# MDE Toolkit — Power BI Report Setup

## Quick Start (5 minutes)

### Step 1: Open Power BI Desktop
Open Power BI Desktop → **Home → Get Data → Blank Query**

### Step 2: Open Advanced Editor
In the Power Query window, click **Advanced Editor** and paste the contents of `HealthReports-Query.m`.

Update the `StorageAccountName` variable at the top to match your storage account.

### Step 3: Authenticate
- When prompted, select **Organizational account** and sign in with your Entra ID
- Your account needs **Storage Table Data Reader** on the storage account

### Step 4: Load the data
Click **Close & Apply** to load the data into the report.

### Step 5: Add DAX Measures
Go to **Modeling → New Measure** and add each measure from `Measures.dax` one at a time.

### Step 6: Build Visuals
See the **Suggested Report Layout** section below for recommended pages and visuals.

---

## Suggested Report Layout

### Page 1: Fleet Health Overview
| Visual | Type | Fields |
|--------|------|--------|
| Health Score Gauge | Gauge | Average of `HealthScore` |
| Device Count | Card | Count of `Hostname` |
| Status Breakdown | Donut | `OverallStatus` by count |
| Health by Device Tag | Bar Chart | `DeviceGroup` × avg `HealthScore` |
| Stale Devices | Table | `Hostname`, `HoursSinceReport` where > 24 |

### Page 2: Defender & ASR
| Visual | Type | Fields |
|--------|------|--------|
| RTP Status | Pie | `RealTimeProtectionEnabled` by count |
| Tamper Protection | Pie | `TamperProtectionEnabled` by count |
| Signature Age | Histogram | `SignatureAgeHours` |
| ASR Coverage | Stacked Bar | `Hostname` × `AsrBlockModeRules` / `AsrTotalRules` |
| MDE Onboarding | Card | % where `IsOnboarded` = true |

### Page 3: Firewall & Network
| Visual | Type | Fields |
|--------|------|--------|
| Firewall Matrix | Matrix | `Hostname` × Domain/Private/Public Enabled |
| Devices Missing Profiles | Table | Where any Firewall profile = false |

### Page 4: App & Device Control
| Visual | Type | Fields |
|--------|------|--------|
| WDAC Status | Pie | `AppControlIsEnabled` by count |
| Device Control | Pie | `DeviceControlEnabled` by count |
| VBS / HVCI | Stacked Bar | `Hostname` × `VbsEnabled`, `HvciRunning`, `CredentialGuardRunning` |

### Page 5: Device Inventory
| Visual | Type | Fields |
|--------|------|--------|
| Full Table | Table | All key columns with conditional formatting on status fields |
| Slicers | Slicer | `DeviceGroup`, `OverallStatus`, `OsVersion` |