MDE Toolkit Administrative Template Group Policy settings for MDE Toolkit. Manages HKLM\SOFTWARE\Policies\MDE-Toolkit. MDE Toolkit 3.0 or later MDE Toolkit 3.3.1 or later MDE Toolkit 3.3.2 or later MDE Toolkit Settings for MDE Toolkit, a free monitoring and management tool for Microsoft Defender for Endpoint. All settings write to HKLM\SOFTWARE\Policies\MDE-Toolkit. Any setting left Not Configured uses the application's built-in default, so you only need to configure what you want to change. Background Collector Controls the unattended collector that gathers a security health snapshot from this device and writes it to a local cache. The collector runs as SYSTEM from a scheduled task created by the MSI. It performs no network activity of its own; uploading is a separate step configured under Telemetry Upload. Telemetry Upload Controls how cached health snapshots reach Azure. Two destinations are supported and may be enabled independently: an Azure Function App (recommended, writes to Table Storage) or direct upload to Azure Blob Storage. Uploads run as the signed-in user and authenticate with that user's Entra ID identity. No keys, secrets or connection strings are stored on the endpoint. Identity and Authentication Controls how the toolkit authenticates to Azure and which cloud it targets. Leave everything Not Configured for a standard Entra ID joined device in the commercial cloud. Data Collection Scope Selects which categories of telemetry the background collector gathers. All categories are collected by default. Disabling a category reduces what leaves the device but also removes the corresponding columns from your reporting. Device Tagging Free-form labels written into every health snapshot and promoted to their own columns in Azure Table Storage, so fleet dashboards can filter and group by them. Application Lockdown Restricts what a user of the interactive application may do. These settings apply to the desktop application, not to the background collector. These are guardrails against accident and drift. They are not a security boundary against a determined local administrator, who retains the ability to run the underlying Windows commands directly. ASR Exclusion Guardrails Restricts the Attack Surface Reduction exclusions an administrator may create from within the toolkit. Every exclusion created through the toolkit requires a written justification and is recorded in a local audit ledger, including who created it, when, why, the exact commands used, and its expiry. Temporary exclusions revert themselves from a scheduled task, so they still expire when the application is closed. Logging and Diagnostics Controls the local service log written by the background collector and the upload loop. Page Visibility Controls which pages appear in the application, and to whom. Each page can be hidden entirely, shown only when the application is running elevated, shown only to standard users, or shown to both. Hiding a page removes it from navigation; it does not by itself prevent the underlying Windows functionality from being used by other means. Enable the background collector Determines whether this device collects a security health snapshot on a schedule. If you enable this setting, the collector gathers the categories selected under Data Collection Scope and writes them to the local cache folder. If you disable this setting, no unattended collection takes place. The interactive application still works normally. If you do not configure this setting, collection is off. Registry value: EnableBackgroundCollector (REG_DWORD). Default: 0. Collection interval Sets how often the background collector produces a new snapshot. The scheduled task created by the MSI runs every 8 hours, so values well below 480 minutes have no practical effect unless you also change the task trigger. Values below 5 minutes are rejected. If you do not configure this setting, the interval is 480 minutes (8 hours). Registry value: CollectionIntervalMinutes (REG_DWORD). Default: 480. Cache folder Sets the folder where snapshot JSON files are written before upload. The default location is protected by an access control list restricting it to SYSTEM and Administrators. If you point this at a different folder, secure it equivalently; snapshots describe the device's security posture. If you do not configure this setting, %ProgramData%\MDE-Toolkit\cache is used. Registry value: CacheFolder (REG_SZ). Maximum cached snapshots Sets how many snapshot files are kept before the oldest are rotated out. If you do not configure this setting, 48 files are kept. Registry value: MaxCacheFiles (REG_DWORD). Default: 48. Cache retention period Deletes cached