Direct answer
Record the endpoint's last verified state and offline duration, evaluate how it receives updates and protection, then plan an approved reconnection and recheck rather than assuming stale reports are current.
Understand the offline role
Identify the owner, device role, data sensitivity, expected connection schedule and operational constraints. A laboratory system or field laptop may intentionally be offline. Record the date and permissions of the most recent local assessment and management report.
Assess visibility gaps
Compare update, antivirus, management and sensor reporting dates with policy. Microsoft notes that an inactive Defender sensor may reflect a disconnected device. An old management record cannot prove that current protections are effective.
Reference: Microsoft: Device sensor health.
Plan safe maintenance
Agree a controlled update and reconnection process with the owner, including network restrictions, backup, restart and recovery. Recheck the effective state and reporting after maintenance. Record unsupported or unreachable devices and time-limited exceptions for review.
Plan a field-device maintenance window
A field laptop may be offline for months and carry removable media between sites. Agree a safe reconnection network, update source and restart window with its owner; first preserve required data and recovery access. Record post-maintenance versions and sensor status, and track any unsupported software that could not be updated.
Assessment limits
An offline device may still be exposed through removable media or physical access. A local snapshot cannot predict the state of a machine that has not been assessed.
Frequently asked questions
Does offline mean risk-free?
No. Physical access, removable media and stale software can still matter.
Does an old report prove current antivirus health?
No. Verify the endpoint's actual state at an appropriate time.
Should every offline device connect immediately?
Coordinate a safe maintenance plan with its owner and operational requirements.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.