Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Aggregated Reporting in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

13 October 2026Doc update+16 / −17 lines

In brief

The page updates heading capitalization, formats navigation paths and code blocks, and restructures the supported operating systems section for clearer presentation.

What Defender admins need to know

No administrator action is required; the existing setup and availability guidance remains documented.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Aggregated reportingReporting in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Aggregated reporting addresses constraints on event reporting in Microsoft Defender for Endpoint. Aggregated reporting extends signal reporting intervals to significantly reduce the size of reported events while preserving essential event properties.

The following requirements must be met before turning on aggregated reporting:

  • Permissions to enable advanced features

  • Supported operating systems:

    • Windows 10 (20H2, 21H1, 21H2)
    • Windows 11 (22H2, Enterprise)
    • Windows Server 2019 and later
    • Windows Server version 20H2 or Azure Stack HCI OS, version 23H2 and later
    • Client version: Windows version 24H and later

    Turn on aggregated reporting

    To turn aggregated reporting on, go to Settings > Endpoints > Advanced features. ToggleTurn on the Aggregated reporting feature.

    Screenshot of the aggregated reporting toggle in the Microsoft Defender portal settings page.

    OnceAfter aggregated reporting is turned on, it can take up to seven days for aggregated reports to become available. You can then begin to query new data after the feature is turned on.

    When you turn off aggregated reporting, the changes take a few hours to be applied. All previously collected data remains.

    To query new data with aggregated reports:

    1. Go to Investigation & response > Hunting > Custom detection rules.

    2. Review and modify existing rules and queries that might be affected by aggregated reporting.

    3. When necessary, create new custom rules to incorporate new action types.

    4. Go to the Advanced Hunting page and query the new data.

    Here is an example of advanced hunting query results with aggregated reports.

    Screenshot of advanced hunting query results with aggregated reports.

    Sample advanced hunting queries

    The following query highlights noisy process activity, which can be correlated with malicious signals.

    DeviceProcessEvents
| where Timestamp > ago(1h)
| where ActionType == "ProcessCreatedAggregatedReport"

The following query identifies repeated sign-in attempt failures.

```Kustokusto
DeviceLogonEvents
| where Timestamp > ago(30d)
| where ActionType == "LogonFailedAggregatedReport"

The following query identifies suspicious RDP connections, which might indicate malicious activity.

```Kustokusto
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType endswith "AggregatedReport"