A lightweight, JSON-driven deployment tool for Microsoft Defender for Endpoint (MDE) policies using Microsoft Graph.
This project simplifies how Defender policies are deployed by enabling repeatable, consistent security baselines across environments.
Deploying Defender for Endpoint policies manually can be:
- Time-consuming
- Inconsistent across environments
- Difficult to validate
This tool provides a simple deployment engine that:
- Uses JSON-based configurations
- Automates policy creation via Microsoft Graph
- Enables repeatable security deployments
- Supports Defender Antivirus baseline configuration via Settings Catalog
- Integrates with testing to validate security controls
- ✅ Deploy Settings Catalog policies via Microsoft Graph
- ✅ JSON-driven configuration model
- ✅ Built-in validation before deployment
- ✅ Export existing policies from Intune
- ✅ Simple UI for execution and visibility
- 🔥 Firewall
- 🛡️ Attack Surface Reduction (ASR)
- 📡 Endpoint Detection & Response (EDR) (supported settings only)
- 🪟 Windows Security Experience
- 🛡️ Defender Antivirus (Settings Catalog / AV Configuration Controls)
This tool focuses on Settings Catalog-based deployment via Microsoft Graph.
Some Defender capabilities require alternative deployment methods.
-
Must be created and exported from:
-
❌ Endpoint Security Firewall profiles are not supported
-
✅ Only Settings Catalog firewall configurations can be deployed
- Supported via Settings Catalog (AV Configuration Controls)
Limitations:
- ❌ Onboarding / connector-based settings
- ❌ Tenant-bound or encrypted values
- ❌ Some advanced AV configurations
Recommended:
Use Endpoint Security for:
- Advanced configurations
- Onboarding
- Tenant-specific settings
- Connector-based onboarding is not supported
Do NOT include:
- Only supported, non-connector-based settings should be used
- All policies must originate from Settings Catalog exports
Hand-built JSON may fail due to:
- Incorrect setting types (Simple vs Choice)
- Missing template references
- Invalid values for tenant-specific schemas
This tool uses:
Some Defender features use different APIs and are not included in Phase 1.
Built-in validation checks:
- JSON structure
- Presence of settings
Does NOT validate:
- Tenant compatibility
- Setting-level Graph constraints
- Endpoint Security template conflicts
This tool is designed for:
- Repeatable baseline deployment
- Settings Catalog policy automation
Not included yet:
- Automatic policy assignment
- Endpoint Security policy deployment
- Drift detection
MDE-EndpointSecurityPolicyDeployment-Tool/ │ ├─ MDE-Deployment-Tool.ps1 │ ├─ Config/ │ └─ SettingsCatalog/ │ ├─ firewall.json │ ├─ asr.json │ ├─ edr.json │ ├─ windows-security-experience.json │ └─ avc-update-controls.json │ ├─ Logs/ └─ Reports/
Create policy in Intune Export JSON using the tool Store JSON in the repo Reuse for deployment
This tool is designed to work alongside:
👉 https://github.com/dferrell30/MDE-Test-Framework :contentReference[oaicite:0]{index=0}
Together, they enable:
Deploy → Test → Validate → Repeat
This project is intended for defensive security validation and educational use only.
- Do not use in unauthorized environments
- Do not use for offensive or malicious purposes
- Always test in approved lab or enterprise environments
Some actions may generate security telemetry and alerts.
This project is an independent work developed in a personal capacity.
- It is not affiliated with or endorsed by Microsoft
- No employer has reviewed or approved this work
- No proprietary or confidential resources were used
All opinions and content are solely my own.
Feedback, ideas, and suggestions are welcome.
Built to simplify Defender for Endpoint deployment and validation workflows.
Do not use this framework in unauthorized environments Do not use for offensive or malicious purposes Always perform testing in approved lab or enterprise environments Some tests generate telemetry that may trigger alerts
The author is not responsible for misuse of this tool or unintended impacts resulting from its execution.
This tool is provided for educational, testing, and security validation purposes only.
Use of this tool should be limited to:
Authorized environments Lab or approved enterprise systems The author assumes no liability or responsibility for:
Misuse of this tool Damage to systems Unauthorized or improper use By using this tool, you agree to use it in a lawful and responsible manner.
This project is not affiliated with or endorsed by Microsoft.
⚖️ Professional Disclaimer This project is an independent work developed in a personal capacity.
The views, opinions, code, and content expressed in this repository are solely my own and do not reflect the views, policies, or positions of any current or future employer, client, or affiliated organization.
No employer, past, present, or future, has reviewed, approved, endorsed, or is in any way associated with these works.
This project was developed outside the scope of any employment and without the use of proprietary, confidential, or restricted resources.
Beginning with the current Community Edition release, Shadow Suite repositories transitioned to the Business Source License 1.1 (BSL).
This change was made to support:
- long-term platform sustainability
- consistent Shadow Suite ecosystem licensing
- branding protection
- future platform development
- responsible community distribution
Shadow Suite Community Edition remains available for:
- personal use
- research
- educational use
- defensive security operations
- internal organizational evaluation
Commercial redistribution, managed service integration, SaaS hosting, rebranding, or derivative commercial offerings require written authorization.
Previous releases remain subject to the license terms under which they were originally published.