Blue16 Exposure Intelligence ● Passive · sends no traffic to the estate
Files or paste. Nothing to register.

1Defender device export

Defender portal → Hunting → Advanced hunting → paste the query → Run → Export. A role that can run hunting queries is enough — no app registration, no consent. This is the only route that carries a public IP; the Devices blade export does not.

Deliberately not filtered on IsInternetFacing: a filtered device list turns “not in this file” into a coverage gap that does not exist, and the report flags it when every row is internet-facing.

2Azure public IP addresses

Azure portal → Public IP addresses → Export to CSV, which is the file this was built against. Or run the script: Resource Graph covers every subscription in one call instead of one blade per tenant.

Needs Install-Module Az.ResourceGraph and Connect-AzAccount. Reader on the subscriptions is enough — no app registration.

3Entra trusted locations — optional

Entra admin centre → Protection → Conditional Access → Named locations, or run the script. A trusted location is your organisation declaring this public range is ours — an ownership claim neither of the files above can make, because one lists devices Defender manages and the other lists addresses Azure issued.

Needs Install-Module Microsoft.Graph.Authentication — that submodule alone, not the whole SDK. Policy.Read.All is the least-privileged scope and Global Reader or Security Reader already carries it, so no app registration. The raw Graph JSON works here too, if you would rather use Graph Explorer than install anything.
No ranges loaded.

4Tenant & previous baseline — optional

A baseline is a small file this report writes at the end. Load last month's and this run gains a delta: what appeared, what lost its sensor, what Shodan started seeing. Without one the report is simply today, which is what it has always been.

Nothing in these files identifies the tenant yet.
No baseline loaded — the report will show today only.
Compared on scope before content: a baseline taken from an unfiltered Defender export cannot be compared against a filtered one, because every device missing from the filtered run would read as decommissioned. The report says so rather than showing the difference.
Load either file, or both. Both together is what produces the coverage answer.
Where the estate is
Every machine here has a Defender sensor At least one has no sensor Bigger circle = more addresses at that location Click a circle for the addresses
Reading the files locates each address with ipwho.is, which is what fills this map. Building the report also asks Shodan InternetDB what it last saw open. Both are read-only lookups about the addresses — nothing is sent to the estate itself.