14.3 Defender Vulnerability Management Dashboard

Defender Vulnerability Management Dashboard

Quick Answer: Defender Vulnerability Management is the posture-assessment layer inside Defender for Endpoint. Its dashboard surfaces your exposure score, Microsoft Secure Score for Devices, top security recommendations, weakest assets, and exposed software, then lets you turn any recommendation into a remediation task that you track to closure. It tells you what is wrong with your configuration; EDR alerts tell you what is actively attacking you.

What Defender Vulnerability Management Is

Microsoft Defender Vulnerability Management is a risk-based posture management module built into Defender for Endpoint. The core exposure dashboard is included with MDE Plan 2 and surfaces exposure score, recommendations, weakest assets, and exposed software. A standalone Defender Vulnerability Management add-on (sold separately or bundled with M365 E5 Insights and with the Defender VM standalone SKU) extends the core dashboard with:

• Secure configuration assessments for Microsoft products and third-party apps
• Software inventory with full end-of-life and version detail
• Browser extensions assessment
• Digital certificate assessment
• Network share assessments

For the MS-102 exam, the core dashboard is in scope; recognize the add-on when a question mentions secure configuration or certificate assessments.

---

Dashboard Views

Exposure Score

The exposure score is a 0-100 number that summarizes how exposed your devices are to vulnerabilities and misconfigurations. A lower score is better — it means your devices have fewer exploitable weaknesses. The score is calculated by weighing each device's:

• Missing security updates
• Misconfigurations (e.g., SMBv1 enabled, LAPS not configured)
• Exposed software (installed apps with known CVEs)

The exposure score is sliced into levels (Low, Medium, High) in the dashboard so you can see at a glance whether posture is trending better or worse. The numeric thresholds that define the bands are not published as fixed values — they are dynamic based on the threat landscape, so do not memorize a specific cutoff.

Microsoft Secure Score for Devices

Microsoft Secure Score for Devices is a separate 0-100 number that measures how well your devices are configured against a set of recommended security controls (for example, enable firewall, enable BitLocker, keep firewall on, enable tamper protection). A higher score is better. Secure Score for Devices is complementary to exposure score: exposure score asks "what is wrong?" and Secure Score asks "what recommended controls are in place?"

Top Security Recommendations

The Top security recommendations view lists each recommendation sorted by its recommendation impact — the projected drop in exposure score if you remediate that recommendation across every affected device. Each recommendation card shows:

• The recommendation text (e.g., Update Microsoft Edge or Enable tamper protection)
• The number of exposed machines
• The remediation type (configuration change, software update, uninstall)
• The recommendation impact

Top Exposed Machines and Weakest Assets

Top exposed machines ranks individual devices by their exposure. Weakest assets groups devices by exposure level so you can target the worst-off group first. Both views feed prioritization: fix the highest-impact recommendation on the most-exposed machines for the fastest posture improvement.

Exposed Software

The Exposed software view lists every installed product that has a known vulnerability, with version, CVE count, and the machines it is installed on. Use this view to drive software update campaigns and end-of-life migrations.

---

The Remediation Workflow

Turning a recommendation into closed-loop remediation is a four-step process.

graph LR
    A["Identify recommendation"] --> B["Request remediation"]
    B --> C["Remediation task created"]
    C --> D["Verify deployment"]
    D --> E["Verify exposure reduced"]

1. Identify a recommendation in the dashboard (sort by recommendation impact).
2. Request remediation from the recommendation card. Defender for Endpoint creates a remediation task with a due date and assignee; the task can be exported to a ticketing system or tracked in the Remediation and activities view.
3. Verify deployment — after the IT or patching team applies the fix, the device reports new telemetry. The recommendation card updates to show fewer affected machines.
4. Verify the exposure is reduced — the exposure score for the affected devices drops, and the overall tenant exposure score trends down.

The Remediation and activities tab tracks every open, closed, and overdue remediation task. Use it to hold owners accountable and to detect stalled remediation campaigns.

---

Vulnerability Management vs EDR

A common MS-102 confusion is conflating Vulnerability Management with EDR. They are complementary but distinct:

You need both. Patching a CVE (Vulnerability Management) closes the door; EDR catches the attacker who tries the handle anyway.

---

Using Exposure Trends Over Time

The dashboard includes an exposure trend chart that plots your tenant exposure score and Secure Score for Devices over the last 30, 60, or 90 days. A flat or rising exposure trend while you are actively remediating is a red flag — it usually means new devices or new software are entering the environment faster than you are closing findings. Investigate by filtering the device inventory for recently-onboarded devices and reviewing the exposed software view for new installs.

---

Practical Exam Pointers

• The exposure score and Secure Score for Devices move in opposite directions — exposure down is good, Secure Score up is good. Do not flip them on the exam.
• The remediation task is created inside Defender for Endpoint; you do not need a separate ITSM tool (though integration is supported).
• Recommendations are sorted by recommendation impact, not by CVE count or by the number of affected machines alone.
• The core dashboard ships with MDE P2. Secure configuration, certificate, and browser extension assessments are part of the add-on SKU.