Wardline for Microsoft Defender and AI agents

Configured isn’t protected.

Wardline shows where Microsoft Defender and your AI agents actually have gaps – on Windows, macOS and Linux, not just in your policies. It runs in your own Azure tenant, read-only.

Get started free How it works

Your policy says one thing. The device does another.

Wardline checks every setting on three levels: what you want, what Intune configures, and what is actually effective on the device. The gap between the last two is where attackers get in.

Setting Targetyour baseline Configuredin Intune Effectiveon the device
Tamper protection On On Off on 14 devices
Real-time protection, Linux On On Off on 3 servers via mdatp config
ASR: credential stealing from LSASS Block Block Audit on 212 devices
Local admin exclusions Ignored Not set Merged on 312 devices

Effective state comes from Defender itself – Advanced Hunting and threat and vulnerability management – not from the policy.

Endpoint

Every exclusion. From every source.

Intune, Security Settings Management, changes made locally on the device and allow indicators in Defender for Endpoint – for Windows, macOS and Linux, in one list. Every entry gets a risk rating you can follow: the broader, the more writable and the less centrally managed, the riskier.

Wardline devices page: protection state per Defender feature as charts
Devices: the actual state on every device – regardless of what the policies say.

Windows

Exclusions from Intune, Group Policy and the local registry, ASR rules per device and device group, baseline, tamper and network protection, platform and signature age.

macOS

Exclusions from Intune and local mdatp commands, baseline, Full Disk Access and system extensions, agent version.

Linux

Global exclusions that also blind EDR, local changes through mdatp config and mdatp_managed.json, real-time protection, agent version.

Exclusions that blind EDR, too.

Most exclusions only affect the virus scanner. Linux global exclusions and allow indicators also switch off detection. Wardline gives them their own view.

Local exclusions, remembered.

Added by someone on the device, not in any policy. Wardline finds them through Advanced Hunting and keeps the history beyond Defender’s 30 days.

ASR, as it really runs.

Target, configured and effective mode for every rule – overall, per Defender device group and per device, including conflicts between policies and ASR exclusions.

Baseline, with drift.

Microsoft Defender Antivirus on Windows, macOS and Linux against your baseline – and exactly what changed since the last run.

Exclusions nobody needs.

Did anything run from that path in the last 30 days? If not, the exclusion is a blind spot you can remove.

Devices Defender never saw.

Wardline compares Intune-managed devices with Defender for Endpoint and lists every device that was never onboarded – the gaps no Defender report can show you.

Hygiene, not just settings.

Operating systems past end of support, devices without a recent scan, WSL without the Defender plug-in, detected threats set to “allow”, passive mode without EDR in block mode – and ASR rules that are ready for block because audit saw nothing in 30 days.

From device risk to sign-in.

Is the Intune connector on for every platform you use? Does compliance require a low machine risk score, and does Conditional Access enforce it? Otherwise a compromised device keeps its access.

And everything else that quietly goes wrong

  • Third-party AV/EDR running next to an active Defender Antivirus
  • Tampering attempts and troubleshooting mode sessions
  • Internet-facing devices with high exposure
  • Platform, engine and signature age, update rings
  • Macs without Full Disk Access or approved system extensions
  • Investigations waiting for approval, forgotten isolations
  • Duplicate, ungrouped and long-inactive devices
  • Devices excluded from vulnerability management

Small gaps add up.

A local exclusion is a risk. Tamper protection switched off is a risk. Both on the same device means anyone with local admin rights can blind Defender – and nobody notices. Wardline connects the dots and rates the combination.

DEV-LT-0412 Tamper protection off Medium
DEV-LT-0412 4 local exclusions, including powershell.exe High
DEV-LT-0412 Defender can be switched off locally, without a trace Critical

More combinations Wardline detects

  • Passive mode with local exclusions
  • Local exclusions that take effect because DisableLocalAdminMerge or exclusionsMergePolicy is missing
  • ASR rules left in audit mode for good
  • Local AI agents with auto-approve on a weakened device

AI agents Beta

Every AI agent, accounted for.

Copilot Studio, Foundry and custom agents from Microsoft Entra Agent ID, the Agent 365 registry and Defender – plus the coding assistants running on your endpoints.

Cloud agents

A policy for the agent identity doesn’t apply to its agent user. And “All users” doesn’t include agent users. Wardline rates both separately.

BlueprintContoso Agent Platform3 agents
Agent identityInvoice TriageProtected
Agent userinvoice-triage@contoso.comNot covered

Local agents

Local agents run with the rights of the signed-in user, so Conditional Access doesn’t reach them. What matters is the device and how the agent is configured.

CursorDEV-LT-0388 · a.schulz
Auto-approve
On
MCP servers
3, 2 without a fixed version
npx -y @modelcontextprotocol/server-filesystem
Device
Tamper off, 2 local exclusions
Wardline Conditional Access for agents: policies and agents not effectively protected
Conditional Access for agents: which policies cover agent identities and agent users – and which agents are left out.
  • Agents without Conditional Access or sponsor
  • Orphaned agent users and unknown blueprints
  • Cloud agents without an Entra Agent ID
  • Security defaults that bypass Conditional Access

Access Optional

Who holds the keys to Defender?

Wardline reads Defender XDR unified RBAC: who holds which Defender role, which data sources it covers and whether it was ever used – no matter if it was assigned directly, through a group, eligible in PIM for groups or through an access package in entitlement management.

K. BeckerDirect, permanentNever used
SOC Tier 2Through a groupIn use
L. HoffmannPIM for groupsEligible
Incident ResponseAccess package → groupRequestable

Who can do what?

Search by role or a single permission – live response, for example – and see everyone who has it, or could get it.

