Microsoft Security Exposure Management

1. Updated

   Codename MDASH - MAI Cyber configuration now uses MAI-Cyber-1.1-Flash

   The MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash.

   Detected Nov 11, 2026 · listed under October 2026

1. GA

   Posture policies and recommendation exemptions available for Azure environments

   October 28, 2026 Posture policies and recommendation exemptions are now available in public preview as part of Microsoft Security Exposure Management for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure…

   DocsManage posture policiesNew·Manage exemptionsNew

   Manage posture policies Learn how to manage posture policies in the Microsoft Defender portal, including policy types, permissions, policy effects, transition guidance, and limitations.

   Listed under October 2026 on Microsoft Learn
2. Preview

   Codename MDASH - MAI Cyber configuration now uses MAI-Cyber-1.1-Flash

   The MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash. MAI Cyber (Preview) is now the recommended scan configuration for MDASH.

   Listed under October 2026 on Microsoft Learn
3. GA

   Vulnerability assessment for Microsoft Store applications

   Vulnerability assessment for Microsoft Store applications. Vulnerability assessment for applications installed via the Microsoft Store is now generally available. Defender Vulnerability Management detects supported Microsoft Store applications, adds them to the software inventory, and assesses them for vulnerabilities. Coverage is…

   DocsSoftware inventoryNew

   Software inventory The software inventory page for Microsoft Defender Vulnerability Management shows how many weaknesses and vulnerabilities were detected in software.

   Listed under October 2026 on Microsoft Learn

1. New feature

   Improved onboarding experience for MDASH

   The MDASH onboarding experience has been improved to make setup clearer and more guided. Instead of a single panel that contains all setup steps, onboarding is now organized into clear tasks that users complete as part of the flow. This…

   DocsSet up Microsoft Foundry for Codename MDASH - Agentic code scanner …Updated

   Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration Connect Codename MDASH - Agentic code scanner to your Microsoft Foundry project by creating a resource, deploying the required models, and providing the project endpoint and API key.

   Listed under September 2026 on Microsoft Learn
2. New feature

   Codename MDASH - Scan progress monitoring

   Scan progress helps you understand whether a scan is waiting, processing code, validating findings, or publishing results. Check completed work, elapsed time, and output availability to understand what is happening during a long-running scan. For more information, see Monitor scan…

   DocsCodename MDASH - Agentic code scanner initiativeUpdated

   Codename MDASH - Agentic code scanner initiative Learn how to use the Codename MDASH - Agentic code scanner initiative page in Microsoft Defender to triage and remediate code-level weaknesses detected by agentic code scanning.

   Listed under September 2026 on Microsoft Learn
3. GA

   New Microsoft Secure Score recommendations for AI-Readiness

   New Microsoft Secure Score recommendations for AI-Readiness. Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry…

   Listed under September 2026 on Microsoft Learn

1. New feature

   Keyless authentication for the Microsoft Foundry connection preview

   You can now connect your Microsoft Foundry resource to codename MDASH using Keyless authentication , the recommended method. Keyless relies on a managed identity instead of a stored secret - no API key is kept in Defender, and there's no…

   DocsSet up Microsoft Foundry for Codename MDASH - Agentic code scanner …Updated

   Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration Connect Codename MDASH - Agentic code scanner to your Microsoft Foundry project by creating a resource, deploying the required models, and providing the project endpoint and API key.

   Listed under August 2026 on Microsoft Learn
2. New feature

   Codename MDASH - Cancel scan

   Scan cancellation, previously available only in Defender CLI, is now also available in the Microsoft Defender portal. You can cancel queued or running scans from the scan details page in the Scans tab. For more information, see Cancel scan .

   DocsCodename MDASH - Agentic code scanner initiativeUpdated

   Codename MDASH - Agentic code scanner initiative Learn how to use the Codename MDASH - Agentic code scanner initiative page in Microsoft Defender to triage and remediate code-level weaknesses detected by agentic code scanning.

   Listed under August 2026 on Microsoft Learn
3. GA

   Codename MDASH - Azure DevOps connector preview

   The Azure DevOps connector is now available in preview for Codename MDASH - Agentic code scanner. Security teams can connect Azure DevOps organizations from the Microsoft Defender portal, onboard repositories, and trigger remote on-demand agentic code scans for the onboarded…

   DocsCreate an Azure DevOps connector for agentic code securityUpdated

   Create an Azure DevOps connector for agentic code security Connect your Azure DevOps organization to Microsoft Defender to enable remote on-demand agentic code scans across your repositories.

