Signing in and what you see
You sign in with your Microsoft Entra account. The pages and devices you see depend on your role and any Access assignment. See Roles and Access.
The top bar lists the pages below. Admin appears only for administrators. Search (Ctrl K) jumps to a page or finds a device, user or application. Your name menu sets light or dark appearance and table density.
Nothing in the portal changes a device. It reads what devices reported, or asks them an approved read-only question.
What each page does
| Page | Use it to |
|---|---|
| Dashboard | See fleet health, average security posture and App Control at a glance, then the device table. Start here. |
| Devices | Find a device by name or last user, and filter by status, health, tag or enrollment. Open a device for its detail. How check-in status works. |
| Changes | See what changed across the fleet or on one device in a time range. How to read it. |
| Posture | Check every device against a baseline and see which ones need attention. See Security posture. |
| Settings | Browse every Defender and Windows policy setting devices report, what each one means, and where devices differ. How to read it. |
| Queries | Ask one device, a tag or many devices a read-only question and export the answers. See Ask devices. |
| App Control | Policy compliance, policy sets, alerts and the application decision register. See App Control management. |
| Firewall | What is blocked and allowed, where connections go and what needs attention. See Firewall reporting. |
| Ask Highwind | Ask a question in plain English and get an answer with its evidence. How it works. |
| Admin (administrators) | License, enrollment, certificate authorities, baselines, custom checks, client configuration, access and the activity log. See Client configuration and Activity log. |
Check-in status
The Checking in column is worked out by the server’s own clock, not by what the device says about itself. A device can report Device health problems and still be checking in on schedule. A device that has stopped cannot report anything, which is why the two are separate.
| Status | Meaning |
|---|---|
| Online | A heartbeat arrived within the expected window. |
| Stale | Heartbeats were missed, but not enough yet to call the device gone. A device that has one bad network moment can show this briefly and return to Online. |
| Offline | Heartbeats have been missing long enough that the device should be treated as gone. It keeps its last values. |
| Never reported | The device registered but has never sent a heartbeat. Usually the agent was never enabled by policy. |
With the default interval of 5 minutes, a device turns Stale after two missed intervals and Offline after six. When a check-in fails, the agent retries after 30, 60, 120 and 240 seconds (never longer than the interval) instead of waiting for the next full interval. Set the interval with policy; it cannot be changed from the portal.
Reading the Changes page
The page answers “what changed, and does it matter?” Use the date boxes and the device box at the top to narrow it. With no device, it covers every device you can see.
- Tiles by area. Policy changes are grouped by area, such as antivirus, firewall, attack surface reduction and device control. Select a tile to see just that area.
- One verdict per area. Each tile counts changes by effect, so a red tile means protection was weakened, not merely that something changed.
- Every change lists each change with the device, the old and new value and how sure Highwind is about the statement (Evidence).
| Label | Meaning |
|---|---|
| To look at | A change that lowered protection, such as a feature going from on to off, or a rule going from Block to Audit. |
| Informational | A change that made a device stricter, such as Audit to Block. It is worth knowing about, because a stricter rule can still block work, but it is not a weakening. |
| Repeating | A setting that keeps switching back and forth, often two sources (for example Group Policy and Intune) disagreeing. |
A setting set to its normal value is not an alert. For example AllowCloudProtection = 1 means cloud protection is on. Only a move to a weaker value raises a tile.
How changes are found. The Fleet service compares the reports a device sends over time. It does not use the snapshots the Highwind client keeps on the device.
Reading the Settings page
This page lists the policy settings devices report from Group Policy, Intune and local configuration. Type a workstation name in the filter at the top right to see one device, or leave it empty for the fleet.
| Section | What it shows |
|---|---|
| Settings that look contested | Settings with two sources, or a value going back and forth. |
| Settings that changed the most | The settings with the most changes in the range, as chips. Each chip shows the setting, the area it belongs to and a count. Select a chip to open the setting. |
| Settings that differ between devices | Settings where devices report different values. |
| Every setting | The full list, with what each setting is, how much it matters and when a device last reported it. |
Each setting is rated Critical, High, Medium or Low by what it controls. Many Defender switches have only a number or an internal name. They are grouped as Internal and sorted last so they do not crowd the list.
Select a setting to see its value on each device and its source.
Ask Highwind
Type a question such as what changed in the last 24 hours? and choose a time range. The answer is built from Highwind’s own records, runs with your permissions, and never changes anything. Open it from the Ask Highwind page or the button in the top bar.
Each line of an answer is labelled Observed, Correlated, Likely related, Possible explanation, Insufficient evidence or Unknown, and links to the records behind it. Questions are limited to 500 characters.
Optional: let a model word the answer
By default no model is used. Rules write the answer, and nothing leaves your portal. To use a model, set these portal settings. The model sees only a bounded, redacted set of evidence.
| Setting | Value |
|---|---|
Portal:Ai:UseModel | true to turn it on. Off by default. |
Portal:Ai:Endpoint | Your model endpoint. It must be an https address. |
Portal:Ai:Deployment | The deployment or model name. |
Portal:Ai:ApiKey | The API key. Store it as a secret, for example a Key Vault reference, not in a file. |
If any value is missing or the endpoint is not https, the portal quietly keeps using rules.