Contoso Legal LLP

Devices enrolled in Intune.

Managed devices that aren't compliant, aren't encrypted, run an unsupported Windows release or have stopped checking in.

Windows computers joined to Entra ID and seen in the last 90 days, and whether the BitLocker recovery key for the system drive is saved in Entra ID. Encrypted comes from Intune. Hybrid joined computers often save theirs in on-premises Active Directory instead, which Office Sentry can't see. Office Sentry only reads that a key exists, never the key.

Windows computers joined to Entra ID and seen in the last 90 days, and whether Windows LAPS backs up their local administrator password in Entra ID, which gives each computer its own password and changes it regularly. Hybrid joined computers may back theirs up to on-premises Active Directory instead, which Office Sentry can't see, so they aren't flagged. Office Sentry only reads that a password is backed up, never the password.

Every device known to Entra ID, least recently seen first.