENSE service:
netsh winhttp set proxy proxy-server="http=<proxy_server>:<port>" bypass-list="<bypass_list>"
Alternatively, set a machine-wide proxy via Group Policy at Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage.
Wrong script version or cloud region
- In the Defender portal, go to Settings > Endpoints > Device management > Onboarding
- Select the correct operating system (Windows 10 and 11, or Windows Server 2019/2022, etc.)
- Download the onboarding package -- the filename includes the region identifier
- If your tenant is in GCC or GCC High, the portal URL will be security.microsoft.us (not .com) and the onboarding package must be downloaded from that portal
- Run the new package on the device; the registry key OrgId will update if the previous package wrote the wrong tenant ID
Device in offboarding cooling-off period
Check the registry for an offboarding state:
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' `
| Select-Object OnboardingState
# OnboardingState: 3 = offboarded
If offboarded, the device must wait 30 days or you must open a Microsoft support case to reset the offboarding state early. Document the case if the device needs to be re-onboarded urgently.
Validating Successful Onboarding
After applying a fix, verify onboarding from both the device and the portal.
On the device:
# Confirm OnboardingState is 1
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' `
| Select-Object OnboardingState
# Confirm SENSE service is running
Get-Service -Name Sense
# Check for Event ID 84 (successfully onboarded) or Event ID 5 (connected to cloud)
Get-WinEvent -LogName 'Microsoft-Windows-SENSE/Operational' `
| Where-Object {$_.Id -in (5, 84)} `
| Select-Object TimeCreated, Id, Message `
| Format-List
In the Defender portal:
- Go to security.microsoft.com > Assets > Devices
- Search for the device hostname -- it may take up to 5 minutes to appear after the SENSE service connects, but up to 72 hours if the device has poor cloud connectivity
- The device card should show Sensor health: Active and onboarding timestamp
- If the device appears with Sensor health: No sensor data, the SENSE service is running but not reporting telemetry -- check network connectivity and proxy configuration
Run the client analyzer:
Microsoft provides the Microsoft Defender for Endpoint Client Analyzer (mdatp_onboarding_check.py or the standalone client analyzer tool) which runs a comprehensive check:
# Download from Defender portal: Help > Client analyzer
# Run as administrator
.\MDEClientAnalyzer.cmd
# Output written to MDEClientAnalyzerResult folder
The analyzer report (MDEClientAnalyzerOutput.htm) includes sensor health, connectivity test results, and OS compatibility checks.
Failure Cases and Edge Scenarios
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Escalation Criteria
Open a Microsoft 365 Defender / MDE support ticket when:
- Event ID 84 (onboarding successful) appears in the SENSE event log but the device does not appear in the portal after 72 hours
- The client analyzer reports all connectivity checks passing, the registry key shows OnboardingState: 1, the SENSE service is running, but the portal still shows no device
- The device shows OnboardingState: 3 (offboarded) and you need to re-onboard within the 30-day cooling-off window
- Multiple devices across different network segments all fail onboarding with the same SENSE event log errors
- The SENSE service crashes immediately after start on a Windows 11 23H2 or later device (may indicate a platform version mismatch requiring a hotfix)
Information to gather before escalating:
- Device hostname, Windows build (winver), and hardware model
- Output of the MDEClientAnalyzer tool (MDEClientAnalyzerOutput.htm)
- SENSE operational event log exported to .evtx
- Registry export of
HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\ - Output of
netsh winhttp show proxyandnetsh winhttp show advproxy - Tenant region (from Defender portal Settings > Endpoints > Advanced features > Data storage region)
The bottom line
MDE onboarding script failures are almost always silent: the script writes a registry key but the SENSE service cannot reach the cloud backend. Check the SENSE operational event log for Event IDs 5, 10, 25, and 84 to pinpoint the failure, run the client analyzer tool for a full connectivity report, and confirm the onboarding package region matches your Defender tenant. Proxy SSL inspection bypass is the most commonly overlooked fix -- add all MDE URL patterns to the inspection bypass list, not just the proxy bypass list. For baseline MDE policy configuration after successful onboarding, see the How to Configure Microsoft Defender for Endpoint Baseline Policies guide.
Frequently asked questions
Why does the MDE onboarding script complete without errors but the device never appears in the Defender portal?
The onboarding script only writes a configuration file and sets the registry key -- it does not verify that the SENSE service can connect to the cloud backend. After the script runs, check that OnboardingState is 1 in the registry (HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status), then check the SENSE operational event log for Event ID 10 or 25, which indicate the service is running but cannot reach MDE cloud endpoints due to proxy or firewall blocks.
What is the Windows SENSE service and what does it do in MDE onboarding?
The SENSE service (Windows Defender Advanced Threat Protection) is the MDE sensor that runs on the device after onboarding. It collects behavioral telemetry, processes alerts, and reports device health to the MDE cloud backend. The service must be running and able to reach MDE cloud endpoints for the device to appear in the Defender portal. If the service is stopped or blocked from the internet, the portal will not receive any telemetry and the device will not show up.
How do I check if my proxy is blocking Microsoft Defender for Endpoint connectivity?
Run TestCloudConnection.cmd from the MDE onboarding package as administrator -- it tests each required URL and shows which ones fail. For SSL-inspection proxies, also run the MDEClientAnalyzer tool and review the connectivity section for certificate chain errors. The key URLs to check are *.endpoint.microsoft.com, *.wdcp.microsoft.com, and events.data.microsoft.com. Add all MDE URLs to your proxy's SSL inspection bypass list, not just the proxy bypass list.
What does MDE onboarding Event ID 84 mean and how do I confirm onboarding succeeded?
Event ID 84 in the Microsoft-Windows-SENSE/Operational log means the device has successfully onboarded and the SENSE service has established a connection to the MDE cloud backend. After seeing Event ID 84, check the Defender portal under Assets > Devices -- the device should appear within minutes to a few hours. Event ID 5 (connected to cloud) is an earlier step that confirms connectivity; Event ID 84 is the final onboarding confirmation.
How do I onboard Windows Server 2012 R2 and Windows Server 2016 to MDE?
Windows Server 2012 R2 and 2016 require a different onboarding approach than Windows 10/11. Download the Server-specific onboarding package from the Defender portal under Settings > Endpoints > Device management > Onboarding, selecting the correct server version. For Windows Server 2012 R2, install prerequisites KB3045999 and KB3080149 first. The unified MDE agent (available since late 2021) is the recommended approach for both versions and replaces the older MMA-based sensor.
A device was previously offboarded from MDE and the new onboarding script does not work. What is the 30-day cooling-off period?
When a device is offboarded from MDE, Windows applies a 30-day block to prevent immediate re-onboarding. During this period, the SENSE service starts and runs but reports an offboarded state, and the device will not appear in the Defender portal even if the onboarding script runs successfully. Check OnboardingState in the registry -- a value of 3 indicates offboarded. You must wait 30 days or open a Microsoft support case to reset the offboarding state before the device can re-onboard.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.