Created by Claude - please verify

Exclusions - paths, processes and extensions excluded in Intune antivirus and ASR policies (settings catalog, beta).

Required Microsoft Graph permissions

DeviceManagementConfiguration.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Intune.

Endpoint: GET /beta/deviceManagement/configurationPolicies?$expand=settings,assignments

Only exclusions configured through Intune settings-catalog policies are read; local, GPO and Configuration Manager exclusions are not visible here.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Defender Antivirus & ASR Exclusions

Every exclusion is a place malware can hide: an excluded folder is not scanned, an excluded process can do anything, an excluded extension is never inspected. Broad or user-writable exclusions - temp folders, user profiles, *.ps1, powershell.exe - are flagged. The ASR and firewall modes are in Endpoint Security Posture.