Troubleshooting mode for Microsoft Defender for Endpoint would be a pretty useful feature considering that the tamper protection is turned on or off for all devices and there are no in-betweens. Tamper protection prevents an admin from stopping services or making some of the configuration changes at the end point if one were to engage in troubleshooting of reported issues around MDE. As we helped deploy MDE with our clients, we had to face a bunch of issues, and it keeps coming as more devices are onboarded, and the new kid on the block takes a lot of the blame from application / performance issues to the battery inefficiencies, you name it. One quick way to prove the issues are not related to MDE deployment, is to turn off MDE features at the endpoint. But then the tamper protection will not allow an admin to turn off several features. This troubleshooting mode will help a good bit to understand/address the issues. I like the 3 hours window before reset back to configured values and the KQL provided by the team which I can see will be very useful.
Troubleshooting mode for Microsoft Defender for Endpoint now Generally Available