---
name: Defender ASR and Endpoint Config Assessment
description: Read-only audit of Microsoft Defender for Endpoint ASR rules and endpoint hardening against Essential Eight application controls.
---

# Defender ASR and Endpoint Config Assessment

> **TL;DR:** This skill inspects your Microsoft Defender for Endpoint attack surface reduction rules and endpoint protection settings, then scores them against Essential Eight application hardening without changing anything.

## What does a Microsoft Defender for Endpoint ASR assessment check?

Microsoft Defender for Endpoint provides attack surface reduction (ASR) rules within Microsoft Defender Antivirus that constrain risky software behaviours attackers exploit, such as Office apps spawning child processes or scripts launching downloaded executables. This skill reads the configured state of those rules alongside related hardening capabilities such as controlled folder access, network protection and exploit protection. It correlates that posture with the Essential Eight application hardening and the ISM, surfacing gaps where rules sit in audit or disabled mode rather than block mode. Reporting is centralised through the Microsoft Defender portal and Microsoft Defender XDR, with policy typically governed through Microsoft Intune endpoint security.

## When should you run this skill?

- "Are our Defender ASR rules actually in block mode or just auditing?"
- "How does our endpoint hardening map to Essential Eight application controls?"
- "Show me which ASR rules are misconfigured or not configured at all."
- "We have an ASD Essential Eight maturity review coming up, where do we stand on application hardening?"
- "Is controlled folder access and network protection enabled across our fleet?"
- "Which devices are missing standard protection ASR rules before our audit?"
- "Give me an evidence pack for our ISM endpoint hardening controls."

## How this skill works, step by step

1. Connect read-only to the Microsoft Defender portal and Microsoft Intune endpoint security policies to enumerate the ASR rule configuration applied to managed Windows devices.
2. Inventory each ASR rule and record its mode (block, audit, warn, disabled or not configured) using the documented mode codes.
3. Identify whether the standard protection rules are enabled in block mode, since these are the recommended baseline.
4. Read the state of complementary hardening capabilities: controlled folder access, network protection, exploit protection and device control.
5. Compare the observed configuration against Essential Eight application hardening expectations and relevant ISM controls.
6. Flag rules left in audit mode, set to not configured, or weakened by broad exclusions.
7. Derive a per-control risk score: each gap is weighted by exploitability (rules in disabled or not configured mode score higher risk than audit mode), then aggregated into an overall maturity indicator.
8. Compile the findings into a structured table with remediation guidance and supporting evidence references.

## Output format

The skill returns a findings table followed by a short summary. Each row covers one ASR rule or hardening capability, its observed state and the mapped control.

| Capability | Observed state | Essential Eight mapping | Risk | Recommendation |
| --- | --- | --- | --- | --- |
| Block all Office applications from creating child processes | Audit | Application hardening | High | Move rule to block mode after validating line-of-business apps |
| Block executable content from email client and webmail | Block | Application hardening | Low | Maintain; confirm no broad exclusions weaken coverage |
| Controlled folder access | Not configured | Application hardening | Medium | Enable to protect against ransomware file modification |

Summary points returned alongside the table:

- Count of ASR rules in block, audit and not configured states.
- Whether all standard protection rules meet the recommended block baseline.
- Overall application hardening maturity indicator and the top remediation priorities.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Centralised ASR rule management and reporting in Microsoft Defender for Endpoint | Microsoft Defender for Endpoint Plan 1 (included in Microsoft 365 E3) |
| Advanced hunting for ASR rule events in Microsoft Defender XDR | Microsoft Defender for Endpoint Plan 2 (included in Microsoft 365 E5) |
| Policy deployment via Microsoft Intune endpoint security | Microsoft Intune Plan 1 (included in Microsoft 365 E3) |

### Least-privilege roles

- Security Reader (Microsoft Entra) for read-only visibility of Defender configuration and reports.
- Intune Read Only Operator for viewing endpoint security policy assignments without edit rights.

### Microsoft Graph permissions (read-only)

- `DeviceManagementConfiguration.Read.All` — reads Microsoft Intune endpoint security and device configuration policies, including ASR rule settings, where the assessment is sourced via Microsoft Graph.
- Some signals are inspected directly in the Microsoft Defender portal and through Microsoft Defender Antivirus state on devices rather than via Microsoft Graph; in those cases the skill reads portal reports and advanced hunting results instead of calling Graph scopes.

## Scope and safety

This skill is read-only by default. It inspects configuration and reporting data and never changes rule modes, policies or device settings.

This skill does NOT:

- Modify, enable, disable or deploy any ASR rule or endpoint policy.
- Add, remove or alter ASR exclusions or controlled folder access lists.
- Onboard, isolate or take any response action against devices.
- Write to Microsoft Intune, the Microsoft Defender portal or device-local configuration.

## Sources and compliance

- [Attack surface reduction in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/overview-attack-surface-reduction)
- [Attack surface reduction (ASR) rules](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction)
- Maps to the Essential Eight application hardening mitigation strategy and supports ISM controls for application control and hardening of operating systems and applications.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.