Skip to main content
Beta feature. Stealth Devices is still in development, so interpret the results with care. It’s off by default.
A stealth device is an unknown or unmanaged device that someone has used to sign in to your company’s applications, but that isn’t registered in any of your systems. A personal laptop used to check email, or a home PC used to open SharePoint, are typical examples.

​
How stealth devices are found

Stealth Devices mainly uses your Microsoft 365 connection, with some of the data coming from Entra AD. ThreatAware analyses your Microsoft 365 sign-in logs and tries to match each sign-in to a device it already knows about. A stealth device is created when:
  • No device matches. The sign-in can’t be matched to any known device, so it came from an unrecognised one.
  • The IP address doesn’t fit. The user does have known devices, and they were active around the time of the sign-in, but the sign-in came from a completely different IP address. That means it came from a separate, unrecognised device.

​
What each stealth device shows

Each stealth device is named Unknown-{OS}-{ID}, for example Unknown-Windows-abc123, and is linked to:
  • the user who signed in
  • their location at the time of the sign-in
  • the cloud applications they accessed
Stealth devices are updated on every run. If the sign-in activity stops, the stealth device is removed automatically.

​
Turn it on

Connect Microsoft 365 first, and Entra AD if you use it.
1

Enable Stealth Devices

Go to Settings → Misc and turn on Enable Stealth Devices. The setting applies to your whole organisation.
2

Show stealth devices in Devices

Go to Devices, click the Active menu at the start of the search bar and choose Stealth. The grid then lists your stealth devices, and you can search, filter and save the view as usual.
The stealth counter at the top of Device Explorer also shows how many stealth devices ThreatAware has found, and how that’s changed.

​
Using the results

Each stealth device tells you a person has reached company data from a device you don’t manage. For each one, you can:
  • Talk to the user. Ask what the device is. It may be a personal device, or a work device that was never enrolled.
  • Bring it into management, if it should be a company device.
  • Tighten access, for example with conditional access policies, if unmanaged devices shouldn’t reach those applications.

​
Things to bear in mind

How sign-ins are matched to devices is still being improved, so results can change between releases. Treat each stealth device as a lead to check, not a confirmed finding.
Stealth devices come from Microsoft 365 sign-in logs. A device that never signs in to a Microsoft 365 application won’t be found this way.

​
Next steps

Settings → Misc

Turn on Stealth Devices

Device Explorer

The stealth counter