Calculations for Defender for Office 365 incomplete

[DMoenks]

The calculations for Defender for Office 365 currently solely rely on Exchange Online mailboxes. The license terms describe additional scenarios where licenses would be required.

[DMoenks]

To check additional license terms, read access to Defender configuration would be needed, which seems only possible by using Exchange Online PowerShell in combination with the Azure AD Security Reader role as of now, as Graph only provides access to content, not configuration. To eliminate write access for the script and provide necessary read access at the same time, using the Global Reader role instead of a combination of Exchange Recipient Administrator and Security Reader roles might be preferred.

[DMoenks]

Resolving this issue would need clarification based on the following other issues:

• [ ] https://github.com/MicrosoftDocs/OfficeDocs-O365ServiceDescriptions/issues/764
• [ ] https://github.com/MicrosoftDocs/microsoft-365-docs/issues/10327