Block AI Tools with Microsoft Defender for Endpoint

# PowerShell: Create a single custom indicator via the MDE API
# Requires: WindowsDefenderATP app registration with Ti.ReadWrite.All permission

$tenantId    = "YOUR_TENANT_ID"
$appId       = "YOUR_APP_ID"
$appSecret   = "YOUR_APP_SECRET"

# Authenticate to Microsoft Defender API
$body = @{
    grant_type    = "client_credentials"
    client_id     = $appId
    client_secret = $appSecret
    scope         = "https://api.securitycenter.microsoft.com/.default"
}
$token = (Invoke-RestMethod -Method Post `
    -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" `
    -Body $body).access_token

# Create a block indicator for an AI tool domain
$indicator = @{
    indicatorValue = "openai.com"
    indicatorType  = "DomainName"
    action         = "Block"
    title          = "AI Tool - Blocked by policy"
    description    = "AI tool domain blocked per organizational policy"
    severity       = "Medium"
    generateAlert  = $true
} | ConvertTo-Json

Invoke-RestMethod -Method Post `
    -Uri "https://api.securitycenter.microsoft.com/api/indicators" `
    -Headers @{ Authorization = "Bearer $token" } `
    -ContentType "application/json" `
    -Body $indicator

// Intune: Device Configuration Profile — Network Protection (OMA-URI)
// Create via Intune > Devices > Configuration profiles > Create profile
// Platform: Windows 10 and later, Profile type: Custom

// OMA-URI Setting 1: Enable Network Protection
OMA-URI: ./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection
Data type: Integer
Value: 1   // 0=Disabled, 1=Enabled (Block), 2=Audit

// OMA-URI Setting 2: Allow Network Protection Down Level
OMA-URI: ./Vendor/MSFT/Policy/Config/Defender/AllowNetworkProtectionDownLevel
Data type: Integer
Value: 1

// OMA-URI Setting 3: Enable Network Protection on Win Server
OMA-URI: ./Vendor/MSFT/Policy/Config/Defender/AllowNetworkProtectionOnWinServer
Data type: Integer
Value: 1

# PowerShell: Deploy AI blocking via Microsoft Graph API
# Requires: Microsoft.Graph PowerShell module

Import-Module Microsoft.Graph.Security

# Connect with app-only authentication
$cert = Get-ChildItem Cert:\CurrentUser\My\THUMBPRINT
Connect-MgGraph -ClientId $appId -TenantId $tenantId `
    -Certificate $cert

# Fetch AI domains from our feed
$response = Invoke-RestMethod `
    -Uri "https://feeds.aitoolsblocklist.com/v1/domains?format=json&key=YOUR_KEY"

# Create indicators via Graph Security tiIndicators endpoint
foreach ($domain in $response.domains) {
    $params = @{
        action               = "block"
        description          = "AI tool domain - $($domain.category)"
        domainName           = $domain.domain
        expirationDateTime   = (Get-Date).AddDays(30).ToString("o")
        severity             = "medium"
        targetProduct        = "Microsoft Defender for Endpoint"
        threatType           = "UnwantedSoftware"
        tlpLevel             = "white"
    }
    New-MgSecurityTiIndicator -BodyParameter $params
}

Write-Host "Deployed $($response.domains.Count) AI-tool indicators via Graph API"

// KQL: Advanced Hunting — AI tool block events in the last 7 days
// Run in Microsoft 365 Defender > Hunting > Advanced hunting

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "SmartScreenUrlWarning"
    or ActionType == "ExploitGuardNetworkProtectionBlocked"
    or ActionType == "NetworkProtectionResponse"
| extend ParsedFields = parse_json(AdditionalFields)
| extend BlockedUrl = tostring(ParsedFields.ResponseCategory)
| where RemoteUrl has_any (
    "openai.com", "claude.ai", "anthropic.com",
    "gemini.google.com", "midjourney.com",
    "copilot.microsoft.com", "jasper.ai"
)
| summarize BlockCount = count() by DeviceName, AccountName, RemoteUrl
| sort by BlockCount desc

// KQL: Top 20 users attempting AI tool access — for policy review

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType in ("SmartScreenUrlWarning",
    "ExploitGuardNetworkProtectionBlocked")
| where RemoteUrl matches regex @"(openai|anthropic|claude|midjourney|jasper|writesonic|copy\.ai|huggingface)"
| summarize
    TotalAttempts = count(),
    UniqueTools = dcount(RemoteUrl),
    LastAttempt = max(Timestamp)
    by AccountName, DeviceName
| sort by TotalAttempts desc
| take 20

# PowerShell: Export AI-tool block events for compliance reporting

$startDate = (Get-Date).AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ssZ")

$query = @{
    Query = @"
DeviceEvents
| where Timestamp > datetime($startDate)
| where ActionType in ("SmartScreenUrlWarning",
    "ExploitGuardNetworkProtectionBlocked")
| project Timestamp, DeviceName, AccountName,
    RemoteUrl, ActionType
| sort by Timestamp desc
"@
} | ConvertTo-Json

$results = Invoke-RestMethod -Method Post `
    -Uri "https://api.securitycenter.microsoft.com/api/advancedhunting/run" `
    -Headers @{ Authorization = "Bearer $token" } `
    -ContentType "application/json" -Body $query

# Export to CSV for compliance team
$results.Results |
    Export-Csv -Path "AI_Block_Report_$(Get-Date -Format 'yyyyMMdd').csv" `
    -NoTypeInformation

Write-Host "Exported $($results.Results.Count) block events"