In case anyone is interested, here's a script to gather Defender logs and create a performance recording, then compress it and upload it to Azure blob storage

This works via Live Response, Intune scripts, etc. Just need Create permissions on a SAS token.

github.com/nathanmcn...

My automated configuration of Defender for Identity is close to done :)

We will be able to run a script, have it configure everything, get the access key, and download the MDI installer for us!

Let me know if there's anything specific you want built ;)

github.com/nathanmcn...