14.3 Defender Vulnerability Management Dashboard

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

14.3 Defender Vulnerability Management Dashboard

Key Takeaways Explain This Topic AI

Exposure score is a 0-100 measure of how exposed your devices are to vulnerabilities and misconfigurations, with higher values indicating greater exposure

Microsoft Secure Score for Devices is a separate 0-100 metric that measures how well devices are configured against recommended security controls

The remediation workflow is: review a recommendation → request remediation (creates a remediation task) → verify deployment → verify the exposure score drops

Defender Vulnerability Management assesses configuration and software exposure; EDR alerts flag active threats — the two are complementary, not substitutes

The standalone Defender Vulnerability Management add-on adds secure configuration assessments, software inventory, browser extensions, and certificate assessment on top of the core dashboard included with MDE Plan 2

Last updated: August 2026

Defender Vulnerability Management Dashboard

Quick Answer: Defender Vulnerability Management is the posture-assessment layer inside Defender for Endpoint. Its dashboard surfaces your exposure score , Microsoft Secure Score for Devices , top security recommendations , weakest assets , and exposed software , then lets you turn any recommendation into a remediation task that you track to closure. It tells you what is wrong with your configuration; EDR alerts tell you what is actively attacking you.

What Defender Vulnerability Management Is

Microsoft Defender Vulnerability Management is a risk-based posture management module built into Defender for Endpoint. The core exposure dashboard is included with MDE Plan 2 and surfaces exposure score, recommendations, weakest assets, and exposed software. A standalone Defender Vulnerability Management add-on (sold separately or bundled with M365 E5 Insights and with the Defender VM standalone SKU) extends the core dashboard with:

• Secure configuration assessments for Microsoft products and third-party apps
• Software inventory with full end-of-life and version detail
• Browser extensions assessment
• Digital certificate assessment
• Network share assessments

For the MS-102 exam, the core dashboard is in scope; recognize the add-on when a question mentions secure configuration or certificate assessments.

• Dashboard Views
• Exposure Score

The exposure score is a 0-100 number that summarizes how exposed your devices are to vulnerabilities and misconfigurations. A lower score is better — it means your devices have fewer exploitable weaknesses. The score is calculated by weighing each device's:

• Missing security updates
• Misconfigurations (e.g., SMBv1 enabled, LAPS not configured)
• Exposed software (installed apps with known CVEs)

The exposure score is sliced into levels (Low, Medium, High) in the dashboard so you can see at a glance whether posture is trending better or worse. The numeric thresholds that define the bands are not published as fixed values — they are dynamic based on the threat landscape, so do not memorize a specific cutoff.

Microsoft Secure Score for Devices

Microsoft Secure Score for Devices is a separate 0-100 number that measures how well your devices are configured against a set of recommended security controls (for example, enable firewall, enable BitLocker, keep firewall on, enable tamper protection). A higher score is better. Secure Score for Devices is complementary to exposure score: exposure score asks "what is wrong?" and Secure Score asks "what recommended controls are in place?"

Top Security Recommendations

The Top security recommendations view lists each recommendation sorted by its recommendation impact — the projected drop in exposure score if you remediate that recommendation across every affected device. Each recommendation card shows:

• The recommendation text (e.g., Update Microsoft Edge or Enable tamper protection )
• The number of exposed machines
• The remediation type (configuration change, software update, uninstall)
• The recommendation impact
• Top Exposed Machines and Weakest Assets

Top exposed machines ranks individual devices by their exposure. Weakest assets groups devices by exposure level so you can target the worst-off group first. Both views feed prioritization: fix the highest-impact recommendation on the most-exposed machines for the fastest posture improvement.

Exposed Software

The Exposed software view lists every installed product that has a known vulnerability, with version, CVE count, and the machines it is installed on. Use this view to drive software update campaigns and end-of-life migrations.

The Remediation Workflow

Turning a recommendation into closed-loop remediation is a four-step process.

Loading diagram...

Identify a recommendation in the dashboard (sort by recommendation impact).

Request remediation from the recommendation card. Defender for Endpoint creates a remediation task with a due date and assignee; the task can be exported to a ticketing system or tracked in the Remediation and activities view.

Verify deployment — after the IT or patching team applies the fix, the device reports new telemetry. The recommendation card updates to show fewer affected machines.

Verify the exposure is reduced — the exposure score for the affected devices drops, and the overall tenant exposure score trends down.

The Remediation and activities tab tracks every open, closed, and overdue remediation task. Use it to hold owners accountable and to detect stalled remediation campaigns.

Vulnerability Management vs EDR

A common MS-102 confusion is conflating Vulnerability Management with EDR. They are complementary but distinct:

Aspect Vulnerability Management EDR Alerts

What it answers What is wrong with our configuration and patching? What is actively attacking us right now?

Data source Device posture scans, inventory, configuration baselines Sensor telemetry, behavioral detections, threat intel

• Output Recommendations, exposure score, remediation tasks Incidents, alerts, automated investigations
• Time horizon Continuous posture over weeks and months Real-time detections

Example action Patch CVE-2024-12345 across exposed machines Triage an incident where a malicious macro spawned PowerShell

You need both. Patching a CVE (Vulnerability Management) closes the door; EDR catches the attacker who tries the handle anyway.

Using Exposure Trends Over Time

The dashboard includes an exposure trend chart that plots your tenant exposure score and Secure Score for Devices over the last 30, 60, or 90 days. A flat or rising exposure trend while you are actively remediating is a red flag — it usually means new devices or new software are entering the environment faster than you are closing findings. Investigate by filtering the device inventory for recently-onboarded devices and reviewing the exposed software view for new installs.

Practical Exam Pointers

The exposure score and Secure Score for Devices move in opposite directions — exposure down is good, Secure Score up is good. Do not flip them on the exam.

The remediation task is created inside Defender for Endpoint ; you do not need a separate ITSM tool (though integration is supported).

Recommendations are sorted by recommendation impact , not by CVE count or by the number of affected machines alone.

The core dashboard ships with MDE P2. Secure configuration, certificate, and browser extension assessments are part of the add-on SKU.