Defender for Endpoint and ASR controls

Every device onboarded, tamper protection on, and ASR rules moved from Audit to Block without outages.

ID	Control	Priority	Effort
DE01	Check every device is onboarded and its sensor is healthy	Highest	1 h
DE02	Make sure Defender Antivirus is active with cloud protection and block at first sight	Highest	1 h
DE03	Turn on tamper protection tenant-wide	Highest	30 min
DE04	Put all ASR rules in Audit and block the three standard protection rules	High	2 h + 2-4 weeks audit
DE05	Turn on network protection (audit, then block)	High	1 h + 2 weeks audit

These are the free Top 5. The Defender for Endpoint and ASR Kit has all 15 controls, with the Jira import, Excel plan and read-only script.