If you have read about the whole conditional access bypass for compliant devices make sure you read the full research presented by @TEMP43487580 at BHEU.

Great detail and great tooling. Don't just use the other POC.

www.blackhat.com/eu-24/briefi...

I'm creating a proactive Defender AV performance monitoring solution, and we can now query potential AV impacts! :)

This uses a script (Live response, Intune, etc) to send MPLog EstimatedImpact events to Log Analytics via Logs Ingestion API

Setup/script:
github.com/nathanmcn...