fedora-intune: Defender script also turns on behavior monitoring

Behavior monitoring is off by default and the repair script never
checked it, so on devices without the image's managed config (another
distro, a plain install) it stayed off and the compliance rule failed.
Enable it, and cloud-delivered protection, when they're off and not
managed.

Only start mdatp-firstboot where the image installed it; elsewhere every
run logged that first-boot setup hadn't completed and tried to start a
unit that doesn't exist.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -34,7 +34,10 @@ add-files:
   # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
   # Not set here: network protection (Insiders channels only) and tamper
   # protection (audit-only preview on Linux).
-  - ["mdatp_managed.json", "/etc/opt/microsoft/mdatp/managed/mdatp_managed.json"]
+  - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
+  # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
+  # see the drop-in.
+  - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
 
 postprocess:
   - |
@@ -52,6 +55,6 @@ postprocess:
     done
     semodule -n -i "${pp}"
     # Fail the build on a typo rather than ship a config Defender can't read.
-    python3 -m json.tool /etc/opt/microsoft/mdatp/managed/mdatp_managed.json > /dev/null
+    python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
     rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
     chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst

images/fedora-intune/files/himmelblau-os-release

@@ -5,16 +5,23 @@
 # "44". Himmelblau reports VERSION_ID as the device's OS version and has no
 # setting for it. The rest of the system keeps the stock VERSION_ID, which
 # toolbox, flatpak and dnf expect to be the plain release.
+#
+# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID"
+# as the OS version string, and Fedora's PRETTY_NAME already contains the
+# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing
+# else in Himmelblau reads PRETTY_NAME.
 set -euo pipefail
 
 SRC=/usr/lib/os-release
 DEST=/run/himmelblau-os-release
 
 version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
+name="$(. "${SRC}" && echo "${NAME:-Linux}")"
 
 tmp="$(mktemp "${DEST}.XXXXXX")"
 if [[ -n "${version}" ]]; then
-  sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
+  sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \
+      -e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}"
 else
   # No image version (not an ostree/bootc deployment): pass it through as-is.
   cat "${SRC}" > "${tmp}"

images/fedora-intune/files/himmelblau.conf

@@ -11,6 +11,9 @@ apply_policy = true
 # Fedora's admin group; members of sudo_groups (Entra group object IDs) are
 # added to it.
 local_sudo_group = wheel
+# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
+# local_groups_reconcile_interval after leaving the group.
+sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
 # Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
 home_attr = CN
 home_alias = SPN

images/fedora-intune/files/mdatp-managed-config.conf

@@ -0,0 +1,7 @@
+# Install the image's enforced Defender settings each time Defender starts.
+# The image can't ship them in /etc directly: mdatp-firstboot creates
+# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
+# as local and ostree's /etc merge never adds new files under it. Copying on
+# every start also picks up changes from newer images and undoes local edits.
+[Service]
+ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json

images/fedora-intune/intune/defender-compliance.sh

@@ -2,20 +2,26 @@
 # Intune custom compliance discovery script for Linux: is Microsoft Defender
 # for Endpoint (mdatp) installed, onboarded, licensed and protecting?
 #
-# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
+# Upload in Intune > Endpoint security > Device compliance > Scripts (Linux),
-# defender-compliance.json in a Linux compliance policy (Custom compliance).
+# and pair it with defender-compliance.json in a Linux compliance policy
-# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
+# (Custom compliance). Himmelblau runs it as root inside
-# JSON on stdout to Intune, which evaluates it against the rules. Every setting
+# himmelblaud-tasks.service and sends the JSON on stdout to Intune, which
-# is always emitted, so a missing or stopped Defender reads as non-compliant
+# evaluates it against the rules. Every setting is always emitted, so a missing
-# instead of as a script error.
+# or stopped Defender reads as non-compliant instead of as a script error.
 
 MDATP=/usr/bin/mdatp
 
-# Print one `mdatp health` field without quotes or a trailing " [managed]".
+# Defender won't answer `mdatp health` started from inside himmelblaud-tasks
-# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
+# (it can't read that process while checking the caller), so ask through
+# systemd, which runs mdatp as its own child. Elsewhere, ask mdatp directly.
+health="$(systemd-run --quiet --wait --pipe --collect "${MDATP}" health 2>/dev/null)"
+grep -q '^healthy' <<< "${health}" || health="$("${MDATP}" health 2>/dev/null)"
+
+# Print one field of the `mdatp health` output ("name : value") without
+# quotes or a trailing " [managed]".
 field() {
-  "${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
+  grep -m1 "^$1 *:" <<< "${health}" \
-    | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
+    | sed -e 's/^[^:]*: *//' -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
 }
 
 bool() {

images/fedora-intune/intune/defender-remediation.sh

@@ -56,7 +56,7 @@ if [[ ! -x "${MDATP}" ]]; then
 fi
 
 # The image finishes the Defender install on first boot (mdatp-firstboot).
-if [[ ! -f /var/lib/mdatp-firstboot.done ]]; then
+if [[ -x /usr/libexec/mdatp-firstboot && ! -f /var/lib/mdatp-firstboot.done ]]; then
   log "Defender first-boot setup has not completed; starting it."
   systemctl start mdatp-firstboot.service
 fi
@@ -93,18 +93,30 @@ if [[ -z "$(field org_id)" ]]; then
   fi
 fi
 
-# Settings Defender's own policy manages show " [managed]" and can't be
+# Settings a managed config (mdatp_managed.json) sets show " [managed]" and
-# changed locally; this only fixes a locally disabled real-time protection.
+# can't be changed locally; these fix devices without one, where behavior
+# monitoring is off by default. Behavior monitoring needs real-time
+# protection, so that goes first.
 if [[ "$(field real_time_protection_enabled)" != true ]]; then
   log "Real-time protection is off; enabling it."
   "${MDATP}" config real-time-protection --value enabled
 fi
 
+if [[ "$(field behavior_monitoring)" != enabled ]]; then
+  log "Behavior monitoring is off; enabling it."
+  "${MDATP}" config behavior-monitoring --value enabled
+fi
+
+if [[ "$(field cloud_enabled)" != true ]]; then
+  log "Cloud-delivered protection is off; enabling it."
+  "${MDATP}" config cloud --value enabled
+fi
+
 if [[ "$(field definitions_status)" != up_to_date ]]; then
   log "Definitions are not up to date; updating them."
   "${MDATP}" definitions update
 fi
 
 healthy="$(field healthy)"
-log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) definitions=$(field definitions_status)"
+log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) behavior_monitoring=$(field behavior_monitoring) cloud=$(field cloud_enabled) definitions=$(field definitions_status)"
 [[ "${healthy}" == true ]]