My access, for everyone.

Every employee can see their own Defender roles, with links to PIM and My Access. No ticket needed.

Apps with Defender rights.

Service principals that can offboard, isolate or run live response through the Defender APIs – with client secrets, credential lifetime and owners. Plus role groups without access review and PIM activation without MFA.

What happened in the portal.

From the Purview audit log: who downloaded an offboarding package, who ran live response, which settings were changed. None of it shows up in a device timeline.

Licences Optional

Licences bought. Devices onboarded. Do they match?

For Defender for Endpoint, Wardline sets the plans you bought against the users who hold them and the client devices that are actually onboarded – and who uses them. Servers are listed separately.

Wardline licence indication for Defender for Endpoint
An indication, not an audit: the binding numbers are in the Microsoft 365 admin center and your agreement.

Every finding gets an owner.

Findings don’t fix themselves. Hand them to the people who can, accept the ones you consciously live with – and keep a record of every decision.

Wardline finding detail with assignment and an exception being created: justification, owner, ticket and expiry date
Every finding and every exclusion has the same small workflow: assign it, or document an exception.

Assign

Hand a finding or an exclusion to an Entra user, a security group or a distribution list, picked from the directory. The assignee shows up in the findings list, with its own filter.

Accept with a reason

Justification, owner, optional ticket and an expiry date – or no expiry. Accepted items stop counting as open and come back on their own when the exception expires.

Audit log

Every accept, revoke, assign and unassign is recorded with who and when – the trail your auditor asks for.

Notifications

New findings above the severity you choose go to Teams or Power Automate – including the assignee, so a flow can e-mail them directly.

Every run, on record.

Dated snapshots in your own storage account, optionally immutable. See the drift between two runs and export any table as CSV – evidence your auditor can work with.

Wardline changes between runs with a chart of changes per day
Changes: what was added, changed or removed between two runs, day by day.

Runs in your tenant. Nothing leaves it.

Wardline is not a cloud service you send data to. You deploy it into your own Azure subscription, and it only ever reads.

Self-hosted

Portal, collector and snapshots live in your subscription. No vendor cloud, no tenant data with us.

No secrets

Managed identity and workload identity federation. No client secrets, certificates or storage keys to rotate.

Read-only, per feature

Each feature adds only the read-only permissions it needs. Turn a feature off and its permissions are removed.

Separation of duties

Your identity team can create the app registrations up front. The Azure team only attaches them.

# Show exactly what will be granted
./setup/Install-Wardline.ps1 -ShowPermissions

# Deploy into your subscription
./setup/Install-Wardline.ps1 -ResourceGroup rg-wardline -Location westeurope
See every permission before anything is granted. Wardline never updates itself – new releases show their checksums and new permissions first.

Evidence for ISO/IEC 27001:2022, NIST CSF 2.0, SOC 2 and GDPR. Wardline provides evidence, not certification.

View the compliance mapping

Two plans. That’s it.

Start free in your lab. Switch to Enterprise when Wardline runs in production.

Community

Free

For labs and evaluation.

  • Everything collected, in every module
  • The first 10 entries of every list in clear, the rest masked
  • Summaries, charts and history complete
Get started

Enterprise

€19 per month

or €199 per year, per tenant. For production.

  • Every list in full, with CSV export
  • Endpoint + Agent 365 (beta) included; additional modules can be added later
  • Priority support and a direct line into the roadmap
Get started

Your licence key is checked offline – nothing is sent to us. Wardline’s Azure resources run in your subscription and are billed by Microsoft.

FAQ

Questions, answered.

What is Wardline?

Wardline is a self-hosted security posture tool for Microsoft Defender for Endpoint, Intune, Entra ID and AI agents. It compares what you want, what Intune configures and what is actually effective on each device, and turns the gaps into findings.

Does Wardline send data out of my tenant?

No. Wardline runs as an Azure Function App in your own Azure subscription and stores results in your own storage account. It uses read-only application permissions and never calls home – not even for the licence check.

Which permissions does Wardline need?

Only read-only application permissions, and only for the features you select – for example ThreatHunting.Read.All for Advanced Hunting or DeviceManagementConfiguration.Read.All for Intune policies. The installer shows the exact list before it grants anything.

Which platforms are covered?

Windows, Windows Server, macOS and Linux devices onboarded to Defender for Endpoint, Intune policies for all three platforms, and AI agents in Entra Agent ID, Agent 365 and on local devices.

How is Wardline different from Microsoft Secure Score or the Defender portal?

The Defender portal shows each source on its own. Wardline combines them: exclusions from Intune, Group Policy, the local registry and mdatp in one list, ASR rules from target to effective mode, and findings that only appear when two weaknesses meet – such as local exclusions on a device without tamper protection.

What does Wardline cost?

Community is free and shows the first ten rows of every list. Enterprise costs €19 per month or €199 per year per tenant and removes the limit. Your Azure resources are billed by Microsoft.

How is Wardline installed?

One PowerShell script deploys the Function App, grants the selected permissions and registers the portal. After that, click “Collect now” – policies, devices and agents appear within minutes.

Does Wardline change anything in my environment?

No. Wardline only reads. Findings come with a recommendation; you decide what to change in Intune or the Defender portal.

Up and running before your coffee is cold.

  1. Open Azure Cloud Shell

    PowerShell, signed in to your tenant. Nothing to install locally.

  2. Run the installer

    It shows the permissions, deploys Wardline into a resource group and grants consent – or prints the command for your identity team.

  3. Sign in to the portal

    Click “Collect now”. Policies, devices and agents appear within minutes.

Get the release

Wardline is in private preview. You’ll receive the download link and setup guide by email.

We use your details only to send you Wardline. Privacy policy