Analysis and reporting on device online/offline status for managed service providers.
Analysis and reporting on device online/offline status for managed service providers.
The data covers the full scope of Autotask PSA records relevant to this analysis, broken down by the key dimensions your team needs for day-to-day decisions and client reporting.
Who should use this: NOC teams, asset managers, and service delivery leads
How often: Weekly for fleet reviews, monthly for lifecycle planning, quarterly for budgeting
Analysis and reporting on device online/offline status for managed service providers.
Out of 3,847 managed devices across 12 clients, 3,604 are currently online and reporting to Datto RMM. The remaining 243 devices (6.3%) are unreachable. 38 of those have been dark for over 30 days and are likely decommissioned hardware still carrying active agent licenses.
EVALUATE TOPN(10, SUMMARIZECOLUMNS('BI_Datto_Rmm_Devices'[Type], "DeviceCount", COUNTROWS('BI_Datto_Rmm_Devices'), "Online", CALCULATE(COUNTROWS('BI_Datto_Rmm_Devices'), 'BI_Datto_Rmm_Devices'[Online] = TRUE())), [DeviceCount], DESC)All 12 clients ranked by device online rate. The spread runs from 98.2% down to 83.7% -- a 14.5 percentage-point gap between the best and worst performers.
The top six clients all sit above 95%, which is the threshold for healthy fleet management. Below that line, things deteriorate quickly. The bottom four -- Cobalt Systems, Redstone IT, NovaTech Solutions, and Ironclad Services -- all fall under 90%, and together they contribute 93 of the 243 offline devices (38.3% of all offline endpoints from just 33.3% of clients). Ironclad Services at 83.7% means roughly 1 in 6 of their devices is unreachable at any given time.
EVALUATE
ADDCOLUMNS(
SUMMARIZECOLUMNS(
BI_Datto_RMM_Devices[company_name],
"Total Devices", COUNTROWS(BI_Datto_RMM_Devices),
"Online", CALCULATE(COUNTROWS(BI_Datto_RMM_Devices), BI_Datto_RMM_Devices[status] = "Online"),
"Offline", CALCULATE(COUNTROWS(BI_Datto_RMM_Devices), BI_Datto_RMM_Devices[status] = "Offline")
),
"Online Rate", DIVIDE([Online], [Total Devices])
)
ORDER BY [Online Rate] DESCOf the 243 offline devices, how long have they been unreachable? Short outages are routine. Anything over 7 days is a problem.
The bulk of offline devices (100 out of 243, or 41.2%) have been unreachable for less than 4 hours. This is normal churn: reboots, end-of-day shutdowns, brief network drops. These devices will almost certainly come back online without intervention.
The real concern sits on the right side of the chart. 55 devices (22.6%) have been dark for over 7 days. Of those, 38 have not checked in for 30+ days. These stale devices inflate your managed device count without providing any monitoring value. Each one is a billing line item with zero return, and each one drags down your online rate by roughly 0.01 percentage points.
EVALUATE
ADDCOLUMNS(
SUMMARIZECOLUMNS(
"Duration Bucket", SWITCH(
TRUE(),
DATEDIFF(BI_Datto_RMM_Devices[last_seen], TODAY(), HOUR) < 1, "<1 hour",
DATEDIFF(BI_Datto_RMM_Devices[last_seen], TODAY(), HOUR) < 4, "1-4 hours",
DATEDIFF(BI_Datto_RMM_Devices[last_seen], TODAY(), HOUR) < 24, "4-24 hours",
DATEDIFF(BI_Datto_RMM_Devices[last_seen], TODAY(), DAY) < 7, "1-7 days",
DATEDIFF(BI_Datto_RMM_Devices[last_seen], TODAY(), DAY) < 30, "7-30 days",
"30+ days"
),
BI_Datto_RMM_Devices[status] = "Offline",
"Device Count", COUNTROWS(BI_Datto_RMM_Devices)
),
"Pct of Offline", DIVIDE(
[Device Count],
CALCULATE(COUNTROWS(BI_Datto_RMM_Devices), BI_Datto_RMM_Devices[status] = "Offline")
)
)Online rate from November 2025 through April 2026, showing a steady climb from 91.2% to 93.7% while the fleet grew 12.7%.
The fleet grew from 3,412 to 3,847 devices over six months while online rates climbed steadily. That is a 2.5 percentage-point improvement despite onboarding 435 new endpoints. Mean time to recovery (MTTR) dropped from 4.8 hours to 3.4 hours -- a 29.2% improvement driven by alerting policy changes introduced in January and faster agent response workflows. The consistent upward slope shows these operational gains are compounding, not plateauing.
The 5.1 percentage-point gap between server and workstation online rates tells a clear story about where the problem sits.
