Skip to content

Microsoft Defender Vulnerability Management Overview

Last updated: 2026-07-27

References

Back to the documentation hub

Defender Vulnerability Management continuously discovers endpoint software and weaknesses, prioritizes them with threat and business context, and coordinates remediation with security and IT teams. It replaces periodic scan-and-spreadsheet cycles with a live, risk-ranked view of what to fix first.

Why enable it

Every environment has more vulnerabilities than any team can patch at once. The question is which few actually expose you. Defender Vulnerability Management ranks findings by active exploitation, exposure, and asset criticality so effort goes where it reduces the most risk.

Without Defender Vulnerability Management With it enabled
Scans run periodically and age quickly Discovery is continuous and always current
Findings are a flat Common Vulnerabilities and Exposures (CVE) list Risk-based prioritization ranks what to fix first
Software inventory is incomplete Live inventory covers apps, extensions, and certificates
Remediation is tracked in spreadsheets Requests flow to IT with progress tracking

Value in one line: it focuses limited patching effort on the vulnerabilities attackers are actually using, instead of an endless undifferentiated list.

How it works

Defender Vulnerability Management uses the Defender for Endpoint sensor already on your devices to keep a live inventory of installed software, browser extensions, certificates, and firmware, and it maps that inventory against Microsoft's vulnerability and threat intelligence. Instead of a flat CVE count, it produces a risk-based ranking that weights each weakness by active exploitation, internet exposure, and the criticality of the affected asset.

From a finding, it can create a remediation request that flows to IT through Microsoft Intune, with progress tracked to completion. Exceptions carry an owner, justification, compensating control, and expiry, so accepted risk stays visible instead of disappearing into a spreadsheet.

Configure

  1. Confirm whether capabilities come from Defender for Endpoint or an add-on.
  2. Onboard supported endpoint platforms and verify sensor health.
  3. Define device groups, criticality, exposure ownership, and role access.
  4. Review security baselines, software inventory, certificates, and extensions.
  5. Integrate remediation tasks with Intune or the organization's IT workflow.
  6. Set exception criteria, compensating controls, owners, and expiration dates.

Verify and operate

  • Reconcile device and software inventory with management systems.
  • Prioritize by exploitability, exposure, criticality, and active threat evidence.
  • Track remediation completion instead of treating recommendation closure as proof.
  • Measure vulnerable-device age, internet exposure, and exception debt.
  • Validate that removed software and patches are reflected after the scan interval.

Architecture and prerequisites

  • Data source: the Defender for Endpoint sensor continuously reports installed software, extensions, certificates, and firmware. There is no separate scan window.
  • Licensing: core capabilities ship with Defender for Endpoint Plan 2; the add-on extends premium features such as authenticated scans, certificate and firmware assessment, and browser-extension inventory.
  • Prioritization: exposure score and Microsoft threat intelligence rank findings by active exploitation, exposure, and asset criticality.
  • Remediation: requests flow to Microsoft Intune as tasks and track to completion.

Advanced hunting example

Find devices exposed to a specific CVE:

DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2024-0000"
| project DeviceName, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel

Rank CVEs by the number of affected devices before combining the result with business criticality and active-exploitation context:

DeviceTvmSoftwareVulnerabilities
| where Timestamp > ago(30d)
| summarize affectedDevices = dcount(DeviceId),
    devices = make_set(DeviceName, 10) by CveId, VulnerabilitySeverityLevel
| order by affectedDevices desc

Track remediation to closure, and record exceptions with an owner, compensating control, and expiry rather than closing the recommendation as proof.

Note

Vulnerability Management prioritizes risk; patch deployment still uses Intune, Configuration Manager, platform tooling, or another software-management system.

Operational decisions

  • Prioritize remediation by exposure, exploit evidence, business criticality, and compensating controls rather than Common Vulnerability Scoring System (CVSS) score alone.
  • Agree an exception owner and expiry date for every accepted vulnerability; a deferred patch without a review date is unmanaged risk.
  • Retain device group, software version, vulnerability ID, exposure rationale, remediation task, exception evidence, and verification scan result.

Business example

A critical browser CVE affects 2,000 devices, but vulnerability management ranks the 40 internet-facing executive and finance devices first because exploitation is active. IT creates an Intune remediation task for that cohort, confirms the new browser version through device inventory, then phases the remaining devices after the highest-risk exposure is closed.