Created by Claude - please verify

Hardening - Defender Vulnerability Management secure configuration assessment through advanced hunting (top 300).

Required Microsoft Graph permissions

ThreatHunting.Read.All — application permission, granted to the app registration with admin consent.

Licence: Defender for Endpoint P2 or Defender Vulnerability Management.

Endpoint: POST /v1.0/security/runHuntingQuery (DeviceTvmSecureConfigurationAssessment, ...KB)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Device Hardening Gaps (Secure Configuration Assessment)

Credential Guard, LSA protection, SMBv1, Office macro settings, BitLocker and hundreds more: which hardening settings fail on the most devices, ranked by impact. The configuration counterpart of Exploitable Vulnerabilities.