Servers are performing well at 97.5%, in line with the industry target of 97%+ during business hours. They live in controlled environments with stable power, hardwired networking, and enterprise-grade UPS. The 20 offline servers are still a concern because each one represents a potential business-critical outage your team cannot see. The critical alert rate for servers (4.2%) is double that of workstations (1.8%), confirming that server downtime carries outsized operational impact.
Workstations at 92.4% are the main drag on the portfolio average. The 215 offline workstations include a mix of normal user behavior (shutdowns, travel, VPN disconnects) and genuinely problematic endpoints hidden in the noise. Separating one from the other requires looking at the duration data in section 3.0.
Six devices with Datto RMM agents installed that have stopped reporting entirely. Four are servers.
| Client | Device Name | Type | Last Seen | Agent Version | Days Silent | Action |
|---|---|---|---|---|---|---|
| Ironclad Services | SRV-DC-02 | Server | 2025-11-18 | v2.0.4 (outdated) | 138 | |
| Cobalt Systems | SRV-APP-03 | Server | 2025-12-01 | v2.0.8 (outdated) | 125 | |
| NovaTech Solutions | WS-ACCT-14 | Workstation | 2026-01-22 | v2.1.8 (outdated) | 73 | |
| Redstone IT | WS-SALES-07 | Workstation | 2026-02-10 | v2.2.0 (outdated) | 54 | |
| Vanguard Tech | SRV-DB-01 | Server | 2026-02-14 | v2.1.4 (outdated) | 50 | |
| Redstone IT | SRV-MAIL-01 | Server | Never | v2.2.0 (outdated) | -- |
These six ghost agents span five clients and share a common trait: all are running outdated agent versions. Ironclad Services has a domain controller (SRV-DC-02) that has not reported in 138 days on agent version 2.0.4. Redstone IT has a mail server (SRV-MAIL-01) that has never successfully checked in, pointing to a failed deployment. Each ghost agent inflates the managed device count, which affects per-device pricing, SLA calculations, and every metric in this report. Removing or reinstalling these six endpoints would immediately improve the online rate by roughly 0.1%.
The gap between top and bottom performers is wider than expected. The bottom 20% scores more than 25 percentage points below the portfolio average, indicating structural issues that require targeted intervention.
Entities in the moderate risk category show a declining trend over the past quarter. Without intervention, 3-4 of these entities may shift to the high-risk category within 60 days.
The top 30% of the portfolio maintains stable performance above target, indicating current best practices are effective and can serve as a model for the rest.
1. Conduct a targeted review of all high-risk entities within 2 weeks. Document the root cause for each entity and create a remediation plan with clear deadlines and accountable owners.
2. Implement automated monitoring for the moderate-risk group. Set thresholds that trigger an alert when performance drops 5 percentage points below target, enabling early intervention before entities slip into high risk.
3. Schedule this report monthly as part of the QBR process. Use the trend data to verify that improvement initiatives are delivering measurable results across multiple quarters.
A device is marked offline when its Datto RMM agent fails to check in with the platform for more than 30 minutes. This can be caused by network outages, device shutdowns, agent crashes, firewall blocks, or VPN disconnects. The status updates automatically when the agent resumes communication.
Servers should be investigated within 15 minutes during business hours. Workstations should be reviewed within 4 hours if the user has reported an issue, or within 24 hours for routine checks. After-hours, focus on servers and business-critical infrastructure only. Devices offline for more than 7 days should be flagged for manual follow-up regardless of type.
Yes, but be selective. Alert clients about server downtime and business-critical workstations. Sending offline alerts for employee laptops that shut down at 5 PM creates noise and erodes your credibility. Build a tiered notification policy: immediate for servers, daily digest for workstations, weekly summary for the full fleet.
During business hours, aim for 97%+ for servers and 92%+ for workstations. A blended portfolio rate above 95% is considered strong. Below 90% on any device type signals systemic issues with agent health, network reliability, or device lifecycle management. This portfolio sits at 93.7% blended, which is acceptable but leaves room for improvement at the bottom-tier clients.
Ghost agents inflate total device count, pulling down online rate percentages and skewing per-device cost calculations. A device that has not reported in 90+ days should be decommissioned or reinstalled. Leaving ghost agents in place means billing for and reporting on devices with zero visibility. Removing the 38 stale devices in this portfolio would immediately bump the online rate from 93.7% to roughly 94.6%.
Configure Datto RMM policies to extend the offline threshold for laptop device types from 30 minutes to 2 hours. This filters out normal sleep/hibernate cycles and VPN reconnects. For remote workers, consider a separate monitoring policy that only flags devices offline for more than 8 business hours. This reduces alert noise without sacrificing visibility into genuinely problematic devices.
Connect Proxuma Power BI to your PSA, RMM, and M365 environment, use an MCP-compatible AI to ask questions, and generate custom reports - in minutes, not days.
See more reports Get started