Every month brings a new batch of vulnerabilities, and no IT team patches everything the day it lands. The real skill is deciding what to fix first. Microsoft Defender Vulnerability Management helps by ranking weaknesses across your devices based on real-world threat and exposure, not just a severity number. This article shows how to use it to focus on the patches that actually reduce risk, and how to turn its findings into work your team can finish.
Why “patch everything critical” stops working
A CVSS score tells you how bad a vulnerability could be in theory. It does not tell you whether attackers are using it, whether the affected software is even running on your laptops, or whether the device is exposed to the internet. A list sorted by CVSS alone tends to bury the one browser flaw being exploited this week under fifty “critical” items in software nobody opens.
In the tenants I review, the pattern is consistent. Windows itself is usually well patched through update rings or Windows Autopatch. The risk sits in third-party apps: an old PDF reader, a forgotten Java runtime, a browser extension, a VPN client two years out of date. Those are exactly the items a severity-only approach misses.
What Defender Vulnerability Management gives you
Defender Vulnerability Management uses the Microsoft Defender for Endpoint sensor already on your devices, so there is no separate scanner to deploy. It builds a software inventory, checks it against known vulnerabilities and misconfigurations, and produces security recommendations ranked by impact.
Microsoft describes the ranking as based on three factors: the threat (vulnerability characteristics, available exploits and active campaigns), breach likelihood (your organization’s posture), and business value (the importance of the asset). The newer exposure score model also takes in exploit prediction data (EPSS) and asset context such as whether a device is internet-facing and how critical it is marked.
Two numbers matter on the dashboard:
Exposure score: lower is better. Microsoft groups it as 0-29 low, 30-69 medium and 70-100 high. It recalculates daily.
Microsoft Secure Score for Devices: higher is better. It reflects configuration, not just missing patches.
Which licence includes what
Licence
What you get
Defender for Endpoint Plan 2 (included in Microsoft 365 E5)
Core capabilities: device and software inventory, vulnerability and configuration assessment, risk-based prioritization, remediation tracking
Defender Vulnerability Management Add-on (for Plan 2)
Premium capabilities: security baselines assessment, blocking vulnerable applications, browser extension and certificate assessment, hardware and firmware assessment
Defender Vulnerability Management Standalone
Full capabilities, usable alongside other EDR products
If you are on Microsoft 365 Business Premium, check the vulnerability management area of the Microsoft Defender portal to see which capabilities your Defender for Business subscription exposes before you build a process around them.
A weekly prioritization routine
The tool is only useful if someone looks at it on a schedule. This is the routine I use for a 20 to 500 seat business. It takes about an hour a week once it is running.
Open the recommendations list. In the Microsoft Defender portal, go to Vulnerability management > Recommendations. In tenants using the newer experience it sits under Exposure management > Recommendations.
Filter for active threat first. Look for the icons Microsoft uses for possible active alerts and associated public exploits. Anything with an exploit and exposed devices goes to the top, regardless of score.
Sort the rest by impact. The impact column shows how much each recommendation would lower your exposure score and raise Secure Score for Devices. Work from the top.
Check the exposed device count. A recommendation affecting three devices is often a quick win. One affecting every laptop needs a planned deployment.
Raise a remediation request. From the recommendation, select Remediation options. You can open a ticket in Microsoft Intune so the endpoint team sees it as a security task, then track it on the Remediation page.
Use exceptions honestly. If a vulnerable app is required and cannot be updated, create an exception with a reason and an expiry date, not a permanent one.
Review last week’s items. Exposure score updates within about 24 hours of remediation. If it has not moved, the update did not land.
Turning recommendations into patches
Defender tells you what to fix. Intune and Windows Update do the fixing. Match each kind of finding to the tool that resolves it:
Windows OS updates: Windows Update rings or Windows Autopatch. If OS findings keep appearing, check that devices are not stuck on a paused ring or failing to restart.
Microsoft 365 Apps: update channel and deadline settings. Monthly Enterprise Channel is a reasonable default for most businesses.
Edge and Chrome: browser update policies through the settings catalog. Browsers update themselves if policy does not stop them.
Third-party apps: Win32 app deployments in Intune with supersedence, so the new version replaces the old one. Remove software nobody uses instead of patching it.
Configuration weaknesses: Intune security baselines and endpoint security policies, for example ASR rules or disabling legacy protocols.
The single most effective change in most environments is uninstalling. Defender’s software inventory shows how many devices run each app and, with usage insights, whether anyone actually opens it. Every unused app removed is a source of future vulnerabilities gone for good.
When there is no patch yet
Some recommendations have no fix available, or the vendor’s update breaks a line-of-business app. Do not leave these sitting in the list with no owner. Check whether the recommendation offers a configuration mitigation, such as disabling a vulnerable feature or protocol, and deploy it through Intune. Tighten the controls around the affected devices: make sure attack surface reduction rules are in Block mode, restrict who can sign in, and limit network exposure. Record the decision as a time-limited exception so it comes back for review, and revisit it as soon as the vendor ships a fix.
