Enterprise

One tool on one machine answers “is this device configured correctly?” Enterprise mode answers it for every device you own — and lets you control the tool itself from Group Policy or Intune.

What “Enterprise” actually means

MDE Toolkit is a desktop application. Installed on a single machine it shows you that machine’s Defender configuration, and an administrator can fix things from it. That is the whole product for most people.

Enterprise mode adds two things on top, and they are independent of each other. You can adopt either one without the other.

📡

1. Fleet reporting

Every endpoint quietly writes a security health snapshot on a schedule and sends it to Azure. You end up with a dated row per report, several a day per device, in a table you can point Power BI at — current posture and history in the same place. No console to log into, no agent beyond the toolkit itself.

See how it works →
🔧

2. Central control of the app

Everything the application does can be governed from a single policy key — which pages a user sees, whether they can export data, whether they can point it at another machine, and what kind of ASR exclusions they may create.

Get the ADMX templates →
Neither is on by default. A freshly installed toolkit collects nothing on a schedule, uploads nothing, and restricts nothing. Enterprise behaviour only starts once you configure it.

How the reporting works

In one sentence: a task running as SYSTEM reads the device’s security configuration, and a second task running as the signed-in user sends it to Azure using that person’s existing work identity.

┌──────────────────────────────────────┐
│         Endpoint (Windows PC)        │
│                                      │
│  ┌────────────────────────────────┐  │      HTTPS/Bearer       ┌──────────────────────┐      Table API       ┌─────────────────────┐
│  │  Scheduled Task: Collect       │  │                         │  Azure Function App  │                      │  Azure Table        │
│  │  Runs as: SYSTEM               │  │                         │  (PowerShell, MI)    │                      │  Storage            │
│  │  Every 8 hours                 │  │                         │                      │                      │                     │
│  │  --collect --no-upload         │──┼── writes to cache ──┐   │                      │                      │                     │
│  └────────────────────────────────┘  │                     │   │  • Validates JSON    │                      │  • HealthReports    │
│                                      │                     │   │  • Flattens fields   │                      │  • Row per report   │
│  ┌────────────────────────────────┐  │                     │   │  • Writes to Table   │                      │  • Power BI ready   │
│  │  Scheduled Task: Upload        │  │  reads cache ───────┘   │                      │                      │                     │
│  │  Runs as: Interactive User     │  │ ────────────────────►   │                      │ ──────────────────►  │                     │
│  │  (BUILTIN\Users group)         │  │    POST /api/ingest     │                      │    Upsert entity     │                     │
│  │  Every 8 hours                 │  │   + Entra bearer token  │                      │                      │                     │
│  │  --upload                      │  │                         │                      │                      │                     │
│  └────────────────────────────────┘  │                         └──────────────────────┘                      └─────────────────────┘
│                                      │                                 │                                            │
│  Registry config                     │                                 │  Managed Identity                          │  Power BI
│  HKLM\SOFTWARE\                      │                                 │  (Storage Table                            │  or custom
│  Policies\MDE-Toolkit                │                                 │   Data Contributor)                        │  dashboard
└──────────────────────────────────────┘
No secrets live on endpoints. There are no keys, connection strings or certificates on the device. The upload is authenticated with the signed-in user’s Entra ID token, and the Function App uses a Managed Identity to write to storage.
Why two scheduled tasks? SYSTEM can read all the local Defender configuration but cannot obtain an Entra ID user token. The logged-on user already has one, but cannot read everything. Splitting the work gives you both without granting either side more than it needs.

The moving pieces

Four things, three of which you set up once.

☁️

The Function App

A small PowerShell function in your own Azure subscription. It validates each snapshot, flattens it, and writes a dated row into Table Storage. It is the only component that touches storage, which is why endpoints need no storage permissions at all.

Build it →
🗂️

Registry settings

Every enterprise behaviour is a value under HKLM\SOFTWARE\Policies\MDE-Toolkit. The installer seeds each one at its built-in default so you can see the whole surface in regedit and edit rather than guess. Existing values are never overwritten on upgrade.

Full reference →
🏛️

ADMX templates

Rather than scripting reg add, drop two files into your Central Store and every setting appears in the Group Policy editor with a proper explanation, sensible defaults and validation.

Download templates →
📊

Power BI

Ready-made Power Query and twenty-plus DAX measures, so you get a fleet dashboard without designing a data model. Commercial and Government cloud variants are both provided.

Connect it →

Controlling the application itself

The second half of enterprise mode has nothing to do with Azure. It is about deciding what the toolkit is allowed to do on a managed device.

You want to…Use
Hide pages your helpdesk has no business seeingVisibility*Page — per page, per elevation level
Give standard users a read-only view of ASR eventsVisibilityAsrEventsPage = 3; exclusion actions stay admin-gated regardless
Stop data leaving the machine in a fileDisableExportButtons
Prevent the tool being pointed at other computersDisableRemoteTarget
Make the tool observe-only, with no ability to change anythingForceReadOnlyMode
Stop admins creating permanent ASR exclusionsAsrAllowPermanentExclusions = 0 plus AsrExclusionMaxHours
Pilot preview features with a small groupShowPreviewFeatures
These are guardrails, not a security boundary. They stop accidents and configuration drift by people doing their jobs. They do not stop a determined local administrator, who can run the underlying Windows commands directly. What makes that visible is the toolkit’s audit ledger, not the lock.
🏛️
Manage all of it from Group Policy ADMX and ADML files covering every live setting, with full explain text and validation.
Download ADMX (.zip)

Prerequisites

For fleet reporting

  • Azure subscription (Commercial or Government)
  • Azure Function App on the PowerShell runtime
  • Azure Storage account with Table Storage
  • Entra ID app registration to protect the endpoint
  • Endpoints Entra ID joined or Hybrid joined, with network access to the Function App

For central control only

  • Nothing in Azure
  • Active Directory with a Group Policy Central Store, or Intune, or any registry deployment tool
  • Windows 10 1809+ or Windows 11 with the .NET 8 Desktop Runtime