capability

Defender for Endpoint Policy Management

Policy management for Microsoft Defender for Endpoint covers onboarding, endpoint protection, attack surface reduction, antivirus, firewall, and endpoint detection and response settings.

capabilitiesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproduct Microsoft Defender for Endpoint P1
Required licenselicense Microsoft Defender for Endpoint P2
Required licenselicense DeviceEvents
Related tabletable IntuneAuditLogs
Related tabletable IntuneOperationalLogs
Related tabletable Microsoft Defender for Endpoint APIs
API accessapi

Configuration Methods

Method	Support	Reference or Gap
Portal	Supported	Reference
PowerShell	Gap	PowerShell is not the primary policy authoring surface for Intune-managed settings.
REST API	Gap	Use Microsoft Graph for Intune policy automation.
Graph	Supported	Reference
ARM	Gap	Intune device policies are not ARM resources.
Bicep	Gap	Intune device policies are not Bicep resources.
Terraform	Gap	Use Intune portal, Microsoft Graph, or Microsoft365DSC for policy management; no first-party azurerm resource represents these policies.
GitHub Actions	Gap	Use Graph authentication and a dedicated automation workflow rather than a native GitHub Actions provider.
Azure DevOps	Gap	Use Graph authentication and a dedicated pipeline rather than a native Azure DevOps provider.

Related KQL

Review Intune policy changes by operator

Summarize Intune audit activity by operation, identity, and result to spot policy edits, assignment changes, and deletions.

template

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneAuditLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneAuditLogs
| where TimeGenerated > ago({lookback})
| where OperationName has_any ("Create", "Update", "Delete", "Assign")
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Identity, ResultType
| order by LastSeen desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from Intune operational diagnostics themes for existing IntuneAuditLogs coverage.