Defender Code Security skills overview - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Cross-product topic
Vulnerabilities and exposure
A cross-product view of Microsoft Defender changes related to Vulnerabilities and exposure.
Latest Vulnerabilities and exposure changes
Explore with the attack surface map in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Exposure insights overview in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The document’s author metadata changed from “dlanger” to “DebLanger.”
External Attack Surface Management Initiative in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Getting value from your data connectors in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Integration and licensing for Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author metadata changed from “dlanger” to “DebLanger.”
Microsoft Defender Vulnerability Management integration with Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The vulnerability management integration page author changed from “dlanger” to “DebLanger.”
OT data connectors in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from limwainstein to DebLanger, and the ms.author value changed from lwainstein to dlanger.
Overview of attack surface management in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
Overview of critical asset management in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The document author changed from “dlanger” to “DebLanger.”
Overview of data connectors in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The data connectors overview now lists DebLanger instead of dlanger as the author.
Predefined classifications in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Prerequisites and support in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The prerequisites page author attribution changed from “dlanger” to “DebLanger.”
Review and classify critical assets in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author was changed from “dlanger” to “DebLanger.”
Review Security Initiatives in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The author metadata changed from “dlanger” to “DebLanger” on the Initiatives page.
Review security metrics in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
Review security recommendations in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Schemas and operators in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
Security initiatives catalog in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The initiatives list documentation now credits DebLanger instead of dlanger as the author.
Start using Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The document’s author name changed from “dlanger” to “DebLanger.”
What is Microsoft Security Exposure Management? - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
What's new in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The Exposure Management What's New page now lists the author as DebLanger instead of dlanger.
Work with attack paths in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Microsoft Defender Vulnerability Management: Private preview for selected developer package vulnerability coverage
Vulnerabilities and exposure
Microsoft Defender Vulnerability Management is privately previewing expanded vulnerability coverage for selected Node.js, Python, and Java packages on Windows devices. It integrates with existing workflows, APIs, and exports, with rollout planned from September to December 2026. Organizations should prepare for increased data volume and validate integrations before enabling.
Attack Surface Reduction in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn
Vulnerabilities and exposure
The page title and heading now capitalize “Attack Surface Reduction.” The text also uses “cyberattack” and revises punctuation around configuration method examples.
Ai Code Security Overview
Vulnerabilities and exposure
The AI code security overview now lists `aspm-data-externalapi-prd.security.aspm.microsoft.com`.
Mdash Foundry Integration
Vulnerabilities and exposure
The page clarifies that Standard deployments use each of the three models once, refers to required model deployments for the Foundry resource, and consolidates the guidance that disconnecting Foundry disables agentic code scanning unless another connection is provided.
Activate Defender Rbac
Vulnerabilities and exposure
The documentation now provides direct navigation and toggle-based steps for deactivating workloads, including confirmation and the resulting **Not Active** status.
Attack Surface Reduction Overview
Vulnerabilities and exposure
The Attack Surface Reduction overview now uses revised links for Microsoft Defender Application Guard, WDAC, and Windows Firewall documentation.
Attack Surface Reduction Rules Configure
Vulnerabilities and exposure
The page now details precedence among local settings, Group Policy, MDM, and Configuration Manager, including the MDMWinsOverGP setting and OMA-URI. It also updates Intune navigation and explains per-rule exclusions.
Attack Surface Reduction Rules Overview
Vulnerabilities and exposure
Starting with platform version 4.18.26060, using the Unblock option to override an ASR rule in Warn mode requires administrator approval. Per-ASR rule exclusions should be used for persistent exceptions.
Attack Surface Reduction Rules Reference
Vulnerabilities and exposure
Three ASR rule entries now use relative links to the cloud-delivered protection documentation.
Cloud overview dashboard in Microsoft Defender for Cloud
Vulnerabilities and exposure
The article adds navigation anchors, renames section headings, clarifies dashboard section and graph descriptions, and adds links to related cloud security resources and Azure portal guidance.
Codename MDASH Overview
Vulnerabilities and exposure
The documentation now describes direct GitHub and Azure DevOps connectors, on-demand local or CI/CD scans through Defender CLI, and integration with AI coding environments. It also changes the status label from “private preview” to “preview” and reorganizes capability, language-support, and setup information.
