Public/Import-TamperProtectionToIntune.ps1

<#
.SYNOPSIS
    Enables Defender Tamper Protection prerequisites and documents Tamper Protection setup.
.DESCRIPTION
    Creates a custom OMA-URI policy that sets DisableLocalAdminMerge = 1 (Defender CSP).
    When using Intune for Defender, DisableLocalAdminMerge must be true to avoid breaking management.
    Tamper Protection itself is enabled via Endpoint Security > Antivirus > Windows Security Experience in Intune.
.PARAMETER DryRun
    Validate only; do not create policy.
.EXAMPLE
    Import-TamperProtectionToIntune
    Import-TamperProtectionToIntune -DryRun
#>

function Import-TamperProtectionToIntune {
    [CmdletBinding()]
    param([switch]$DryRun)

    $ErrorActionPreference = "Stop"
    $workspacePath = Get-WorkspacePath
    if (-not $workspacePath) {
        Write-Error "Workspace not configured. Run Initialize-NLBaseline first."
        return
    }

    $config = Get-Config -WorkspacePath $workspacePath
    if (-not $config -or [string]::IsNullOrEmpty($config.AppRegistration.ClientId) -or [string]::IsNullOrEmpty($config.AppRegistration.ClientSecret) -or [string]::IsNullOrEmpty($config.AppRegistration.TenantId)) {
        Write-Error "App Registration not configured in config.json."
        return
    }

    Write-Host "`nTamper Protection prerequisites and policy`n" -ForegroundColor Cyan

    $omaSettings = @(
        @{
            "@odata.type" = "#microsoft.graph.omaSettingInteger"
            displayName   = "DisableLocalAdminMerge"
            description   = "Prevent local admin from merging Defender settings with org policy. Required when managing Tamper Protection via Intune."
            omaUri        = "./Device/Vendor/MSFT/Defender/Configuration/DisableLocalAdminMerge"
            value         = 1
        }
    )

    $body = @{
        "@odata.type" = "#microsoft.graph.windows10CustomConfiguration"
        displayName   = "NLBaseline - Tamper Protection (DisableLocalAdminMerge)"
        description   = "Defender CSP: DisableLocalAdminMerge. Enable Tamper Protection via Endpoint Security > Antivirus > Windows Security Experience."
        omaSettings   = $omaSettings
    }

    if ($DryRun) {
        Write-Host "[DryRun] Would create: NLBaseline - Tamper Protection (DisableLocalAdminMerge)" -ForegroundColor Cyan
        return
    }

    $connected = Connect-Intune -Config $config
    if (-not $connected) {
        Write-Error "Failed to connect to Microsoft Graph."
        return
    }

    try {
        $removed = Remove-IntunePolicyByDisplayName -DisplayName "NLBaseline - Tamper Protection (DisableLocalAdminMerge)" -PolicyType "Configuration"
        if ($removed) { Write-Host "Removed existing policy." -ForegroundColor Yellow }

        $res = Invoke-IntuneGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations" -Body ($body | ConvertTo-Json -Depth 10)
        Write-Host "Created: NLBaseline - Tamper Protection (DisableLocalAdminMerge) (id: $($res.id))" -ForegroundColor Green
    }
    catch {
        Write-Error "Failed to create policy: $_"
        return
    }

    Write-Host "`nTo enable Tamper Protection:" -ForegroundColor Yellow
    Write-Host " 1. Intune admin center > Endpoint security > Antivirus" -ForegroundColor White
    Write-Host " 2. Create policy > Platform: Windows > Profile: Windows Security Experience" -ForegroundColor White
    Write-Host " 3. Defender section > Tamper protection (device): On" -ForegroundColor White
    Write-Host " 4. Assign to All devices or target groups.`n" -ForegroundColor White
}