   Listed under August 2026 on Microsoft Learn

1. New feature

   OT data connectors in Microsoft Security Exposure Management

   Microsoft Security Exposure Management now supports operational technology (OT) data connectors for Armis, Dragos, and Forescout. OT data connectors bring OT asset and vulnerability data from supported third-party OT platforms into the Defender portal. This helps security teams view OT…

   DocsOT data connectors in Microsoft Security Exposure ManagementUpdated

   OT data connectors in Microsoft Security Exposure Management Learn how OT data connectors enrich Microsoft Security Exposure Management with third-party operational technology asset and vulnerability data.

   Listed under July 2026 on Microsoft Learn
2. GA

   Codename MDASH - MAI-Augmented scan profile preview

   The MAI-Augmented scan profile is now available in preview as part of Codename MDASH. The MAI-Augmented profile can be used when triggering a scan through the Defender CLI. It includes MAI-Cyber-1-Flash, a new cyber-specialized model that extends the current agentic…

   DocsInstall and run Defender CLIUpdated

   Install and run Defender CLI Download and install Defender CLI, then run agentic code scans from the terminal.

   Listed under July 2026 on Microsoft Learn
3. GA

   Codename MDASH - MAI-Augmented scan profile now available for on-demand scans preview

   Expanding on the previously released Defender CLI support, the MAI-Augmented scan profile is now also available in preview for on-demand scans triggered from the Microsoft Defender portal. Security teams can select this profile when starting an on-demand scan from the…

   DocsCreate an Azure DevOps connector for agentic code securityUpdated

   Create an Azure DevOps connector for agentic code security Connect your Azure DevOps organization to Microsoft Defender to enable remote on-demand agentic code scans across your repositories.

   Listed under July 2026 on Microsoft Learn
4. Preview

   Codename MDASH - Agentic code scanner private preview

   Codename MDASH - Agentic code scanner is now available in private preview in Microsoft Security Exposure Management. Codename MDASH uses a multi-model agentic AI system to detect code vulnerabilities with greater depth and accuracy than traditional static analysis. Security teams…

   DocsCodename MDASH OverviewUpdated

   Codename MDASH Overview Learn how Codename MDASH - Agentic code scanner uses a multi-model agentic AI system to detect code vulnerabilities with depth and accuracy beyond traditional static analysis.

   Listed under July 2026 on Microsoft Learn

1. Preview

   Overview dashboard (preview)

   The updated Microsoft Security Exposure Management overview dashboard is now in preview. The dashboard consolidates signals from cloud resources and devices into a single, action-oriented view of exposure risk, organized around two core actions: Resolve Now and Monitor Exposure …

   DocsStart using Microsoft Security Exposure ManagementUpdated

   Start using Microsoft Security Exposure Management Learn how to start using the Microsoft Security Exposure Management dashboard to resolve prioritized exposure risks and monitor internet-facing assets.

   Listed under June 2026 on Microsoft Learn
2. New feature

   New predefined classifications for AI agents

   The following predefined AI agent classification rules were added to the critical assets list: Classification Description Executive-Sponsored AI Agent This rule applies to AI agents that are created or owned by senior executives in the organization. As such, these agents…

   DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

   Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

   Listed under June 2026 on Microsoft Learn
3. New feature

   New predefined classifications

   The following predefined SaaS application classification rules were added to the critical assets list. These classifications require onboarding to Microsoft Defender for Cloud Apps. Classification Description Microsoft Entra ID Core identity and access control plane for the tenant. Compromise can…

   DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

   Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

   Listed under June 2026 on Microsoft Learn
4. New feature

   New predefined classifications

   The following predefined Identity classification rules were added to the critical assets list: Classification Description Widespread Local Admin on Servers This rule applies to identities that are configured as local administrators on a high number of servers in the environment…

   DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

   Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

   Listed under June 2026 on Microsoft Learn
5. GA

   New Microsoft Secure Score recommendation

   New Microsoft Secure Score recommendation. Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface. Internet-facing devices are…

   Listed under June 2026 on Microsoft Learn
6. GA

   Enhanced exposure score in Defender Vulnerability Management

   Enhanced exposure score in Defender Vulnerability Management. The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such…

   DocsExposure score in Defender Vulnerability Management·Security recommendations

   Exposure score in Defender Vulnerability Management Learn how the Microsoft Defender Vulnerability Management exposure score measures your organization's vulnerability to cybersecurity threats and how to reduce it.

   Listed under June 2026 on Microsoft Learn

1. New feature

   New predefined classification

   The following predefined Device classification rule was added to the critical assets list: Classification Description Senior Executive User Workstation Devices in frequent use by users classified as senior executives. This rule logic relies on the predefined critical identity classifications whose…

   DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

   Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

   Listed under May 2026 on Microsoft Learn
2. Preview

   Enhanced exposure score in Defender Vulnerability Management

   Enhanced exposure score in Defender Vulnerability Management. The new exposure score model in Defender Vulnerability Management is now available in preview. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors…

   DocsExposure score in Defender Vulnerability Management·Security recommendations

   Exposure score in Defender Vulnerability Management Learn how the Microsoft Defender Vulnerability Management exposure score measures your organization's vulnerability to cybersecurity threats and how to reduce it.