Compare Secure Score Security Exposure Management
Vulnerabilities and exposure
The article comparing Secure Score with Security Exposure Management was deleted, including its comparison table and prerequisites link.
Configure Defender EASM data connections for Log Analytics and Azure Data Explorer
Vulnerabilities and exposure
The page now better explains asset data and attack surface insights, refreshes configuration guidance and screenshots, and explicitly calls out assigning required roles to the EASM API service principal for Log Analytics.
Configure your data connectors in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title and description now use the imperative wording “Configure your data connectors.”
Defender CLI setup for agentic code security
Vulnerabilities and exposure
The documentation adds a prerequisite requiring accounts to have at least one listed permission before running Defender CLI commands and updates the Defender.InteractiveLogin scope identifier.
Defender Endpoint Demonstration Attack Surface Reduction Rules
Vulnerabilities and exposure
The documentation now warns that the setup script excludes `c:\demo` from Microsoft Defender Antivirus scanning. Administrators must copy ASR test files to a folder not excluded by Defender Antivirus or ASR rules before opening or running them, then delete the copies afterward.
Explore with the attack surface map in Microsoft Security Exposure Management
Vulnerabilities and exposure
Added author metadata, corrected the Attack surface navigation notation, and updated the attack path reference link.
Exposure insights overview in Microsoft Security Exposure Management
Vulnerabilities and exposure
The overview now focuses on initiative scores and metric basics, linking to separate pages for reviewing initiatives and investigating metrics. Detailed metric, unavailable-metric, versioning, and recommendation-management content was removed from this page.
External Attack Surface Management Initiative in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title, headings, terminology, prerequisites, navigation steps, and linked guidance were updated. Instructions now explicitly refer to the initiative and clarify the pre-built footprint workflow and its limitations.
Getting Started with Codename MDASH
Vulnerabilities and exposure
The onboarding requirements now support remote scanning through either GitHub or Azure DevOps, refer to a linked list of required models, and document two authentication methods for the Foundry project endpoint. Detailed RBAC requirements are now provided through linked guidance.
Install and run Defender CLI
Vulnerabilities and exposure
The guide now describes two authentication methods, tenant environment variables, asynchronous scan execution with Job IDs, and selectable AI model profiles, including a MAI-augmented preview profile. Installation instructions were also reorganized by platform.
Investigate OAuth application attack paths in Defender for Cloud Apps
Vulnerabilities and exposure
The Attack Paths documentation now warns that disabling an OAuth application can disrupt services and remove access for dependent users and services. It also updates headings, terminology, and page metadata.
Mdash Initiative
Vulnerabilities and exposure
The MDASH Scans documentation now explains how to cancel queued or running scans, what the confirmation dialog displays, and how to provide a cancellation reason. Consumed tokens are not refunded.
Microsoft Defender EASM page asset filters
Vulnerabilities and exposure
The article was retitled and rebranded for Microsoft Defender EASM, its heading and introductory text were revised, and it now describes defined-value and freeform filters for page-asset searches, including IP version and domain status.
Microsoft Defender Vulnerability Management integration with Exposure Management
Vulnerabilities and exposure
Added author metadata, linked the licensing statement to Microsoft Defender for Endpoint licensing requirements, and replaced the Secure Score link with Microsoft Security Exposure Management.
Mitigate the Log4Shell vulnerability with Microsoft Defender Vulnerability Management
Vulnerabilities and exposure
The article title and date were updated, Log4j file-detection details were clarified, JNDI mitigation terminology was expanded, and descriptions for advanced hunting queries were added or refined.
Overview of attack surface management in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page adds author metadata and a link to the attack paths guide, keeps the attack surface map link, and removes the Microsoft Security Exposure Management Graph blog link.
Overview of critical asset management in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page now adds alert and incident-investigation context, including the crown indicator for business-critical assets, condenses the capability list, and links to related classification and protection guidance.
Overview of data connectors in Microsoft Security Exposure Management
Vulnerabilities and exposure
The documentation title and heading now use “data connectors” instead of “connecting data sources.” Author metadata was also added.
