Microsoft Defender not syncing: what to check and fix
If Microsoft Defender isn’t syncing, the usual causes are the wrong work or school account, a device that isn’t enrolled or fully enabled for Defender, stale policy, or a network or security tool blocking check-in. Start by confirming what is out of sync, then check the sign-in, service state, and policy path before you change anything more disruptive. If the portal and the device disagree, that can also mean the problem is on the tenant or service side rather than on the PC itself.
Symptom
You may see one or more of these problems: threats reported on one device but not another, device health that looks different in the portal and on the PC, settings that do not match across devices, or a device that stops updating after a sign-in, policy, or network change.
If you are looking for a specific error, the exact message varies by product, management method, and tenant state. Treat the mismatch itself as the symptom and compare what is different: threat data, device status, policy, or settings.
Before you start
- Confirm which part is not syncing: threats, device status, policy, or settings.
- On the affected device, check that you are signed into the correct work or school account and tenant.
- Make sure Microsoft Defender is enabled for that device and that the relevant Defender service is up to date.
- Check whether another security product is installed, whether a policy was changed recently, and whether the device can reach Microsoft services over the network.
If the device is offline, newly enrolled, or still waiting on a policy change, give it a little time before you start making changes. If the device belongs to a managed tenant, avoid removing enrollment or changing protection settings unless you know how to restore them.
Fix it
- Check what is failing to sync.
Open the Microsoft Defender portal and the local device side by side if you can, then compare the item that is wrong: threat records, device status, policy, or settings. If only one of those is off, focus on that path instead of changing everything at once.
- Confirm the device is signed into the right account and tenant.
On the affected device, verify the work or school account used for Defender management. If the device is signed into the wrong tenant, or into an account that is not assigned to the policy, the portal and the device will keep disagreeing until the sign-in and enrollment match.
If the device was recently moved between tenants or accounts, stale data can linger until the device checks in again. If you cannot confirm the tenant, stop there and check the tenant assignment first rather than forcing more changes.
- Verify that Defender is enabled and current on the device.
Check that the relevant Microsoft Defender service is turned on for that machine and that the app or platform is up to date for your management method. If Defender is disabled, partially replaced, or out of date, the device may not report the same status that the portal expects.
If another security product is installed, check whether it is meant to coexist with Defender or replace it. A conflicting product can suppress reporting or change the status shown in the portal, which makes the device look out of sync even when the local machine seems fine.
- Look for stale policy or a blocked check-in path.
Review recent policy changes, assignment changes, or grouping changes in the tenant. A device can only sync what the tenant is actually sending to it, so a stale or misassigned policy can make the portal and the device look inconsistent.
Then check whether the device can reach Microsoft services. Firewall rules, proxy settings, DNS issues, or restricted outbound access can stop policy and reporting traffic even when normal browsing still works. If the network path is blocked, fix that first; the device cannot sync what it cannot reach.
- Decide whether the issue is device-side, tenant-side, or service-side.
If the device changes locally but the portal never updates, the problem is usually on the reporting or check-in path, or in the tenant assignment. If the portal looks healthy but the device never changes, the issue is more likely on the device, its sign-in, or local policy delivery.
If both the portal and the device show the same wrong state after a reasonable delay, check tenant health, enrollment, and policy assignment before making deeper local changes. If Microsoft’s service is having an incident or the tenant is not sending the right policy, the fix may need to happen there rather than on the device.
Verify it worked
After the fix, force or wait for the next sync, then compare the same item again: threat data, device status, policy, or settings. The expected result is that the portal and the device now match for the problem you were tracking.
If the change was successful, the device should appear enrolled under the correct tenant, Defender should show the expected enabled state, and the stale mismatch should clear after the next check-in. If the mismatch is still there, the problem is not fully fixed yet, and the next check should be tenant assignment, service health, or network reachability.
Conclusion
If the device still will not sync after these checks, collect the device name, tenant name, account used to sign in, and the exact mismatch you can see, then check tenant health or Microsoft service status before trying a bigger change.
Frequently Asked Questions
How long should Microsoft Defender take to sync after a fix?
It depends on the device, the management method, and the network path. After a successful sign-in, update, or manual sync, check again after a few minutes. If nothing changes, the problem is probably not just a delay.
Can another antivirus stop Microsoft Defender from syncing?
Yes. Another security product can change Defender’s behavior, disable parts of it, or prevent the expected status from showing in the portal. If a different antivirus is installed, check whether it is meant to coexist with Defender or replace it.
What if the portal shows the wrong device status but the PC looks fine?
That usually means the device has not checked in recently or the tenant policy is stale. Confirm the device is online, signed into the right account, and still enrolled in the right tenant before changing deeper settings.