GULAB PRASAD

Curiosity Applied
DefenderPowerShell

Defedner for Microsoft 365, Identity (Entra) & Endpoint Audit Scripts

Gulab Prasad · · 1 min read

Two PowerShell scripts that take a snapshot of how your tenant is configured and hand you a tidy CSV and a color-coded HTML report. It read — it never change a single setting, so you can run them on a Friday afternoon without holding your breath.

Think of them as a flashlight, not a wrench. They show you what's there; you decide what to fix.

Script What it looks at
M365SecurityAudit.ps1 Defender for Office 365 (email/collaboration policies) + Entra identity (Security Defaults, Conditional Access, authorization policy)
DefenderEndpointAudit.ps1 Defender for Endpoint (device fleet posture + ASR rules)
A note on "Identity," because the naming is genuinely confusing. Entra identity posture — Security Defaults, Conditional Access, and so on — is covered, by Script 1 through Microsoft Graph. Defender for Identity (MDI) — the separate product with sensors on your on-prem domain controllers — is not covered by either script; it lives behind its own portal and API. When you say "Defender for Identity (Entra)" it usually mean the first one, which you've got.

They're deliberately kept separate because they talk to different services and need different permissions. Run one, run the other, or run both — they don't depend on each other.

Before you start

You'll need PowerShell 5.1 or (better) PowerShell 7, and depending on which script you're running, a couple of modules.

For the M365 script:
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Install-Module Microsoft.Graph -Scope CurrentUser

The Endpoint script doesn't need extra modules for its main (tenant) mode — it talks to the Defender API directly over HTTPS. Its optional local ASR check uses Get-MpPreference, which already ships with Windows.

A quick word on permissions: Global Reader is enough for everything the M365 script does. You do not need, and should not use, an admin account with write powers just to read config. The Endpoint script is a little different — see its section below.

Download

M365SecurityAudit.ps1
DefenderEndpointAudit.ps1