Note: A Client Global Administrator or Cloud Application Administrator (least privileged) must consent to this URL to authorize this application.
PackageCollectorPlus leverages MDE Live Response to make remote triage collections on Isolated & Active MDE endpoints. “Live response unsigned script execution” is not required. All tasks are performed by signed PowerShell.
Specify the Defender for Endpoint TenantId and DeviceIds for package collection.