Detect missing MDE licensing.

az account show \
  --query "{tenantId:tenantId, tenantDisplayName:tenantDisplayName, tenantDefaultDomain:tenantDefaultDomain, user:user.name, subscription:name}" \
  --output table

az rest \
  --method GET \
  --url https://graph.microsoft.com/v1.0/subscribedSkus \
  --query "value[].{sku:skuPartNumber, consumed:consumedUnits, enabled:prepaidUnits.enabled, plans:servicePlans[?contains(servicePlanName, 'DEFENDER') || contains(servicePlanName, 'ATP') || contains(servicePlanName, 'MTP') || contains(servicePlanName, 'INTUNE')].{name:servicePlanName,status:provisioningStatus,appliesTo:appliesTo}}" \
  --output json

az rest \
  --method GET \
  --url 'https://graph.microsoft.com/v1.0/me?$select=id,displayName,userPrincipalName,assignedLicenses,assignedPlans' \
  --output json

az rest \
  --method GET \
  --url 'https://graph.microsoft.com/v1.0/organization?$select=id,displayName,provisionedPlans' \
  --output json

USER_ID="$(az rest \
  --method GET \
  --url 'https://graph.microsoft.com/v1.0/me?$select=id' \
  --query id \
  --output tsv)"

az rest \
  --method GET \
  --url "https://graph.microsoft.com/v1.0/users/${USER_ID}/memberOf?\$select=id,displayName,roleTemplateId" \
  --query "value[?displayName=='Global Administrator']" \
  --output table

az rest \
  --resource https://api.securitycenter.microsoft.com \
  --method GET \
  --url 'https://api.securitycenter.microsoft.com/api/machines?$top=1' \
  --output json

Connect-MgGraph -Scopes @(
  "Organization.Read.All",
  "User.Read.All",
  "Directory.Read.All"
)

$skus = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/subscribedSkus"

$skus.value | ForEach-Object {
  $sku = $_
  $sku.servicePlans |
    Where-Object { $_.servicePlanName -match "DEFENDER|ATP|MTP|INTUNE|WINDEF" } |
    Select-Object `
      @{Name = "Sku"; Expression = { $sku.skuPartNumber } },
      servicePlanName,
      provisioningStatus,
      appliesTo
}

$token = az account get-access-token `
  --resource https://api.securitycenter.microsoft.com `
  --query accessToken `
  --output tsv

try {
  Invoke-RestMethod `
    -Method GET `
    -Uri "https://api.securitycenter.microsoft.com/api/machines?`$top=1" `
    -Headers @{ Authorization = "Bearer $token" }
} catch {
  $_.Exception.Response.StatusCode.value__
  $_.ErrorDetails.Message
}

#!/usr/bin/env bash
set -euo pipefail

subscribed_skus="$(az rest \
  --method GET \
  --url https://graph.microsoft.com/v1.0/subscribedSkus \
  --output json)"

mde_status="unknown"
mde_error=""

set +e
mde_response="$(az rest \
  --resource https://api.securitycenter.microsoft.com \
  --method GET \
  --url 'https://api.securitycenter.microsoft.com/api/machines?$top=1' \
  --output json 2>&1)"
mde_exit=$?
set -e

if [ "$mde_exit" -eq 0 ]; then
  mde_status="active"
elif printf '%s' "$mde_response" | grep -qi "Account mode is inactive"; then
  mde_status="inactive"
  mde_error="Account mode is inactive"
elif printf '%s' "$mde_response" | grep -qi "Forbidden"; then
  mde_status="forbidden"
  mde_error="Forbidden without inactive-account marker"
else
  mde_status="error"
  mde_error="$mde_response"
fi

has_enterprisepremium="$(printf '%s' "$subscribed_skus" |
  jq -r '[.value[] | select(.skuPartNumber == "ENTERPRISEPREMIUM")] | length > 0')"

defender_plan_names="$(printf '%s' "$subscribed_skus" |
  jq -r '[.value[].servicePlans[].servicePlanName |
    select(test("DEFENDER|ATP|MTP|INTUNE|WINDEF"; "i"))] | unique | join(",")')"

jq -n \
  --arg has_enterprisepremium "$has_enterprisepremium" \
  --arg defender_plan_names "$defender_plan_names" \
  --arg mde_status "$mde_status" \
  --arg mde_error "$mde_error" \
  '{
    has_enterprisepremium: $has_enterprisepremium,
    defender_plan_names: $defender_plan_names,
    mde_status: $mde_status,
    mde_error: $mde_error
  }'

data "external" "mde_license_check" {
  program = ["bash", "${path.module}/scripts/check-mde-license.sh"]
}

locals {
  mde_status = data.external.mde_license_check.result.mde_status
  mde_error  = data.external.mde_license_check.result.mde_error
}

check "mde_is_active_before_sentinel_device_tables" {
  assert {
    condition     = local.mde_status == "active"
    error_message = "Microsoft Defender for Endpoint is not active for this tenant. Status: ${local.mde_status}. Error: ${local.mde_error}. Do not deploy Sentinel content that assumes DeviceEvents or other MDE Device tables."
  }
}

DeviceInfo
| take 10

DeviceEvents
| summarize Events=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)

DeviceInfo
| summarize Rows=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)

union isfuzzy=true
  DeviceEvents,
  DeviceProcessEvents,
  DeviceNetworkEvents,
  DeviceFileEvents,
  DeviceRegistryEvents,
  DeviceLogonEvents,
  DeviceImageLoadEvents
| summarize Rows=count() by Type
| order by Rows desc