Is endpoint security centrally managed to monitor and force signature/agent updates?
An agent that stopped updating eight months ago still reports as installed. Central management is what turns that from an invisible failure into an alert.
What the carrier is actually asking
The carrier is asking whether one console governs endpoint protection across the fleet, and whether it can push signature and agent updates without depending on the device or its user. It is asking about control, not merely visibility.
Why it is underwritten
Endpoint agents drift. They fail to update after an operating system upgrade, get disabled during troubleshooting and never re-enabled, or lose connectivity to a console after a network change. Each of those produces a device that appears protected and is not, and central management with health reporting is the only thing that catches it.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Health and update state come from the endpoint console. The tenant contributes the enforcement layer that makes an unhealthy device lose access.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Endpoint console | Agent health, last check-in, and definition currency across the fleet | A small population of stale or unhealthy agents, with a process that chases them. Attested |
| Microsoft 365 | Intune compliance policy including antimalware health and signature currency | Health is a compliance condition, so a failing agent has a consequence |
| Entra ID | Conditional Access requiring device compliance | Non-compliant devices lose access to corporate applications, which converts health reporting into enforcement |
| Microsoft 365 | Tamper protection state | Enabled, so local administrative access cannot silently disable the agent |
| Azure | Extension health on virtual machines | Server agents reporting, since virtual machines built outside the standard pipeline commonly lack the extension entirely |
Coverage counts agents that exist. Health counts agents that work. The gap between the two is usually a few percent of the fleet, permanently, and it moves around. A device that has not checked in for thirty days is functionally uncovered regardless of what the inventory says.
What a defensible yes requires
- One console governs the fleet, with a defined owner.
- Agent and signature updates are pushed centrally rather than depending on the device.
- Health and last check-in are monitored, with a process for chasing stale agents.
- Tamper protection prevents local disabling.
- Unhealthy devices lose access through compliance enforcement rather than merely appearing on a report.
How this answer goes wrong
The console exists and nobody reviews the health view. Devices that stopped checking in months ago sit in the inventory as protected, which inflates the coverage figure reported elsewhere on the application. The second failure is fragmentation: two consoles after an acquisition, neither covering the whole estate, and a coverage number produced from one of them.
Frequently asked
What if a managed provider runs the console?
That is central management and it satisfies the question. Confirm you receive health reporting, because outsourcing the console sometimes outsources the visibility as well.
How stale is too stale?
Most teams treat two weeks without check-in as a problem and thirty days as effectively unprotected. Pick a threshold and act on it consistently.
Does this apply to servers?
Yes, and server agent drift is worse because servers are rebuilt less often and are excluded from endpoint processes more often.
Why does tamper protection matter here?
Because the most common way an agent stops working during an intrusion is that the attacker turned it off. Tamper protection makes that a detectable failed attempt rather than a silent success.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture