IaC gaps

What is NOT Terraform

This page is generated from capability `configuration_methods.terraform` data. Use it to decide where a baseline needs REST, Graph, PowerShell, Microsoft365DSC, or manual validation instead of Terraform.

Terraform Gap Rollup

Capability	Product	Category	Gap	Microsoft References
Advanced Hunting	Microsoft Defender for Endpoint	Investigation	Advanced hunting is a query capability, not a desired-state resource. Automate saved queries or query execution through Graph/REST scripts.	Advanced hunting in Microsoft Defender XDR Use the Microsoft Graph security API security: runHuntingQuery
Attack Surface Reduction	Microsoft Defender for Endpoint	Prevention	No azurerm resource exists for ASR policy. Use Intune/Graph automation or Microsoft365DSC rather than Terraform.	Overview of attack surface reduction capabilities
Automated Investigation and Response	Microsoft Defender for Endpoint	Detection and response	Automation level and investigation settings are tenant/device-group configuration exposed only via the Defender for Endpoint API and Graph Security API, not ARM/Terraform. Automate with a script step inside the same pipeline that runs Terraform, not Terraform itself.	Automated investigation and response
Endpoint Detection and Response	Microsoft Defender for Endpoint	Detection and response	MDE onboarding and EDR settings are not ARM/Terraform resources. Automate onboarding packages and Intune/Graph policy outside Terraform.	Endpoint detection and response
Threat and Vulnerability Management	Microsoft Defender for Endpoint	Exposure management	Vulnerability inventory and recommendations are operational data exposed through APIs, not Terraform-managed desired state.	Microsoft Defender Vulnerability Management
Defender for Identity Sensors	Microsoft Defender for Identity	Deployment	Sensor deployment and directory service account configuration have no ARM/Terraform/Graph desired-state surface. Treat as manual/scripted PowerShell plus host configuration, not tenant IaC.	Manage and update Microsoft Defender for Identity sensors Microsoft Defender for Identity deployment overview
Identity Alerts and Incidents	Microsoft Defender for Identity	Detection	Alerts and incidents are operational records exposed through Graph/Defender XDR, not Terraform-managed resources.	What is Microsoft Defender for Identity?Use the Microsoft Graph security API
Identity Health Issues	Microsoft Defender for Identity	Monitoring	Health issues are monitoring data, not desired-state configuration.	Use the Microsoft Graph security API
Identity Response Actions	Microsoft Defender for Identity	Response	Identity response actions are operational Graph/portal actions, not Terraform desired state.	Use the Microsoft Graph security API
Attack Simulation Training	Microsoft Defender for Office 365	Education	No azurerm/azapi resource exists for Attack Simulation Training campaigns.	Microsoft Defender for Office 365 Features service description
Explorer and Real-time Detections	Microsoft Defender for Office 365	Investigation	Explorer is an investigation surface, not Terraform-managed configuration.	Microsoft Defender for Office 365 documentation
MDO Advanced Hunting	Microsoft Defender for Office 365	Hunting	Advanced hunting query execution is API/script automation, not Terraform desired state.	Advanced hunting in Microsoft Defender XDR Microsoft Defender for Office 365 service description
Microsoft Defender XDR Integration	Microsoft Defender for Office 365	Integration	Defender XDR integration is service-side capability wiring, not an ARM/Terraform resource.	Microsoft Defender for Office 365 service description
Office 365 Automated Investigation and Response	Microsoft Defender for Office 365	Response	MDO AIR is a Defender XDR operational capability, not an azurerm/azapi resource.	Microsoft Defender for Office 365 documentation
Preset Security Policies	Microsoft Defender for Office 365	Configuration	Preset security policy assignments are Defender portal/Exchange Online configuration, not ARM/Terraform resources. Automate through PowerShell where supported.	Preset security policies
Safe Attachments	Microsoft Defender for Office 365	Protection	No azurerm/azapi resource exists for Safe Attachments policies. Use Exchange Online PowerShell or Microsoft365DSC. Alternative	Set up Safe Attachments policies in Microsoft Defender for Office 365
Safe Links	Microsoft Defender for Office 365	Protection	No azurerm/azapi resource exists for Exchange Online Protection policies. Manage via Exchange Online PowerShell wrapped in a pipeline task, or via Microsoft365DSC (M365DSCConfig resource EXOSafeLinksPolicy) for a declarative/idempotent alternative. Alternative	Microsoft Defender for Office 365 Features service description
Threat Submissions	Microsoft Defender for Office 365	Investigation	Threat submissions are operational actions, not desired-state infrastructure.	Use the Microsoft Graph security API
Content Hub	Microsoft Sentinel	Content management	No azurerm resource exists for Content Hub package installation. Use REST/azapi or deploy the package artifacts as explicit resources.	Discover and deploy Microsoft Sentinel out-of-the-box content and solutions
Incidents	Microsoft Sentinel	Investigation	Incidents are operational records, not desired-state configuration. Manage incident state through REST/Graph automation, not Terraform.	Manage your SOC better with incident metrics in Microsoft Sentinel Incidents - REST API
Threat Intelligence	Microsoft Sentinel	Threat management	Threat intelligence indicators are operational data. Ingest with the Sentinel STIX upload API from a pipeline/script step, not Terraform.	Threat intelligence in Microsoft Sentinel Import threat intelligence to Microsoft Sentinel with the upload API
User and Entity Behavior Analytics	Microsoft Sentinel	Analytics	No dedicated azurerm resource is recorded for UEBA configuration. Use REST/azapi if automating tenant-specific settings.	Identify advanced threats with User and Entity Behavior Analytics in Microsoft Sentinel

Declarative Alternatives

For Microsoft 365 policy surfaces that are not ARM resources, use Microsoft365DSC where it has resource coverage and Microsoft Graph where the policy surface is Graph-native.

Defender for Office Safe Links policy with Microsoft365DSC

powershell

EXOSafeLinksPolicy 'BaselineSafeLinks' {
    Identity                     = 'Baseline Safe Links'
    EnableSafeLinksForEmail      = $true
    EnableSafeLinksForTeams      = $true
    EnableSafeLinksForOffice     = $true
    TrackClicks                  = $true
    AllowClickThrough            = $false
    ScanUrls                     = $true
}

EXOSafeLinksPolicyMicrosoft365DSC Set up Safe Links policiesMicrosoft Learn

Defender for Office Safe Attachments policy with Microsoft365DSC

powershell

EXOSafeAttachmentPolicy 'BaselineSafeAttachments' {
    Identity           = 'Baseline Safe Attachments'
    Enable             = $true
    Action             = 'Block'
    Redirect           = $false
}

EXOSafeAttachmentPolicyMicrosoft365DSC Set up Safe Attachments policiesMicrosoft Learn

Export Microsoft 365 tenant state with Microsoft365DSC

powershell

Export-M365DSCConfiguration \
  -Components @('EXOSafeLinksPolicy', 'EXOSafeAttachmentPolicy') \
  -Path './m365dsc'

Microsoft365DSC user guideMicrosoft365DSC Exchange Online PowerShell in Microsoft 365 DefenderMicrosoft Learn

Conditional Access named location with Microsoft Graph

http

POST https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations
Authorization: Bearer <graph-token>
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.ipNamedLocation",
  "displayName": "Corporate egress",
  "isTrusted": true,
  "ipRanges": [
    {
      "@odata.type": "#microsoft.graph.iPv4CidrRange",
      "cidrAddress": "203.0.113.0/24"
    }
  ]
}

namedLocation resource typeMicrosoft Learn Create namedLocationMicrosoft Learn