Edit

Troubleshoot subscription and portal access issues

  • Article

Applies to:

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

This page provides detailed steps to troubleshoot issues that might occur when setting up your Microsoft Defender for Endpoint service.

If you receive an error message, Microsoft Defender XDR will provide a detailed explanation on what the issue is and relevant links will be supplied.

No subscriptions found

If while accessing Microsoft Defender XDR you get a No subscriptions found message, it means the Microsoft Entra ID used to log in the user to the portal, does not have a Microsoft Defender for Endpoint license.

Potential reasons:

  • The Windows E5 and Office E5 licenses are separate licenses.
  • The license was purchased but not provisioned to this Microsoft Entra instance.
    • It could be a license provisioning issue.
    • It could be you inadvertently provisioned the license to a different Microsoft Entra ID than the one used for authentication into the service.

For both cases, you should contact Microsoft support at General Microsoft Defender for Endpoint Support or Volume license support.

The No subscriptions found page

Your subscription has expired

If while accessing Microsoft Defender XDR you get a Your subscription has expired message, your online service subscription has expired. Microsoft Defender for Endpoint subscription, like any other online service subscription, has an expiration date.

You can choose to renew or extend the license at any point in time. When accessing the portal after the expiration date a Your subscription has expired message will be presented with an option to download the device offboarding package, should you choose to not renew the license.

Note

For security reasons, the package used to Offboard devices will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a device will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.

The subscription expired notification message

You are not authorized to access the portal

If you receive a You are not authorized to access the portal, be aware that Microsoft Defender for Endpoint is a security monitoring, incident investigation and response product, and as such, access to it is restricted and controlled by the user. For more information, see, Assign user access to the portal.

The access disallowed notification message

Data currently isn't available on some sections of the portal

If the portal dashboard and other sections show an error message such as "Data currently isn't available":

The data unavailability notification message

You'll need to allow the security.windows.com and all subdomains under it on your web browser. For example, *.security.windows.com.

Portal communication issues

If you encounter issues with accessing the portal, missing data, or restricted access to portions of the portal, you'll need to verify that the following URLs are allowed and open for communication.

  • *.blob.core.windows.net
  • crl.microsoft.com
  • https://*.microsoftonline-p.com
  • https://*.security.microsoft.com
  • https://automatediracs-eus-prd.security.microsoft.com
  • https://login.microsoftonline.com
  • https://login.windows.net
  • https://onboardingpackagescusprd.blob.core.windows.net
  • https://secure.aadcdn.microsoftonline-p.com
  • https://security.microsoft.com
  • https://static2.sharepointonline.com

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.