What percentage of hardware/software connected to network is inventoried?
Every coverage percentage elsewhere on this application is calculated against an inventory. This question asks whether that inventory is real.
What the carrier is actually asking
The carrier is asking what proportion of connected hardware and installed software is tracked in an inventory. It is the foundational control, because patching, endpoint coverage, and vulnerability management all measure themselves against it.
Why it is underwritten
Unknown assets are unpatched, unmonitored, and uncovered by every control you reported. They are also disproportionately where intrusions begin, because nobody is looking at them. An inventory that misses ten percent of the estate makes every other coverage figure ten percent optimistic.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Several independent sources can be reconciled to produce a real denominator, which is what distinguishes an inventory from a list.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Entra ID | Registered and joined device inventory | The identity-side view of devices, which usually differs from the endpoint console |
| Microsoft 365 | Intune enrolled devices and discovered applications | Managed device population and the software inventory it reports |
| Azure | Resource inventory across subscriptions | Cloud assets including those in subscriptions outside the main management group |
| Endpoint console | Unmanaged device discovery on the network | Devices seen without an agent, which is the most direct measure of inventory gaps. Attested |
| Reconciliation | Differences between sources | A reconciled figure with a stated method, since the union of the sources is the real denominator |
Physical shadow IT has largely been replaced by cloud subscriptions and software-as-a-service accounts opened with a corporate card. They hold data, they have administrators, and they appear in no inventory. Reviewing your cloud tenant for subscriptions and consented applications finds them.
What a defensible yes requires
- The inventory is built by reconciling multiple discovery sources.
- It covers cloud resources and software-as-a-service accounts, not only hardware.
- Discovery runs continuously rather than as a periodic project.
- Unmanaged discoveries are triaged and either enrolled or removed.
- The stated percentage names its denominator.
How this answer goes wrong
The inventory is the endpoint console export, which by construction contains only devices with an agent, so the reported coverage approaches a hundred percent. It is the same circular figure that inflates the endpoint coverage answer, and both derive from the same missing denominator.
Frequently asked
What percentage should we report?
Whatever your reconciliation supports, with the method stated. An honest ninety with a described method is stronger than an unexplained hundred.
Does software inventory matter as much as hardware?
Increasingly more. Unsupported and vulnerable software is what gets exploited, and you cannot manage what you have not inventoried.
How do we find unknown assets?
Network discovery, cloud resource enumeration, financial records for cloud spend, and identity logs showing applications in use. Each finds things the others miss.
How often should this be refreshed?
Continuously where possible. Estates change weekly, and an annual inventory is stale before it is finished.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture