This query is designed to identify devices that are not compliant with specific Endpoint Detection and Response (EDR) security settings. Here's a simple breakdown of what it does:

1. Data Source: It starts by using data from two tables: DeviceTvmSecureConfigurationAssessment and DeviceTvmSecureConfigurationAssessmentKB.

2. Joining Tables: It combines these two tables based on a common field called ConfigurationId. This means it matches records from both tables that have the same ConfigurationId.

3. Filtering Non-Compliant Devices:

   • It filters the results to include only those devices where the IsCompliant field is equal to 0, indicating that these devices are not compliant with the required security settings.
   • It also checks that the IsApplicable field is equal to 1, meaning the security setting is relevant and should be applied to these devices.

4. Focusing on EDR Settings: Finally, it narrows down the results to focus specifically on settings related to the "EDR" (Endpoint Detection and Response) category.

In summary, this query identifies devices that should have certain EDR security settings applied but currently do not comply with those settings.