This morning, a large number of our Intune-managed Windows 11 devices displayed a toast notification saying Defender signatures were out of date. However, the Defender portal shows those devices as up to date and healthy.

We’re expecting some user concern given the conflicting information.

We had an issue in August, resolved in September, where Defender was incorrectly reported as disabled. That turned out to be a Windows Security Center (WSC) signal issue. This feels potentially similar, although we haven’t confirmed the cause yet.

Has anyone else seen this today?