SecOps - 41119 - Local modification of Microsoft Defender Antivirus policy is blocked

[Sandeep Jha (sandeepjha000)]

Issue-1143
Spec-41119

[Copilot]

Pull request overview

Adds a new SecOps assessment (41119) that evaluates whether Intune Settings Catalog policies block local Microsoft Defender Antivirus policy modifications by enforcing DisableLocalAdminMerge.

Changes:

• Introduces Test-Assessment-41119, querying Intune Settings Catalog configuration policies (Graph beta) and evaluating device_vendor_msft_defender_configuration_disablelocaladminmerge.
• Produces a markdown report table of relevant policies, including assignment and detected setting state.
• Adds supporting markdown documentation for the new assessment.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/powershell/tests/Test-Assessment.41119.ps1	New assessment implementation for DisableLocalAdminMerge using Graph policy + settings enumeration and report generation.
src/powershell/tests/Test-Assessment.41119.md	New assessment documentation and remediation links, with %TestResult% placeholder for generated output.

Suppressed comments (2)

src/powershell/tests/Test-Assessment.41119.ps1:241

• This comment says N/A policies are excluded from display, but the report generation below intentionally includes N/A rows in the output table. Update the comment to match the actual behavior (excluded from roll-up only).

    # Only policies that actually carry the control are evaluable; N/A policies are excluded from the roll-up and from display.

src/powershell/tests/Test-Assessment.41119.ps1:257

• The Fail summary mentions "enables it only in an unassigned policy", but the evaluation can fail for multiple reasons and (with the recommended change to treat unassigned policies as N/A) this text becomes inaccurate. Update the summary to reflect the actual failing condition (assigned policy sets the control to No).

            $testResultMarkdown = "❌ A retrieved Intune policy sets **DisableLocalAdminMerge** to No (**..._0**), or enables it only in an unassigned policy.`n`n%TestResult%"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aleksandar Nikolić (alexandair)]

Sandeep Jha (@sandeepjha000) Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

Sandeep Jha (@sandeepjha000) Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

A null assignments value is treated as definitely unassigned

The new classifier checks whether the assignments property exists, but it does not check whether the property contains a usable collection:

Test-Assessment.41119.ps1#L143-L157

$assignmentsPresent = $null -ne $policy.PSObject.Properties['assignments']
$assignmentCount = @($policy.assignments | Where-Object { $null -ne $_ }).Count
...
elseif ($assignmentCount -ge 1) {
    $assignmentState = 'Assigned'
}
else {
    $assignmentState = 'Unassigned'
}

When Graph returns an assignments property whose value is $null, $assignmentsPresent is true and $assignmentCount is zero. The code therefore sets the state to Unassigned. An enabled setting then becomes a definite Fail in the new per-instance logic at Test-Assessment.41119.ps1#L239-L245.

A null expanded collection is not the same as a valid empty array. It is missing or unusable assignment evidence, so the specification requires Investigate rather than Fail.

I confirmed the behavior with the exact classifier:

Input	Current state
assignments property absent	Unknown
assignments = $null	Unassigned
assignments = @() and isAssigned = $false	Unassigned
One assignment and isAssigned = $false	Unknown

Fix: inspect both the property and its value. Treat an absent or null value as Unknown, while preserving an actual empty collection as Unassigned. Add a regression test for assignments = $null with an enabled control and verify the result is Investigate.