   Listed under May 2026 on Microsoft Learn

1. New feature

   New predefined classifications

   The following predefined Cloud resource classification rule was added to the critical assets list: Classification Description APIs with Sensitive Data This rule applies to APIs that contain sensitive data. This often indicates that the API is used for critical production…

   DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

   Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

   Listed under April 2026 on Microsoft Learn
2. Preview

   New Microsoft Secure Score recommendation

   New Microsoft Secure Score recommendation. Microsoft Secure Score now includes the Ensure devices are updated to Secure Boot 2023 certificates and boot manager , which helps identify devices that haven't yet transitioned to the new Secure Boot 2023 certificates required…

   DocsAssess Secure Boot status with Microsoft Defender (blog)

   Listed under April 2026 on Microsoft Learn

1. New feature

   Updates to Secure Score category calculations for increased accuracy

   To improve accuracy and better protect organizational identities, some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score remains unchanged, individual identity and app scores may change.

   Listed under March 2026 on Microsoft Learn
2. New feature

   Cloud apps

   To improve accuracy and better protect organizational identities, we've made updates to the Secure Score category calculations. Some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score…

   Listed under March 2026 on Microsoft Learn
3. GA

   New Microsoft Secure Score recommendations

   New Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Block outbound network connections from Microsoft HTML Application Host (mshta.exe): Helps mitigate attacks that leverage mshta.exe (a trusted…

   Listed under March 2026 on Microsoft Learn
4. GA

   New Microsoft Secure Score recommendations

   New Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations reduce exposure to common attack techniques involving remote access and authentication relay attacks: - Block file transfer over RDP : Restricts file transfer capabilities in…

   Listed under March 2026 on Microsoft Learn

1. GA

   Vulnerable components page renamed to Software components

   Vulnerable components page renamed to Software components. To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components .

   DocsSoftware components in Microsoft Defender Vulnerability Management

   Software components in Microsoft Defender Vulnerability Management Use the Software components page in Defender Vulnerability Management to identify vulnerable software components and dependencies, review associated risks, and find remediation guidance.

   Listed under February 2026 on Microsoft Learn
2. GA

   Support for software product vulnerability data on Windows 7

   Support for software product vulnerability data on Windows 7. To provide comprehensive vulnerability management capabilities across all supported Windows versions, Microsoft Defender Vulnerability Management now gathers software product vulnerability data on Windows 7 devices.

   Listed under February 2026 on Microsoft Learn
3. GA

   Improved Device Vulnerabilities report experience

   Improved Device Vulnerabilities report experience. To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements: - The Vulnerable devices by Windows 10/11 version over time section is now removed. -…

   DocsVulnerable devices report

   Vulnerable devices report A report showing vulnerable device trends and current statistics so you can understand the breath and scope of your device exposure.

   Listed under February 2026 on Microsoft Learn

1. New feature

   New predefined classifications

   The following predefined Device classification rule was added to the critical assets list: Classification Description WSUS Server Centralized Windows update management service used to approve and distribute Microsoft software updates and security patches to Windows devices across an organization. Compromise…

   DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

   Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

   Listed under January 2026 on Microsoft Learn
2. Preview

   Cloud software inventory in vulnerability management (Preview)

   Cloud software inventory is available in preview in vulnerability management in the Microsoft Defender portal. This feature shows software in your cloud environment, application versions, assets where each software is installed, and related vulnerabilities. The software inventory helps you understand…

   DocsMicrosoft Defender Vulnerability Management integration with Exposure …Updated

   Microsoft Defender Vulnerability Management integration with Exposure Management Learn about the integration of Microsoft Defender Vulnerability Management into Microsoft Security Exposure Management.

   Listed under January 2026 on Microsoft Learn
3. Preview

   Device vulnerabilities report enhancements

   Device vulnerabilities report enhancements. To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes several changes and enhancements ( learn more ). Note : These changes are not yet visible to government cloud customers.

   DocsVulnerable devices report

   Vulnerable devices report A report showing vulnerable device trends and current statistics so you can understand the breath and scope of your device exposure.

   Listed under January 2026 on Microsoft Learn

1. GA

   New Microsoft Secure Score recommendations

   New Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Disable Remote Registry service on Windows : Prevents remote access to the Windows registry, reducing attack surface and…

   Listed under December 2025 on Microsoft Learn

No changes match.