Skip to main content
{ Reporting and Compliance / Endpoint Security }

Microsoft Defender for Endpoint Posture Report

Delivers a weekly report on Defender for Endpoint sensor coverage, antivirus health, indicator and detection rule changes, and anything in the tenant that needs attention.

What this agent does

This read-only agent checks the health of a Microsoft Defender for Endpoint tenant every week. It summarizes how many devices are onboarded and healthy, and which are inactive, impaired, running antivirus in passive mode, or discovered but never onboarded. It lists indicator and custom detection rule changes since last week from the API, and suppression rule and device group changes from an export I hand it. It flags anything that needs an admin, such as antivirus out of date across a device group or a new allow indicator.

The challenge

Defender only protects devices where the sensor reports, antivirus runs in active mode, and the right policies reach the device group. Sensors go inactive, a device lands in a group with automated response turned off, and antivirus stays in passive mode on a server after the old product is removed. Device discovery finds unmanaged devices that nobody onboards. Admins find these gaps after an incident, not before.

The solution

The agent checks devices, antivirus health, indicators, rules, and the exported settings in one pass each week and compares them with the previous week. It lists what changed and what someone needs to act on, with the fix for each item. Provides a weekly briefing an admin can read in a few minutes.

Workflow

  1. 01

    Check devices

    Count onboarded and healthy devices, and find inactive, impaired, and no sensor data devices and devices discovered but never onboarded.

  2. 02

    Check antivirus

    Read the antivirus health report for mode and update state, and flag passive mode and not up to date by device group.

  3. 03

    Check controls

    Compare indicators and custom detection rules with last week from the API, and suppression rules and device groups from the export, and flag anything that weakens protection.

  4. 04

    Report

    Publish what changed and what needs action, with the fix for each item.

Agent template 

# Microsoft Defender for Endpoint Posture Report

## Measurable outcomes

Every week, the admin knows which devices Defender is not fully protecting, what changed in the tenant, and what needs action before it matters. Track onboarded and healthy devices, unprotected devices, and open action items on every run.

## Procedure

Once a week, read every device in the Defender for Endpoint tenant. Count the devices with an active sensor and active antivirus. List the devices whose health status is inactive, impaired communications, or no sensor data, and the devices whose last full report is more than 30 days old, unless I set another value. List the devices that device discovery found and that can be onboarded but are not. Read the antivirus health report. Flag devices where antivirus runs in passive mode or is off, and devices where the report marks the platform, the engine, or the security intelligence as not up to date, grouped by device group. Compare the indicators and the custom detection rules with last week's. Read the alert suppression rules, the device groups with their automation levels, and the web content filtering policies from the export I hand it, and compare them with last week's export. Report those surfaces as not assessed when I supply no export. Call out any change that weakens protection, such as a new allow indicator, a suppression rule scoped to all devices, a custom detection turned off, or a device group moved to no automated response. Name who made each change from the Microsoft Purview audit log when I grant access to it. Compare everything with last week's report, and lead with what changed. Give every action item the specific fix. Report a check it cannot run as not checked, never as fine. Replace device names and user names with stable pseudonyms in the report.

## Requirements

It needs read access to Defender for Endpoint devices, the antivirus health report, indicators, and custom detection rules, through an app registration with the Machine.Read.All, Ti.ReadWrite, and CustomDetection.Read.All permissions, optional read access to the Microsoft Purview audit log for the actor on each change, and the suppression rule, device group, and web content filtering export I hand it, and nothing more. The Ti.ReadWrite permission is the only one Defender offers for reading indicators, and the agent never writes with it. It never changes devices, indicators, rules, groups, or Defender configuration.