Set targets you can report on
Leadership does not need a CVE list. They need to know whether risk is going up or down. Pick a few measures and report them monthly:
Exposure score trend over 90 days
Number of recommendations with a known exploit, target zero older than 14 days
Median days to remediate high-impact recommendations
Percentage of devices on a supported Windows build
These also make good evidence for cyber insurance renewals and frameworks such as NIST CSF, which expect a documented, risk-based vulnerability process rather than ad hoc patching.
Frequently asked questions
Do I need a separate scanner for Defender Vulnerability Management?
No. It uses the Defender for Endpoint sensor already built into Windows and onboarded to your tenant. Microsoft notes that assessment accuracy depends on successful data collection, so application control or restricted PowerShell modes may need allow rules for Defender scripts.
How is the exposure score different from Secure Score?
Exposure score measures how vulnerable your devices are to exploitation, and lower is better. Microsoft Secure Score for Devices measures configuration posture, and higher is better. They are calculated independently.
Which Microsoft 365 licence includes Defender Vulnerability Management?
Core capabilities come with Defender for Endpoint Plan 2, included in Microsoft 365 E5. Premium capabilities need the Defender Vulnerability Management Add-on, and a standalone version is also available.
Every month brings a new batch of vulnerabilities, and no IT team patches everything the day it lands. The real skill is deciding what to fix first. Microsoft Defender Vulnerability Management helps by ranking weaknesses across your devices based on real-world threat and exposure, not just a severity number. This article shows how to use it to focus on the patches that actually reduce risk, and how to turn its findings into work your team can finish.
Why “patch everything critical” stops working
A CVSS score tells you how bad a vulnerability could be in theory. It does not tell you whether attackers are using it, whether the affected software is even running on your laptops, or whether the device is exposed to the internet. A list sorted by CVSS alone tends to bury the one browser flaw being exploited this week under fifty “critical” items in software nobody opens.
In the tenants I review, the pattern is consistent. Windows itself is usually well patched through update rings or Windows Autopatch. The risk sits in third-party apps: an old PDF reader, a forgotten Java runtime, a browser extension, a VPN client two years out of date. Those are exactly the items a severity-only approach misses.
What Defender Vulnerability Management gives you
Defender Vulnerability Management uses the Microsoft Defender for Endpoint sensor already on your devices, so there is no separate scanner to deploy. It builds a software inventory, checks it against known vulnerabilities and misconfigurations, and produces security recommendations ranked by impact.
Microsoft describes the ranking as based on three factors: the threat (vulnerability characteristics, available exploits and active campaigns), breach likelihood (your organization’s posture), and business value (the importance of the asset). The newer exposure score model also takes in exploit prediction data (EPSS) and asset context such as whether a device is internet-facing and how critical it is marked.
Two numbers matter on the dashboard:
Which licence includes what
If you are on Microsoft 365 Business Premium, check the vulnerability management area of the Microsoft Defender portal to see which capabilities your Defender for Business subscription exposes before you build a process around them.
A weekly prioritization routine
The tool is only useful if someone looks at it on a schedule. This is the routine I use for a 20 to 500 seat business. It takes about an hour a week once it is running.
Vulnerability management > Recommendations. In tenants using the newer experience it sits underExposure management > Recommendations.Turning recommendations into patches
Defender tells you what to fix. Intune and Windows Update do the fixing. Match each kind of finding to the tool that resolves it:
The single most effective change in most environments is uninstalling. Defender’s software inventory shows how many devices run each app and, with usage insights, whether anyone actually opens it. Every unused app removed is a source of future vulnerabilities gone for good.
When there is no patch yet
Some recommendations have no fix available, or the vendor’s update breaks a line-of-business app. Do not leave these sitting in the list with no owner. Check whether the recommendation offers a configuration mitigation, such as disabling a vulnerable feature or protocol, and deploy it through Intune. Tighten the controls around the affected devices: make sure attack surface reduction rules are in Block mode, restrict who can sign in, and limit network exposure. Record the decision as a time-limited exception so it comes back for review, and revisit it as soon as the vendor ships a fix.
Set targets you can report on
Leadership does not need a CVE list. They need to know whether risk is going up or down. Pick a few measures and report them monthly:
These also make good evidence for cyber insurance renewals and frameworks such as NIST CSF, which expect a documented, risk-based vulnerability process rather than ad hoc patching.
Frequently asked questions
Do I need a separate scanner for Defender Vulnerability Management?
No. It uses the Defender for Endpoint sensor already built into Windows and onboarded to your tenant. Microsoft notes that assessment accuracy depends on successful data collection, so application control or restricted PowerShell modes may need allow rules for Defender scripts.
How is the exposure score different from Secure Score?
Exposure score measures how vulnerable your devices are to exploitation, and lower is better. Microsoft Secure Score for Devices measures configuration posture, and higher is better. They are calculated independently.
Which Microsoft 365 licence includes Defender Vulnerability Management?
Core capabilities come with Defender for Endpoint Plan 2, included in Microsoft 365 E5. Premium capabilities need the Defender Vulnerability Management Add-on, and a standalone version is also available.
Microsoft’s article on security recommendations explains the ranking model in detail. If you want someone running this routine for you, our managed security service includes weekly vulnerability triage, and our Defender for Endpoint deployment gets the sensor and policies in place. Comparing licence options? Try our E5 vs E3 calculator.
Want to see your current exposure score and the five fixes that would move it most? Book a free Microsoft 365 security assessment.