How is the "Endpoints Protected" percentage calculated on the Endpoints page?
Red Canary and Microsoft Defender for Endpoint
If device discovery is enabled within your Microsoft Defender for Endpoint instance, any endpoints discovered that meet the minimum requirements will display in the Defender for Endpoint console with the status "Can Be Onboarded". All devices in Device Inventory within Defender for Endpoint will show in on the Endpoints page in Red Canary, however devices that have not been onboarded are not sending telemetry to Red Canary and can be identified using the filter
See Protected by Red Canary for additional information.
You can filter in Device Inventory within Defender for Endpoint by the status "Can Be Onboarded" and determine if the endpoint should have the sensor installed. See Onboard devices and configure Microsoft Defender for Endpoint for additional information.
If you choose not to onboard a particular device, it is recommended to decommission the device in Red Canary. See Decommissioning endpoints for additional information.