Beyond configuration
Microsoft shows one device. Gapsio shows the fleet.
The Defender portal shows effective settings one Windows device at a time. Gapsio answers the fleet questions behind it: where policies contradict each other, where USB storage is used without control, whether attack disruption could actually act – and which of your own detections quietly stopped.
Policy conflicts
Two policies, one setting, different values: Intune may apply neither, and a conflicting ASR rule drops out of the merged rule set. Gapsio lists every such setting with the policies involved and the number of devices that receive both.
Device control
Which devices mounted USB storage in the last 30 days – and does a device control policy reach them? Gapsio joins Defender's media usage events with your Intune assignments.
Attack disruption readiness
Automatic attack disruption contains a compromised user within minutes – on devices with a current Sense agent and a working sensor, and with Defender for Identity on your domain controllers. Gapsio checks what can be verified and says plainly which settings Microsoft only shows in the portal.
Detection rules that stopped
Custom detections fail quietly: Defender switches a failing rule off and tells nobody. Gapsio shows which rules were switched off automatically, which are disabled, which act on their own – and who changed them.
Policy conflicts, device control and attack disruption readiness need no extra permission. Detection rules are an optional feature (-Features …,Detections) with one more read-only permission, CustomDetection.Read.All.
See it in your own tenant.
Read-only, self-hosted in your Azure subscription, running in minutes. Every check is free.