[FEATURE] Some Intune items are not included in the HTML report or the script output

[mikesierra2]

Is your feature request related to a problem? Please describe.
Fantastic report. There are some Intune items not currently appearing in the Report:

These are in Intune > Endpoint Security > Account Protection

• "Local User group membership"
• "Local admin password solution (LAPS)"

These are in Intune > Endpoint Security > Attack surface reduction

• "App and Browser Isolation"
• "Device Control"
• "Application Control"
• "Attack Surface Reduction Rules"

None of those items are in the report

Describe the solution you'd like
Is it possible to add these extra items in to the report? I can see a section for ASR, but it is not showing any of the ASR type rules I currently have.

[mikesierra2]

Part of this can be fixed by fixing the TemplateFamily name for ASR. In the Html-export.ps1 file:

TemplateFamily = "endpointSecurityAttackSurfaceReductionRules"
should be
TemplateFamily = "endpointSecurityAttackSurfaceReduction"

And this incorrect filter is all throughout the IntuneAssignmentChecker PS1.

But this only gets the ASR items into the report. It includes these:

• "App and Browser Isolation"
• "Device Control"
• "Attack Surface Reduction Rules"

But these are still not included

• "Local User group membership"
• "Local admin password solution (LAPS)"
• "Device Control"

[mikesierra2]

In "html-export.ps1", in the section "# 2. Check deviceManagement/intents (Templates)", this line

  $intentPolicies = $allIntentPolicies | Where-Object { $_.templateReference -and $_.templateReference.templateFamily -eq $esCategory.TemplateFamily }

Checks the existence of $_.templateReference, which does not exist, and therefore, the ASR > Application control (WDAC Policy) settings never make it into the report. I just removed the Where-Object, and the Application Policy did show up, but it showed up 5 times, once in each of the 5 Endpoint Security sections. Further, it also appears to not report any ASR item that is not assigned to any user groups.

Unsure if there is any data that can separate the Endpoint Security items like the code attempts.

[mikesierra2]

Also, re the LAPS and Local Admin group membership, I just added the following item

        @{ Name = "Account Protection"; Key = "AttackSurfaceProfiles"; TemplateFamily = "endpointSecurityAccountProtection"; UserFriendlyType = "ASR Profilen" }

to this array

# Endpoint Security Policies Fetching
$endpointSecurityCategories = @(

This is not th best way to do it, this really needs a new tab section called "Endpoint Security - Account Protection"

[ugurkocde]

Why are you not creating a PR? Looks like you found a easy solution.

[mikesierra2]

Valid. I might be able to do that on the weekend. But, I am only using the html-export.ps1, not the other larger script. Not sure I will have time to fix and debug that larger ps1 file in the immediate future. Is that OK?

[ugurkocde]

Absolutely. Thanks @mikesierra2