Microsoft InTune reporting basics

Within the administrative and reporting interface of InTune, is there a way to get the following data:

• All software installed on a device, and version?
• Report of whether windows defender (virus & threat protection) is 'running' on the device, last scan date, last update date?
• Report providing assurance that all Windows devices local drives are protected by Bitlocker?
• Report providing assurance that all Windows devices are controlled with Bitlocker To Go policies for USB devices? (and the specific settings)
• Report of all users/groups with "local administrator" permissions on each device. 

Secondly, does the system produce inventory type reporting, for example, if the device was 'offline' at the time to report(s) were ran, would InTune provide the most recent data as the last time the device reported back to Intune? Or will you simply not get the data for that device?
Thirdly, what permissions would allow someone to run such reports, but have limited permissions so they could make no changes in the system?

For info - the reporting will be against Windows 10 Laptop devices.
If InTune doesn't have the best reporting to achieve this, any other 3rd party recommended reporting tools for devices not joined to a local on-prem AD would be welcome. Not sure if PDQ Inventory, for example, can easily integrate with InTune managed kit.