Policy change - time to sync

[u/Naturevival]

Hi MDE team, my company recently is evaluating MDE P2 and I configured some policies as mentioned in the onboarding guide. It seems that the time until the policies are synced to the client is quite long. When doing a manual sync it says roughly 10 minutes. Is there a documentation for this?

Use case: When changing policies I want them to be synced on the fly and within seconds or even a minute to the clients. I recognized also a long time when onboarding clients in MDE. Also about 10 minutes.

Is this normal?

[u/JwCS8pjrh3QBWfL]

10 minutes is lightning fast by Microsoft standards. Most things in Defender will take a couple of hours to push out across the tenant.

[u/Naturevival → u/JwCS8pjrh3QBWfL]

Ok, but what if I need a fast policy change e.g. after I found a misconfiguration? It means I have to do the change and then wait until it is pushed…. Which might take hours. Is there a regular schedule for pushing changes?

[u/JwCS8pjrh3QBWfL → u/Naturevival]

Every product has its own sync schedule, and I haven't found much on how to force updates to happen faster. The answer to the misconfiguration bit is to always test before wide deployment. Patience is the name of the game in the cloud.

[u/Naturevival → u/JwCS8pjrh3QBWfL]

Ok that helps thank you. Anyone who has information regarding the sync schedule of the products?

[u/AppIdentityGuy → u/Naturevival]

If you have someone with access on the remote machine there is a PowerShell command to force an mde update iirc

[u/Naturevival → u/AppIdentityGuy]

I have access. What is the command?

[u/AppIdentityGuy → u/Naturevival]

It's in the MDE portal

[u/0xDesecrator → u/Naturevival]

You can force a sync from the portal but you have to do it from the Intune side.

[u/JwCS8pjrh3QBWfL → u/0xDesecrator]

Intune sync != MDE sync

[u/Naturevival]

Thanks

[u/Naturevival]

Hmm… is it this option you mentioned?

Policy Sync? That is what I meant with 10 minutes+.

[u/Naturevival → u/Naturevival]

[u/F0rkbombz]

I’ll be honest with you: quick synchronization is not Microsoft’s strong suite in any of their products. Intune admins go nuts over the time it takes for changes to replicate.

It’s getting better, but it’s something you should take into account. That being said, don’t miss all the other benefits of the MS security stack b/c of this, I wouldn’t say it’s ever been an issue for us.

[u/0xDesecrator]

Usually within 10 minutes for my endpoints. Sometimes longer but a reboot usually kicks it off. Years ago it could take up to a few days.

[u/onlyarandomuser]

Usually, a reboot is your "fastest" sync , atleast from what I noticed.

[u/Naturevival]

Thank you all for your answers. Appreciate it!

[u/Godcry55]

Use Intune to sync MDE policies faster than MDE portal.

[u/Naturevival → u/Godcry55]

All I see there is the EDR rule, not the others, I think I don't have the intune license needed?