Endpoint Security Policy Posture
The question it answers: Are attack surface reduction rules enforced or only audited, are firewalls on, and are security baselines current?
Attack surface reduction rules block the techniques ransomware uses - but many tenants leave them in audit mode for years. Firewall profiles switched off by policy and outdated security baselines are just as easy to miss. Defender Health shows device state; this report shows what the policies actually enforce.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › Endpoint Security Posture |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Intune; ASR rules need Defender for Endpoint / Windows E3+ for full value. |
| Report id (API and MCP) | intune.operations.endpoint-security-posture |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Control | Category | Text |
| Rule / profile / baseline | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Policy / assignment | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Intune; ASR rules need Defender for Endpoint / Windows E3+ for full value.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementConfiguration.Read.All | Microsoft Graph | Read Microsoft Intune device configuration and policies |
Data sources it reads
GET /beta/deviceManagement/configurationPolicies?$expand=settings,assignmentsGET /beta/deviceManagement/intentsGET /beta/deviceManagement/templates
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.endpoint-security-posture?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.endpoint-security-posture. The client needs the Read grant for Intune. See Using the API.