Predefined classifications in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title and description now identify it as a list of current predefined classifications. Its heading was also simplified.
Prerequisites and support in Microsoft Security Exposure Management
Vulnerabilities and exposure
The documentation now states that Defender for Cloud with CSPM and Microsoft Defender Vulnerability Management must be enabled for full dashboard value. It also specifies that the service is available only in the public cloud, not national or sovereign clouds.
Protect your ServiceNow environment | Microsoft Defender for Cloud Apps
Vulnerabilities and exposure
The page adds optional instructions for creating a non-admin ServiceNow user with custom read ACLs and a shared role. It also clarifies 90-day token rotation and adds an Australia-specific Scope Restriction instruction.
Review and classify critical assets in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page now includes author metadata and uses “Exposure insights > Initiatives” instead of an arrow separator in the navigation path.
Review Attack Paths
Vulnerabilities and exposure
The documentation page describing attack path prerequisites, dashboards, grouping, choke points, blast radius, path examination, and recommendations was deleted.
Review Security Initiatives in Microsoft Security Exposure Management
Vulnerabilities and exposure
The article now uses updated Microsoft Security Exposure Management terminology, adds prerequisite guidance and a direct link to the initiatives page, and refreshes navigation steps, headings, anchors, and descriptions of favorites and initiative trends.
Review security metrics in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title and main heading changed from “Investigate” to “Review,” and author metadata for dlanger was added.
Review security recommendations in Microsoft Security Exposure Management
Vulnerabilities and exposure
The article is now labeled as a how-to guide, adds author and AI-use metadata, simplifies its introduction, and reformats the transition tip. It continues to explain that seeing both recommendation formats or Preview-tagged recommendations is expected during the transition.
Risk evaluation framework changelog
Vulnerabilities and exposure
The changelog now lists 80+ Defender for SQL Vulnerability Assessment recommendations as generally available, with a link to the database-level recommendations experience.
SaaS Security Posture Management (SSPM) in Microsoft Defender for Cloud Apps
Vulnerabilities and exposure
The page description now explains SSPM assessment of SaaS configurations, recommendations in Microsoft Security Exposure Management, and OAuth application risk visibility. Screenshot wording and publication metadata were also updated.
Schemas and operators in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title changed to “Schemas and operators,” and author metadata was added for dlanger.
Security Copilot In Microsoft 365 Defender
Vulnerabilities and exposure
The Defender XDR documentation now uses updated relative links for Security Copilot threat intelligence guidance and the “Use threat intelligence” page.
Security Events
Vulnerabilities and exposure
The `security-events.md` page was deleted, including prerequisites and steps for reviewing, filtering, and opening security events in the Microsoft Defender portal.
Security initiatives catalog in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title, description, heading, and introductory text now use “Security initiatives catalog.” Author metadata was also added.
Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration
Vulnerabilities and exposure
The MDASH integration documentation now describes Keyless authentication as recommended, API-key authentication, required permissions, onboarding values, and updated steps for creating a Foundry project.
Start using Microsoft Security Exposure Management
Vulnerabilities and exposure
The article now directs users to Exposure Management > Overview and describes the Resolve Now and Monitor Exposure sections, including prioritized remediation categories and internet-exposed resource views. Prerequisites are now linked separately.
Trigger an on-demand agentic scan (private preview)
Vulnerabilities and exposure
The documentation now covers SCM connectors, including GitHub and Azure DevOps. Repositories may take up to one hour to become available after connector activation, and each scan can use the default GPT-General profile or the MAI-Augmented preview profile.
Understand asset details in Microsoft Defender EASM
Vulnerabilities and exposure
The article title, headings, terminology, explanatory wording, and screenshot markup were updated. Terms such as “Signature algorithm Object Identifier” and “Autonomous System Numbers” are now expanded.
Understand dashboards in Microsoft Defender EASM
Vulnerabilities and exposure
The page was retitled and revised to describe eight dashboards, including inventory, attack surface, security posture, compliance, and risk insights. Several explanations and terms were also clarified.
Understand just-in-time virtual machine access
Vulnerabilities and exposure
The article now uses clearer Azure and AWS headings, anchors, and tab identifiers; clarifies approved access requests and expiration behavior; and adds decision-flow diagram references and a next-steps link.
