EDR Policy Compliance Discovery
SentinelOne
Microsoft Defender for Endpoint
Microsoft Intune- 1Runs periodic checks on all managed endpoints for EDR policy compliance
- 2Identifies devices with missing or misconfigured EDR agents
- 3Marks violations as NEW or existing based on entity tracking
- 4Notifies device owners and security team
- 5Creates ticket with violation summary for IT remediation
- 6Auto-resolves when devices return to compliance
Overview
What EDR Policy Compliance Discovery does
EDR Policy Compliance Discovery answers a question most fleets cannot answer on demand: which devices are not covered by our EDR policy right now. On a recurring schedule it checks every managed endpoint for a missing or misconfigured EDR agent, marks each violation new or already known, notifies the device owner and the security team, and opens a ticket with a violation summary for IT to work. When a device comes back into compliance, the ticket resolves itself, so the open ticket count is a live measure of coverage rather than a backlog.
Who it's for
Who EDR Policy Compliance Discovery is for
Security and IT leaders who have to report EDR coverage as a number, and the endpoint teams who have to close the gap.
EDR coverage gets reported from license counts and enrollment lists, which is not the same as coverage. Devices arrive without the agent, get reimaged and never re-enrolled, or sit in a state the policy does not accept, and there is no recurring process that finds them. The gap is real, it grows, and nobody can size it without a manual export.
How it works
How EDR Policy Compliance Discovery works
A recurring schedule, configurable per tenant.
- 1
Check endpoints against policy
Runs a periodic compliance check across all managed endpoints rather than sampling.
- 2
Identify non-compliant devices
Surfaces devices with a missing EDR agent, and devices whose agent is present but misconfigured against policy.
- 3
Mark new versus existing violations
Uses entity tracking so a violation already being worked stays on its ticket instead of being raised again.
- 4
Notify owner and security team
Alerts the device owner and the security team through each recipient's preferred channel.
- 5
Ticket the violations
Creates a ticket with a summary of the violations for IT to remediate.
- 6
Auto-resolve on compliance
Closes the ticket once the affected devices return to a compliant state.
A current, ticketed picture of every endpoint outside your EDR policy, with owners notified and tickets that close themselves as coverage is restored.
Capabilities
Capabilities
Recurring fleet-wide compliance checks
Every managed endpoint is checked against policy on a schedule, not on request.
Missing and misconfigured agent detection
Catches both devices with no EDR agent and devices whose agent does not satisfy the policy.
New versus existing violation tracking
Entity tracking keeps repeat findings on their original ticket rather than multiplying them.
Owner and security notifications
Both the person holding the device and the team accountable for coverage are told.
Violation summary tickets
IT gets a ticket describing what is out of policy, not a raw device list.
Self-closing remediation loop
Tickets resolve automatically when devices return to compliance, so open tickets track the real gap.
Use cases
Main use cases
Reimaged laptop that never came back
A device is reimaged and returned to its user without the EDR agent reinstalled. The next compliance run finds it, notifies the owner and security, and tickets it - instead of it living unprotected until someone happens to look.
Sizing the coverage gap for a board report
Leadership asks what percentage of the fleet is covered. Open violation tickets are the live answer, and because they auto-resolve on compliance, the number reflects today rather than the last manual audit.
Closing the loop after a rollout
An EDR policy change rolls out to the fleet. The agent surfaces the devices the rollout missed, tickets each one, and clears the tickets as the stragglers come into line.
Integrations
| Integration | Role in the agent flow |
|---|---|
| Your connected EDR (e.g. CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Palo Alto Cortex) | Source of agent presence, policy state, and per-device compliance signal |
| Your connected MDM (e.g. Jamf Pro, Microsoft Intune, Hexnode, JumpCloud) | Supplies the managed device inventory the compliance check runs across |
| Harmony Service Desk | Native ticketing - creates the ticket, tracks it, and records the outcome |
| Harmony Notifications | Delivers updates through each recipient's preferred channel: Slack, Teams, or email |
FAQ
A device with a missing EDR agent, or one whose agent is present but misconfigured relative to your policy. Both are reported as violations so neither hides behind an enrollment count.
Works alongside
More agents for the same team
See EDR Policy Compliance Discovery on your own requests
Connect your stack and we will walk you through a real run in a 30-minute session.