# Wardline

> Wardline is a self-hosted, read-only security posture tool for Microsoft Defender for Endpoint, Microsoft Intune, Microsoft Entra ID and AI agents (Entra Agent ID, Agent 365, local AI agents). It shows where protection that is configured is not actually effective: exclusions from every source, attack surface reduction (ASR) rules, the Microsoft Defender Antivirus baseline and its drift, combined findings, Conditional Access for AI agents, Defender XDR unified RBAC permission paths and Defender for Endpoint licence coverage. Wardline runs as an Azure Function App in the customer's own Azure tenant with read-only application permissions; no data leaves the tenant and the product never calls home.

Website: https://wardline.cloud/ (English), https://wardline.cloud/de/ (German)
Source code (MIT): https://github.com/dominikhoefling/wardline · Documentation: https://dominikhoefling.github.io/wardline/
Vendor: Dominik Hoefling, Langfurth, Germany (Microsoft MVP, security architect). Contact: dominik.hoefling@outlook.com

## What Wardline checks

- **Defender exclusions from every source**: Intune policies, Security Settings Management, Group Policy, local registry (Windows) and `mdatp` / `mdatp_managed.json` (macOS, Linux), allow indicators; risk rating per exclusion and "unused exclusion" detection (no activity in 30 days).
- **ASR rules on three levels**: target (baseline), configured (Intune) and effective (per device and Defender device group, from Advanced Hunting); audit telemetry per rule and "ready for block mode".
- **Microsoft Defender Antivirus baseline** for Windows, macOS and Linux (60+ checks: tamper protection, cloud protection and block level, network protection, PUA, brute-force and remote encryption protection, SmartScreen, threat default actions …) with drift between runs.
- **Device hygiene**: passive mode and third-party AV/EDR, troubleshooting mode, tampering attempts, scans, operating systems past end of support, streamlined connectivity, WSL without the Defender plug-in, coverage gaps (Intune-managed devices never onboarded).
- **Intune and Conditional Access integration**: Defender connector per platform, machine risk score in compliance policies, Conditional Access requiring compliant devices.
- **AI agents**: Entra Agent ID blueprints, agent identities and agent users, Agent 365 packages, Conditional Access coverage for agents, local AI agents on devices.
- **Access (Defender XDR unified RBAC)**: who holds which Defender permission and how (direct, group, PIM for Groups, access package), whether it was ever used, Entra roles that bypass unified RBAC, API apps with Defender application permissions, access reviews, PIM activation rules, Purview audit events (offboarding package downloads, live response).
- **Licensing**: Defender for Endpoint Plan 1 / Plan 2 entitlements compared with onboarded client devices and their users.
- **Governance**: assign findings to people, accept risks with expiry and justification, change history, notifications.

## How it works

- Deployment: Azure Function App (PowerShell), Storage Account and a static portal in the customer's Azure subscription; installed with a PowerShell script.
- Data sources: Microsoft Graph (Intune, Entra, Advanced Hunting) and the Defender for Endpoint API, application permissions only, all read-only, least privilege per feature.
- Portal: Entra ID sign-in, English and German, light and dark mode.

## Pricing

- Community: free, full feature set, lists show the first 10 rows.
- Enterprise: €19 per month or €199 per year, per tenant. Licence keys are bound to one Entra tenant and verified offline.

## Pages

- [Home (English)](https://wardline.cloud/): product overview, features, screenshots, pricing, FAQ
- [Startseite (Deutsch)](https://wardline.cloud/de/): Produktübersicht auf Deutsch
- [Roadmap](https://wardline.cloud/roadmap): planned features and feature requests
- [Imprint](https://wardline.cloud/imprint) · [Privacy](https://wardline.cloud/privacy) · [Terms of Service](https://wardline.cloud/terms) · [Refund and Cancellation Policy](https://wardline.cloud/refunds)

## Buying and cancelling

- Purchases are handled by Paddle.com Market Ltd. as merchant of record (invoice, VAT, payment). Cards, PayPal, Apple Pay, Google Pay, iDEAL, Bancontact and BLIK are accepted.
- Subscriptions renew monthly or yearly and can be cancelled at any time with effect from the end of the paid period. 14-day money-back guarantee on the first purchase; consumers additionally have the statutory 14-day right of withdrawal.
- The licence key is bound to one Entra tenant ID and verified offline; no telemetry, no call-home.