It would be great if you could turn on Microsoft Defender Audit mode through huntress https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-worldwide