How to find unmanaged devices on your network

An unmanaged device is any device on your network that is missing from at least one of the systems that should know about it: your MDM, your EDR or your identity provider. To find them, collect what is actually on the network (from your EDR's network discovery, DHCP leases and switch tables, or an active scan), then compare that list against your MDM, EDR and identity provider records. Anything on the network that is missing from those lists is unmanaged. Run the comparison at least weekly: CIS Control 1 asks for active discovery at least daily and a weekly process for dealing with unauthorized assets.

What counts as an unmanaged device

"Unmanaged" covers three different problems, and each one is found a different way.

Printers, switches, access points and cameras are a fourth case. They cannot run an agent, so the goal is to inventory them, give each one an owner and keep them on the right network segment, not to enroll them.

Most guides focus on the first type. The second and third are just as important for an IT team, because those devices look covered on a dashboard: they belong to real employees, they have company data on them, and nothing alerts when they drift out of management.

Four ways to find unmanaged devices

1. Use your EDR's network discovery

If you already run an EDR, start here, because the sensors you have deployed can see their neighbours.

• Microsoft Defender for Endpoint device discovery has two modes. Standard mode, the default, has onboarded devices actively probe the network to find and identify other devices. Basic mode only listens to the traffic onboarded devices already see. It finds workstations, servers and mobile devices that are not onboarded, network devices such as routers and switches, and IoT devices such as printers and cameras.
• SentinelOne Singularity Network Discovery (formerly Ranger) elects a few agents per subnet that listen for ARP and DHCP traffic, with optional active scanning. It needs no extra hardware.
• CrowdStrike Falcon Exposure Management lists assets that lack a Falcon sensor as unmanaged, and can trigger a workflow to triage them.

The limit: EDR discovery only covers subnets where at least one onboarded device is present, and it does not know what your MDM thinks should be there. It finds unknown devices well and says little about managed-but-unprotected ones.

2. Read DHCP leases and switch tables

Every device that asks for an IP address leaves a DHCP lease, and every device plugged into a managed switch shows up in that switch's MAC address table. Export both, look up each MAC address prefix to get the manufacturer, and you have a list of what has been on the network. CIS Control 1 asks for DHCP logs to be reviewed and used to update the asset inventory at least weekly.

This catches anything that requests an address. It misses devices with static IPs and anything that never joins the corporate network, such as remote laptops on home Wi-Fi.

3. Run an active scan

An active scan sends probes across a subnet and records what answers. For a quick check, an Nmap ping sweep (nmap -sn followed by the subnet, for example 10.0.0.0/24) lists live hosts without scanning ports. Dedicated tools such as runZero and Lansweeper add fingerprinting, so each device comes back with a vendor, model and operating system rather than an IP address.

Active scans are thorough on the subnets they reach. They can be blocked by host firewalls, they need a scanner on or routed into each segment, and they only see devices that are online when the scan runs.

4. Reconcile EDR, MDM and your identity provider

This is the step that turns discovery into a list you can act on, and the only one that finds the second and third types above.

1. Export what network discovery found, with MAC address, hostname and serial number where available.
2. Export your MDM inventory (for example Jamf, Intune or Kandji).
3. Export your EDR host list (for example CrowdStrike, SentinelOne or Defender for Endpoint).
4. Export registered devices from your identity provider (Entra ID or Okta) and active employees from your HRIS, so every device can be tied to an owner.
5. Match on serial number, or MAC address for devices without one. Do not match on IP address: with DHCP it changes too often.
6. Sort the gaps into the three types and route each one: unknown devices to security for investigation, known-but-unmanaged devices to IT for re-enrollment, managed-but-unprotected devices to whoever owns the EDR rollout.

Done by hand in spreadsheets this takes a few hours, which is why it tends to happen once a quarter. Automated, it runs every day.

How to find devices with no EDR agent within 24 hours

New laptops are the most common way a device ends up in MDM without EDR: the EDR package fails to install during enrollment, or the device is reimaged and only partly rebuilt. To catch them within a day:

1. Make MDM enrollment the starting point. With zero-touch enrollment (Apple Business Manager or Windows Autopilot), every company device appears in MDM before it reaches the employee.
2. Compare MDM against EDR every day, by serial number. Any device that has been in MDM for more than 24 hours without an EDR sensor checking in is a gap.
3. Check sensor health, not just presence. Flag sensors that have stopped reporting, agents that are out of date, and agents with protections switched off. An installed agent that does nothing is the same gap as a missing one.
4. Open a ticket with an owner. Send the device, its owner and the fix (install the sensor, re-enroll, or re-enable protection) to IT, and tell the owner.
5. Close the ticket automatically once the sensor checks in and the configuration is back in policy, so the open ticket count is a live measure of coverage.

Devices that never enrolled in MDM will not show up in this check, which is why it runs alongside network discovery rather than instead of it.

Tools that do this

How Harmony handles it

Harmony covers both halves: finding what is on the network, and reconciling it against the systems that should manage it.

• Network discovery. A discovery script runs on managed macOS and Windows endpoints. It reads the endpoint's ARP cache, sends ARP requests across the local subnet, and fingerprints each MAC address to a vendor and model. Every device it finds is added to the asset inventory, and devices without an active Harmony agent are marked unmanaged. One managed endpoint per network segment is enough, and no scanner appliance is needed.
• Missing and misconfigured EDR. EDR Policy Compliance Discovery checks the device inventory from your MDM (for example Jamf Pro, Intune or JumpCloud) against your EDR (CrowdStrike, SentinelOne, Defender for Endpoint or Cortex) on a schedule. It flags devices with no EDR agent or an agent that does not meet policy, notifies the owner and the security team in Slack, Teams or email, opens a ticket, and closes it when the device is back in compliance.
• Protections switched off. EDR Misconfiguration Detection catches agents that are installed but not protecting anything: real-time or tamper protection disabled, outdated versions, sensors that stopped reporting, and exclusions that are too broad.
• Devices without an owner. Unassigned Assets flags active devices that nobody owns, so every discovered device ends up with a name against it.

A routine that keeps the list short

• Daily: automated discovery, plus the MDM-against-EDR comparison.
• Weekly: review new unmanaged devices, classify them and assign each one (CIS Control 1 asks for a weekly process for unauthorized assets).
• Monthly: check that every network segment has a discovery source, and review EDR exclusions.
• Quarterly: reconcile the full inventory against the HRIS, so devices belonging to people who have left are recovered.

For choosing an asset management tool, see the best IT asset management software for 2026. For the basics, see what IT asset management is.

This guide is written and maintained by Harmony, which is one of the vendors listed. Details about other products come from their public documentation, listed under Sources, and were last checked in October 2026. If something is out of date, email us and we will fix it.