Hi, its great the device suppression option has been added for vpn escalations. However based on the wording below I have some concerns.

Concern:

Compliant devices: Suppresses unexpected country and VPN escalations (Default: ON)

Entra Joined / Hybrid Joined: Suppresses unexpected country and VPN escalations (Default: ON)

Entra Registered (BYOD tier): Suppresses unexpected country and VPN escalations (Default: OFF)

If a hacker somehow managed to gain access to the end users credentials, they technically could have the ability to Entra Join a device (depending on security configurations). Whilst I appreciate eventually Huntress will likely pickup the compromised account based on other actions in the M365 tenant, its still a concern in the short term.

Request:

Given Huntress has the ability to interrogate Intune, I would assume it then has the ability to also interrogate the discovered apps.

From this, would it be possible to request that if any of these are turned on, then we have the ability within Huntress to enable a report/setting which flags to us at certain intervals that if a device is "joined and/or registered" in Intune and does not have the huntress agent installed, then Huntress will generate an alert or report?

Intent:

If a hacker manages to somehow join their device and block Huntress from being installed on their device, then Huntress (at a scheduled interval) will flag there is a device in the M365 environment which doesn't have Huntress installed which could be seen as a red flag or an opportunity to see why Huntress failed to install.