Skip to content

51346 implement metadata functionality in our GitHub #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DGusevNerdio merged 8 commits into from
Mar 17, 2026
Merged

51346 implement metadata functionality in our GitHub #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b2edae0
[#49019] Adds new CA 1.0.0 policies
AYushko-nerdio Nov 27, 2025
db8cd4c
AB#51346: Implement metadata functionality in our github
AYushko-nerdio Feb 11, 2026
0a14c2f
AB#51346: Fixes Defender for Endpoint PB
AYushko-nerdio Feb 12, 2026
67bafc4
AB#51346 Changes metadata structure
AYushko-nerdio Feb 17, 2026
de1f9f3
Updates CA Policies assignments to match Intune portal
AYushko-nerdio Mar 13, 2026
0208c0d
AB#51831 Adds new canned policies
AYushko-nerdio Mar 6, 2026
6923e49
AB#51831 Removes Security Baseline Bitlocker obsolete policy
AYushko-nerdio Mar 11, 2026
89195d9
AB#52223 Updates guest user assignments in CA policies
AYushko-nerdio Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion intune-policies/policy-baselines/NMM For Defender for Endpoint.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@
"/intune-policies/compliance-policies/NMM Windows Advanced Compliancy with Defender.json",
"/intune-policies/application-control-policies/NMM Application Control (audit mode).json",
"/intune-policies/application-control-policies/NMM Enforce SmartScreen.json",
"/intune-policies/security-baseline-policies/NMM Force Bitlocker for fixed disks only.json",
"/intune-policies/macos-firewall-policies/NMM macOS Firewall.json",
"/intune-policies/attack-surface-reduction-rules-policies/NMM Attack Surface Reduction.json",
"/intune-policies/microsoft-defender-antivirus-policies/NMM Defender Antivirus for macOS.json",
Expand Down
Empty file added policies-versioning/application-control-policies/.gitkeep
View file
Open in desktop
Empty file.
Empty file added policies-versioning/attack-surface-reduction-rules-policies/.gitkeep
View file
Open in desktop
Empty file.
252 changes: 252 additions & 0 deletions ...Audit mode Device/1.0.0_Windows Attack Surface Reduction All Rules Audit mode Device.json
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 6 additions & 0 deletions ...olicies/Windows Attack Surface Reduction All Rules Audit mode Device/policy.metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"tags": [
"attacksurfacereduction",
"EasyStart"
]
}
222 changes: 222 additions & 0 deletions ...Block mode Device/1.0.0_Windows Attack Surface Reduction All Rules Block mode Device.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,222 @@
{
"description": "Places all Attack Surface Reduction rules into block mode - this includes \u0027Block execution of potentially obfuscated scripts\u0027 which affects AVD session hosts. https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference. Apply to All Devices (optionally with filters) or Entra ID device groups, ensuring this excludes AVD and W365 hosts.",
"name": "Windows Attack Surface Reduction All Rules Block mode",
"platforms": "windows10",
"settingCount": 2,
"technologies": "mdm, microsoftSense",
"templateReference": {
"templateDisplayName": "Attack Surface Reduction Rules",
"templateDisplayVersion": "Version 1",
"templateFamily": "endpointSecurityAttackSurfaceReduction",
"templateId": "e8c053d6-9f95-42b1-a7f1-ebfd71c67a4b_1"
},
"settings": [
{
"settingInstance": {
"groupSettingCollectionValue": [
{
"children": [
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutionofpotentiallyobfuscatedscripts_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutionofpotentiallyobfuscatedscripts",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockwin32apicallsfromofficemacros_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockwin32apicallsfromofficemacros",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutablefilesrunningunlesstheymeetprevalenceagetrustedlistcriterion_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutablefilesrunningunlesstheymeetprevalenceagetrustedlistcriterion",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockofficecommunicationappfromcreatingchildprocesses_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockofficecommunicationappfromcreatingchildprocesses",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockallofficeapplicationsfromcreatingchildprocesses_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockallofficeapplicationsfromcreatingchildprocesses",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockadobereaderfromcreatingchildprocesses_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockadobereaderfromcreatingchildprocesses",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockcredentialstealingfromwindowslocalsecurityauthoritysubsystem_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockcredentialstealingfromwindowslocalsecurityauthoritysubsystem",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockjavascriptorvbscriptfromlaunchingdownloadedexecutablecontent_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockjavascriptorvbscriptfromlaunchingdownloadedexecutablecontent",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockwebshellcreationforservers_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockwebshellcreationforservers",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockuntrustedunsignedprocessesthatrunfromusb_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockuntrustedunsignedprocessesthatrunfromusb",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockpersistencethroughwmieventsubscription_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockpersistencethroughwmieventsubscription",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockuseofcopiedorimpersonatedsystemtools_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockuseofcopiedorimpersonatedsystemtools",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockabuseofexploitedvulnerablesigneddrivers_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockabuseofexploitedvulnerablesigneddrivers",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockprocesscreationsfrompsexecandwmicommands_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockprocesscreationsfrompsexecandwmicommands",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockofficeapplicationsfromcreatingexecutablecontent_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockofficeapplicationsfromcreatingexecutablecontent",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockofficeapplicationsfrominjectingcodeintootherprocesses_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockofficeapplicationsfrominjectingcodeintootherprocesses",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockrebootingmachineinsafemode_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockrebootingmachineinsafemode",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_useadvancedprotectionagainstransomware_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_useadvancedprotectionagainstransomware",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
{
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutablecontentfromemailclientandwebmail_block",
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutablecontentfromemailclientandwebmail",
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
}
],
"@odata.type": "microsoft.graph.deviceManagementConfigurationGroupSettingValue"
}
],
"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules",
"settingInstanceTemplateReference": {
"settingInstanceTemplateId": "19600663-e264-4c02-8f55-f2983216d6d7"
},
"@odata.type": "#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance"
},
"id": "0"
},
{
"settingInstance": {
"choiceSettingValue": {
"children": [],
"value": "device_vendor_msft_policy_config_defender_enablecontrolledfolderaccess_1",
"settingValueTemplateReference": {
"settingValueTemplateId": "e57db701-c3c6-4264-ab50-7896cb90dfd6",
"useTemplateDefault": false
},
"@odata.type": "microsoft.graph.deviceManagementConfigurationChoiceSettingValue"
},
"settingDefinitionId": "device_vendor_msft_policy_config_defender_enablecontrolledfolderaccess",
"settingInstanceTemplateReference": {
"settingInstanceTemplateId": "78c83b32-56c0-445a-932a-872d69af6e49"
},
"@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance"
},
"id": "1"
}
]
}
5 changes: 5 additions & 0 deletions ...olicies/Windows Attack Surface Reduction All Rules Block mode Device/policy.metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"tags": [
"attacksurfacereduction"
]
}
Loading