KQL query for AntiVirus policy report

Hi Maddenk 

One possibility is to look what is available in the Windows Event Log 

1. Applications and Services Logs > Microsoft > Windows > SENSE and click on Operational. cc https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/event-error-codes?view=o365-worldwide

2. Applications and Services Logs > Microsoft > Windows > Windows Defender and click on Operational cc https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#:~:text=Open%20Event%20Viewer.,events%20to%20find%20your%20event.

However, you may not find the information that is available through the Get-MpPreference PowerShell cmdlet.
If the goal is to have a desired state on machines managed by Azure (Either within Azure, either through Azure Arc) you could use https://docs.microsoft.com/en-us/powershell/dsc/getting-started/wingettingstarted?view=dsc-1.1 .If the goal is to have an overview, maybe that an https://docs.microsoft.com/en-us/azure/automation/automation-create-alert-triggered-runbook could help

Kind Regards,
Thomas