Created by Claude - please verify

Endpoint security - ASR rule modes and firewall settings from settings-catalog policies, and security baseline versions (intents) - beta APIs.

Required Microsoft Graph permissions

DeviceManagementConfiguration.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Intune; ASR rules need Defender for Endpoint / Windows E3+ for full value.

Endpoints: GET /beta/deviceManagement/configurationPolicies?$expand=settings,assignments · GET /beta/deviceManagement/intents · GET /beta/deviceManagement/templates

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Endpoint Security Policy Posture

Attack surface reduction rules block the techniques ransomware uses - but many tenants leave them in audit mode for years. Firewall profiles switched off by policy and outdated security baselines are just as easy to miss. Defender Health shows device state; this report shows what the policies actually enforce.