snapshots older than the number of days you specify. Set to 0 to keep files regardless of age, subject only to the maximum file count. If you do not configure this setting, snapshots older than 30 days are deleted. Registry value: CacheRetentionDays (REG_DWORD). Default: 30. Enable upload to an Azure Function App Determines whether cached snapshots are posted to your Azure Function App ingestion endpoint. You must also configure the Function App endpoint setting, or nothing will be uploaded. If you do not configure this setting, upload is off. Registry value: EnableFunctionAppUpload (REG_DWORD). Default: 0. The legacy value name EnableUpload is still honoured but is deprecated. Azure Function App endpoint Specifies the ingestion endpoint and the Entra ID audience the upload token is requested for. The URL is the full HTTPS address of your ingestion function. The audience is the Application ID URI of the Entra ID application protecting it. Registry values: FunctionAppUrl and FunctionAppAudience (both REG_SZ). Upload interval Sets how often cached snapshots are uploaded. Values below 5 minutes are rejected. If you do not configure this setting, the interval is 480 minutes (8 hours). Registry value: UploadIntervalMinutes (REG_DWORD). Default: 480. Upload timeout Sets the HTTP timeout for a single upload attempt, in seconds. Values are clamped to the range 5 to 300. If you do not configure this setting, the timeout is 30 seconds. Registry value: UploadTimeoutSeconds (REG_DWORD). Default: 30. Upload retry count Sets how many times a failed upload is retried before the snapshot is left in the cache for the next cycle. Values are clamped to the range 0 to 10. If you do not configure this setting, 2 retries are attempted. Registry value: UploadRetryCount (REG_DWORD). Default: 2. Enable direct upload to Azure Blob Storage Determines whether cached snapshots are written directly to an Azure Storage blob container, bypassing the Function App. This is an alternative to Function App upload, intended for environments where hosting a function is not practical. It requires each endpoint's user identity to hold a data-plane role on the container, which is a broader grant than the Function App design. Prefer the Function App where possible. If you do not configure this setting, direct blob upload is off. Registry value: EnableBlobUpload (REG_DWORD). Default: 0. Azure Blob Storage destination Specifies the storage account, container and endpoint suffix used for direct blob upload. Leave the endpoint suffix blank for the commercial cloud. For sovereign clouds supply the appropriate suffix, for example blob.core.usgovcloudapi.net. If the container name is left blank, mde-telemetry is used. Registry values: BlobStorageAccountName, BlobContainerName and BlobEndpointSuffix (all REG_SZ). Entra ID tenant Specifies the Entra ID tenant identifier used when acquiring tokens. If you do not configure this setting, the tenant is detected automatically from the device's Primary Refresh Token. Set it explicitly only in multi-tenant or guest scenarios where automatic detection picks the wrong tenant. Registry value: TenantId (REG_SZ). Preferred authentication method Selects how the toolkit acquires an Entra ID token. Default uses the standard credential chain and is correct for almost all deployments. Windows Account Manager forces broker-based sign-in. Device code is intended for hosts without an interactive desktop session. Managed identity is for Azure-hosted machines with an assigned identity. If you do not configure this setting, Default is used. Registry value: PreferredAuthMethod (REG_SZ). Default: Default. Azure cloud environment Selects the Azure cloud whose endpoints the toolkit talks to. If you do not configure this setting, the commercial (Public) cloud is used. Registry value: AzureEnvironment (REG_SZ). Default: Public. Entra ID authority override Overrides the Entra ID authority URI used for sign-in. Use this only where the cloud environment setting does not produce the correct authority, such as air-gapped or specialised sovereign deployments. An example value is https://login.microsoftonline.us/. Registry value: AuthorityHostOverride (REG_SZ). Collect Defender antivirus status Includes real-time protection state, tamper protection, signature, engine and platform versions, and last scan times in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectDefenderStatus (REG_DWORD). Default: 1. Collect Defender policy configuration Includes Attack Surface Reduction, Network Protection, Controlled Folder Access and Device Control configuration in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectDefenderPolicies (REG_DWORD). Default: 1. Collect Windows Firewall status Includes the state of the Domain, Private and Public firewall profiles in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectFirewallStatus (REG_DWORD). Default: 1. Collect App Control (WDAC) status Includes Windows Defender Application Control enforcement state and the number of deployed policies in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectAppControl (REG_DWORD). Default: 1. Collect management enrollment details Includes Intune and Configuration Manager enrollment information in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectIntuneEnrollment (REG_DWORD). Default: 1. Collect Device Guard status Includes Virtualization-based Security, Hypervisor-protected Code Integrity and Credential Guard state in each snapshot. If you do not configure this setting, this data is collected. Registry value: CollectDeviceGuard (REG_DWORD). Default: 1. Device tag, organizational unit and environment Applies free-form labels to this device. Each label is written into the snapshot and promoted to its own column in Azure Table Storage, so dashboards can filter and group by them. Typical uses are a business unit for the device tag, a region or site for the organizational unit, and Production, Staging or Dev for the environment. Any value is accepted; consistency across your fleet is what makes them useful. Registry values: DeviceTag, OrgUnit and Environment (all REG_SZ). Block data export from the application Determines whether users may export data out of the application. If you enable this setting, every export path is blocked, including report PDF and HTML, triage reports, scan results, ASR event and Advanced Hunting exports, App Control and WDAC policy files, firewall migration files, and investigation details. A blocked attempt shows a dialog naming this policy, so the button does not simply appear broken. If you disable or do not configure this setting, export is permitted. Registry value: DisableExportButtons (REG_DWORD). Default: 0. This setting is genuinely enforced from version 3.3.2 onward; in earlier versions it was documented but had no effect. Restrict the application to the local machine Determines whether the application may be pointed at another computer. If you enable this setting, the target machine box is disabled and any non-local value is rejected and reset to localhost. Enforcement sits at the single point every remote-capable service reads from, so no remote path is reachable even if the target is set programmatically. If you disable or do not configure this setting, remote targeting over WinRM or PsExec is permitted. Registry value: DisableRemoteTarget (REG_DWORD). Default: 0. This setting is genuinely enforced from version 3.3.2 onward; in earlier versions it was documented but had no effect. Force read-only mode Determines whether the application may change anything on the device. If you enable this setting, all write operations are blocked, including remediation actions, policy changes, and the creation or removal of ASR exclusions. The application becomes a viewer and reporter only. If you disable or do not configure this setting, write operations are permitted subject to the user holding administrative rights. Registry value: ForceReadOnlyMode (REG_DWORD). Default: 0. This setting is genuinely enforced from version 3.3.1 onward. Show preview features Determines whether features still marked as preview appear in the application. Machine Investigator is currently a preview feature. Preview features are functional but may change between releases. Consider enabling this for a pilot group before rolling it out broadly. If you disable or do not configure this setting, preview features are hidden. Registry value: ShowPreviewFeatures (REG_DWORD). Default: 0. Allow permanent ASR exclusions Determines whether an administrator may create an Attack Surface Reduction exclusion that never expires. If you disable this setting, the Permanent option is removed and every exclusion created through the toolkit must have an expiry. If you enable or do not configure this setting, permanent exclusions are permitted. Disable both this setting and Allow temporary ASR exclusions to prevent exclusion creation through the toolkit entirely. Registry value: AsrAllowPermanentExclusions (REG_DWORD). Default: 1. Allow temporary ASR exclusions Determines whether an administrator may create a time-limited Attack Surface Reduction exclusion. If you disable this setting, all temporary durations are removed from the menu. If you enable or do not configure this setting, temporary exclusions are permitted. Registry value: AsrAllowTemporaryExclusions (REG_DWORD). Default: 1. Maximum ASR exclusion duration Sets an absolute ceiling, in hours, on how long any Attack Surface Reduction exclusion created through the toolkit may last. Set to 0 for no ceiling. This cap is applied last, so it cannot be widened by the custom duration list. Enforcement happens where the exclusion is written, not only in the user interface. If you do not configure this setting, there is no ceiling. Registry value: AsrExclusionMaxHours (REG_DWORD). Default: 0. ASR exclusion duration choices Replaces the list of durations offered when creating a temporary Attack Surface Reduction exclusion. Supply a comma-separated list of whole hours, for example 4,24,168. Entries that cannot be parsed are ignored and reported to the user rather than being dropped silently. The maximum duration setting still applies on top of this list. If you do not configure this setting, the choices are 4, 24, 168 and 720 hours. Registry value: AsrExclusionDurationsHours (REG_SZ). Default: 4,24,168,720. Service log level Sets how much detail the background collector and upload loop write to the service log. Use Verbose only while troubleshooting; it produces a large volume of output. None disables logging entirely, which makes deployment problems considerably harder to diagnose. If you do not configure this setting, Info is used. Registry value: LogLevel (REG_SZ). Default: Info. Service log file path Specifies a custom path for the service log file. If you do not configure this setting, the log is written to service.log inside the cache folder. Registry value: LogFilePath (REG_SZ). Maximum log file size Sets the size in megabytes at which the service log is rotated. Values are clamped to the range 1 to 500. If you do not configure this setting, the log rotates at 10 MB. Registry value: MaxLogSizeMb (REG_DWORD). Default: 10. Controls whether this page appears in the application, and to whom. Hidden removes the page for everyone. Administrators only shows it when the application is running elevated. Standard users only shows it when the application is not elevated. Both shows it in either case. If you do not configure this setting, the application's built-in default for this page applies. Value data: 0 hidden, 1 administrators only, 2 standard users only, 3 both. ASR Rules overview page ASR Rules events page Firewall page WFP filters page Firewall migration page App Control Advanced Hunting page Machine Investigator page Device Control policies page Defender policies page Advanced networking page CiTool page AI Analysis page Controls whether the Machine Investigator page appears in the application, and to whom. Machine Investigator queries Advanced Hunting for up to 25 devices and produces a triage verdict for each. It is a preview feature, so it also requires the Show preview features setting to be enabled. Results are limited to what the signed-in user's Defender for Endpoint permissions allow, so showing this page does not by itself grant access to data. If you do not configure this setting, the page is shown to administrators only. Value data: 0 hidden, 1 administrators only, 2 standard users only, 3 both. Controls whether the AI Analysis page appears in the application, and to whom. This page sends collected configuration data to an Azure OpenAI or OpenAI endpoint that you configure. It is hidden by default and should be enabled only after you have confirmed that arrangement is acceptable to your organization. If you do not configure this setting, the page is hidden. Value data: 0 hidden, 1 administrators only, 2 standard users only, 3 both. Default (recommended) Windows Account Manager (broker) Device code flow Managed identity Azure Public (commercial) Azure US Government Azure China Azure Germany None Error Warning Info (default) Verbose Hidden Administrators only Standard users only Both administrators and standard users Minutes between collections: Cache folder path: C:\ProgramData\MDE-Toolkit\cache Snapshots to keep: Delete snapshots older than (days, 0 = no limit): Function App ingestion URL: https://func-mde-toolkit.azurewebsites.net/api/HealthReportIngestion Entra ID audience (Application ID URI): api://mde-toolkit-func Minutes between uploads: Timeout (seconds): Retries: Storage account name: Container name (blank = mde-telemetry): mde-telemetry Blob endpoint suffix (blank = commercial cloud): Entra ID tenant ID: Authentication method: Cloud environment: Authority URI: https://login.microsoftonline.us/ Device tag: Organizational unit: Environment: Maximum duration (hours, 0 = no limit): Durations in hours (comma-separated): 4,24,168,720 Log level: Log file path: Rotate at size (MB): Show this page to: