$ruleIds = @(
    "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",
    "5beb7efe-fd9a-4556-801d-275e5ffc04cc",
    "d3e037e1-3eb8-44c8-a917-57927947596d",
    "01443614-cd74-433a-b99e-2ecdc07bfc25",
    "d4f940ab-401b-4efc-aadc-ad5f3c50688a",
    "3b576869-a4ec-4529-8536-b80a7769e899"
)

$actions = @(
    "AuditMode",
    "AuditMode",
    "AuditMode",
    "AuditMode",
    "AuditMode",
    "AuditMode"
)

Add-MpPreference `
    -AttackSurfaceReductionRules_Ids $ruleIds `
    -AttackSurfaceReductionRules_Actions $actions

Microsoftも、最初に監査モードで動作と影響を確認してから有効化する手順を案内しています。