"Scan Now" on a single device and "Scan All Devices" on your fleet list both do the same thing, and it's less than you might expect: they don't scan anything themselves. Both just flag the device (or every device) for the agent to pick up on its own.
Clicking either button sends a request that sets one flag on the device's record — nothing else. No DNS lookup happens at that moment, no network request goes out to test anything. The button greys out and its label changes to "Scanning now…" (or "Scanning all devices…" for the fleet-wide button), but that's the UI reflecting a flag that was just set, not a scan actually running yet.
About every 30 seconds, the agent asks the dashboard whether a scan has been requested. If nothing's pending, it also updates its heartbeat before checking again. If your click set that flag, the agent runs a scan immediately instead of waiting for its next scheduled one. If you don't request anything, the agent runs on its own schedule anyway — by default once an hour.
If a device is offline or its agent was uninstalled, the flag you set by clicking Scan Now has no one left to pick it up. Rather than leaving the button disabled forever in that case, the dashboard treats a request older than five minutes as abandoned and re-enables the button — even though, if the device never checks in, the underlying flag is still sitting there waiting.
The flag isn't cleared the moment the agent sees it — it's cleared when the agent finishes the scan and submits its results back to the dashboard. That happens in the same step as the device's regular heartbeat update, so a failure partway through can't leave your results saved while the dashboard is still stuck showing "waiting."
Neither button does anything for a device you added by browser check rather than the agent — there's no installed agent on those to ever poll for the flag, so both Scan Now and Scan All Devices skip them entirely. If every device on your account happens to be browser-checked, clicking Scan All Devices tells you so directly and points you at "Get Check Link" for each device instead of a generic error.
For what the scan itself actually tests once the agent picks it up, see how the scanner works.