Exclusions that blind EDR, too.
Most exclusions only affect the virus scanner. Linux global exclusions and allow indicators also switch off detection. Gapsio gives them their own view.
Endpoint
Every exclusion. From every source.
Intune, Security Settings Management, changes made locally on the device and allow indicators in Defender for Endpoint – for Windows, macOS and Linux, in one list. Every entry gets a risk rating you can follow: the broader, the more writable and the less centrally managed, the riskier.
Windows
Exclusions from Intune, Group Policy and the local registry, ASR rules per device and device group, baseline, tamper and network protection, platform and signature age.
macOS
Exclusions from Intune and local mdatp commands, baseline, Full Disk Access and system extensions, agent version.
Linux
Global exclusions that also blind EDR, local changes through mdatp config and mdatp_managed.json, real-time protection, agent version.
Local exclusions, remembered.
Added by someone on the device, not in any policy. Gapsio finds them through Advanced Hunting and keeps the history beyond Defender’s 30 days.
ASR, as it really runs.
Target, configured and effective mode for every rule – overall, per Defender device group and per device, including conflicts between policies and ASR exclusions.
Baseline, with drift.
Microsoft Defender Antivirus on Windows, macOS and Linux against your baseline – and exactly what changed since the last run.
Exclusions nobody needs.
Did anything run from that path in the last 30 days? If not, the exclusion is a blind spot you can remove.
Devices Defender never saw.
Gapsio compares Intune-managed devices with Defender for Endpoint and lists every device that was never onboarded – the gaps no Defender report can show you.
Hygiene, not just settings.
Operating systems past end of support, devices without a recent scan, WSL without the Defender plug-in, detected threats set to “allow”, passive mode without EDR in block mode – and ASR rules that are ready for block because audit saw nothing in 30 days.
From device risk to sign-in.
Is the Intune connector on for every platform you use? Does compliance require a low machine risk score, and does Conditional Access enforce it? Otherwise a compromised device keeps its access.
And everything else that quietly goes wrong
- Third-party AV/EDR running next to an active Defender Antivirus
- Tampering attempts and troubleshooting mode sessions
- Internet-facing devices with high exposure
- Platform, engine and signature age, update rings
- Macs without Full Disk Access or approved system extensions
- Investigations waiting for approval, forgotten isolations
- Duplicate, ungrouped and long-inactive devices
- Devices excluded from vulnerability management
See it in your own tenant.
Read-only, self-hosted in your Azure subscription, running in minutes. Every check is free.