Created by Claude - please verify

Defender antivirus health - as last reported to Intune by each device; a device that has not synced reports stale state.

Required Microsoft Graph permissions

DeviceManagementManagedDevices.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Intune (Windows devices with Microsoft Defender Antivirus).

Endpoints: GET /v1.0/deviceManagement/managedDevices · GET /v1.0/deviceManagement/managedDevices/{id}/windowsProtectionState (scan)

Protection state is only available per device, so it comes from an on-demand scan: one Graph call per Windows device, 4 in flight.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Defender Antivirus Health

Windows devices whose Microsoft Defender Antivirus is off, has real-time or tamper protection disabled, runs on outdated signatures, or needs a reboot to finish remediation - as reported to Intune. A device with protection off is the first place ransomware lands.

Reads the Defender state of 0 Windows devices.