One tool on one machine answers “is this device configured correctly?” Enterprise mode answers it for every device you own — and lets you control the tool itself from Group Policy or Intune.
MDE Toolkit is a desktop application. Installed on a single machine it shows you that machine’s Defender configuration, and an administrator can fix things from it. That is the whole product for most people.
Enterprise mode adds two things on top, and they are independent of each other. You can adopt either one without the other.
Every endpoint quietly writes a security health snapshot on a schedule and sends it to Azure. You end up with a dated row per report, several a day per device, in a table you can point Power BI at — current posture and history in the same place. No console to log into, no agent beyond the toolkit itself.
See how it works →Everything the application does can be governed from a single policy key — which pages a user sees, whether they can export data, whether they can point it at another machine, and what kind of ASR exclusions they may create.
Get the ADMX templates →In one sentence: a task running as SYSTEM reads the device’s security configuration, and a second task running as the signed-in user sends it to Azure using that person’s existing work identity.
┌──────────────────────────────────────┐ │ Endpoint (Windows PC) │ │ │ │ ┌────────────────────────────────┐ │ HTTPS/Bearer ┌──────────────────────┐ Table API ┌─────────────────────┐ │ │ Scheduled Task: Collect │ │ │ Azure Function App │ │ Azure Table │ │ │ Runs as: SYSTEM │ │ │ (PowerShell, MI) │ │ Storage │ │ │ Every 8 hours │ │ │ │ │ │ │ │ --collect --no-upload │──┼── writes to cache ──┐ │ │ │ │ │ └────────────────────────────────┘ │ │ │ • Validates JSON │ │ • HealthReports │ │ │ │ │ • Flattens fields │ │ • Row per report │ │ ┌────────────────────────────────┐ │ │ │ • Writes to Table │ │ • Power BI ready │ │ │ Scheduled Task: Upload │ │ reads cache ───────┘ │ │ │ │ │ │ Runs as: Interactive User │ │ ────────────────────► │ │ ──────────────────► │ │ │ │ (BUILTIN\Users group) │ │ POST /api/ingest │ │ Upsert entity │ │ │ │ Every 8 hours │ │ + Entra bearer token │ │ │ │ │ │ --upload │ │ │ │ │ │ │ └────────────────────────────────┘ │ └──────────────────────┘ └─────────────────────┘ │ │ │ │ │ Registry config │ │ Managed Identity │ Power BI │ HKLM\SOFTWARE\ │ │ (Storage Table │ or custom │ Policies\MDE-Toolkit │ │ Data Contributor) │ dashboard └──────────────────────────────────────┘
Four things, three of which you set up once.
A small PowerShell function in your own Azure subscription. It validates each snapshot, flattens it, and writes a dated row into Table Storage. It is the only component that touches storage, which is why endpoints need no storage permissions at all.
Build it →Every enterprise behaviour is a value under HKLM\SOFTWARE\Policies\MDE-Toolkit. The installer seeds each one at its built-in default so you can see the whole surface in regedit and edit rather than guess. Existing values are never overwritten on upgrade.
Rather than scripting reg add, drop two files into your Central Store and every setting appears in the Group Policy editor with a proper explanation, sensible defaults and validation.
Ready-made Power Query and twenty-plus DAX measures, so you get a fleet dashboard without designing a data model. Commercial and Government cloud variants are both provided.
Connect it →The second half of enterprise mode has nothing to do with Azure. It is about deciding what the toolkit is allowed to do on a managed device.
| You want to… | Use |
|---|---|
| Hide pages your helpdesk has no business seeing | Visibility*Page — per page, per elevation level |
| Give standard users a read-only view of ASR events | VisibilityAsrEventsPage = 3; exclusion actions stay admin-gated regardless |
| Stop data leaving the machine in a file | DisableExportButtons |
| Prevent the tool being pointed at other computers | DisableRemoteTarget |
| Make the tool observe-only, with no ability to change anything | ForceReadOnlyMode |
| Stop admins creating permanent ASR exclusions | AsrAllowPermanentExclusions = 0 plus AsrExclusionMaxHours |
| Pilot preview features with a small group | ShowPreviewFeatures |
If you only want central control of the application, skip straight to the ADMX templates — there is no Azure work to do. If you want fleet reporting, follow the three steps in order.
Create the storage account, Function App and Entra ID app. Deploy the ingestion script and lock it down with an identity provider and Conditional Access.
2Set the registry values, push the MSI through Intune, Configuration Manager or GPO, then verify the scheduled tasks and a real end-to-end upload.
3Connect Power BI to Table Storage using the supplied Power Query and DAX measures, and build the fleet dashboard.