chore: add defender policy

ImportPolicies.ps1

@@ -1,5 +1,5 @@
 # Connect to Microsoft Graph
-Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All", "Organization.Read.All" -NoWelcome
+Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All", "Organization.Read.All", "Group.ReadWrite.All", "Directory.ReadWrite.All" -NoWelcome
 
 # Get Tenant ID
 $tenant = Get-MgOrganization
@@ -16,7 +16,7 @@ ForEach ($policie in $policies) {
 
     try {
         $uri = "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies"  # Using the beta version
-        $response = Invoke-MgGraphRequest -Method POST -Uri $uri -Body ($PolicyObject | ConvertTo-Json -Depth 10)
+        # $response = Invoke-MgGraphRequest -Method POST -Uri $uri -Body ($PolicyObject | ConvertTo-Json -Depth 10)
         Write-Host "✅ $PolicieName - successfully imported!"
         #$response
     } catch {
@@ -25,4 +25,25 @@ ForEach ($policie in $policies) {
 }
 
 
-$null = Disconnect-Graph -ErrorAction SilentlyContinue
+# Define the dynamic membership rule
+$dynamicRule = '(device.deviceOSType -eq "Windows") and (device.accountEnabled -eq true) and (device.managementType -eq "MDM")'
+
+
+# Create the security group with dynamic membership
+$groupBody = @{
+    displayName = "Intune - All Windows Workstations Dynamic Membership"
+    mailEnabled = $false
+    mailNickname = "IntuneWindowsDevices"
+    securityEnabled = $true
+    groupTypes = @("DynamicMembership")
+    membershipRule = $dynamicRule
+    membershipRuleProcessingState = "On"
+}
+
+# Convert the body to JSON
+$groupBodyJson = $groupBody | ConvertTo-Json -Depth 10
+
+# Create the group using Invoke-MgGraphRequest
+Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/groups" -Body $groupBodyJson -ContentType "application/json"
+
+$null = Disconnect-Graph -ErrorAction SilentlyContinue