What is Microsoft Security Exposure Management?
Vulnerabilities and exposure
The documentation now states that Microsoft Security Exposure Management is available only in Public Cloud and unavailable in national or sovereign clouds, including US Gov and China Gov. It also adds descriptions of the Overview dashboard’s Resolve Now and Monitor Exposure views.
What's new in Microsoft Security Exposure Management
Vulnerabilities and exposure
The August 2026 entries cover keyless Microsoft Foundry authentication, portal scan cancellation, an Azure DevOps connector preview, MAI-Augmented scan profiles, and an updated overview dashboard preview. Attack-path links and older release-note content were also updated.
Work with attack paths in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page was retitled and reorganized as a how-to guide covering attack-path generation, data sources, data availability, fluctuating results, and the separate Defender for Cloud cloud-only experience. The previous dashboard overview and screenshot were removed.
Attack Surface Reduction Rules Configure
Vulnerabilities and exposure
The command example changes one Attack Surface Reduction rule ID from ending in `...e5` to `...e5b`.
Agentic code security audit log reference (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/mdash-audit-log-events.md.
Attack Surface Reduction Rules Configure
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-configure.md.
Attack Surface Reduction Rules Overview
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-overview.md.
Attack Surface Reduction Rules Reference
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-reference.md.
Autofix agentic code vulnerabilities (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/auto-fix-ai-vulnerabilities.md.
CI/CD example for Defender CLI (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-cli-cicd.md.
Codename MDASH - Agentic code scanner initiative (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/mdash-initiative.md.
Codename Mdash Faq
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/codename-mdash-faq.md.
Codename MDASH overview (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/ai-code-security-overview.md.
Connect Microsoft Foundry (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/mdash-foundry-integration.md.
Defender CLI setup for agentic code security (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-cli-authentication.md.
Defender Code Security skills overview (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-code-security-plugin.md.
Defender Endpoint Demonstration Attack Surface Reduction Rules
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md.
Install and run Defender CLI (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-cli.md.
Microsoft 365 Security Center Mde
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-xdr/microsoft-365-security-center-mde.md.
Reduce the Attack Surface for Microsoft Teams
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-office-365/step-by-step-guides/reducing-attack-surface-in-microsoft-teams.md.
Review agentic code scan results from the terminal (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/review-terminal-results.md.
Review agentic code scan results in the Microsoft Defender portal (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/review-portal-results.md.
Trigger an on-demand agentic scan (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/trigger-on-demand-scan.md.
Whats New
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/whats-new.md.
Agentic code security audit log reference
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/mdash-audit-log-events.md.
Attack Surface Reduction Rules Configure
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-configure.md.
Attack Surface Reduction Rules Deployment Implement
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-deployment-implement.md.
Attack Surface Reduction Rules Deployment Test
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-deployment-test.md.
Attack Surface Reduction Rules Report
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-report.md.
Attack Surface Reduction Windows Events
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-windows-events.md.
Autofix agentic code vulnerabilities
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/auto-fix-ai-vulnerabilities.md.
CI/CD example for Defender CLI
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-cli-cicd.md.
Codename MDASH - Agentic code scanner initiative
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/mdash-initiative.md.
Codename MDASH - FAQ
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/codename-mdash-faq.md.
Codename MDASH Overview
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/ai-code-security-overview.md.
Configure Data Connectors
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/configure-data-connectors.md.
Defender CLI setup for agentic code security
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-cli-authentication.md.
Defender Code Security skills overview
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-code-security-plugin.md.
Getting Started with Codename MDASH
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/ai-code-security-onboarding.md.
Initiatives List
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/initiatives-list.md.
Install and run Defender CLI
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-cli.md.
Microsoft Defender Code admin consent script
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/microsoft-defender-code-admin-consent-script.md.
Monitor attack surface reduction (ASR) rule activity
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-endpoint/attack-surface-reduction-rules-monitor.md.
Prerequisites
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/prerequisites.md.
Reduce the attack surface for Microsoft Teams
Vulnerabilities and exposure
Updated Microsoft Defender documentation in defender-office-365/step-by-step-guides/reducing-attack-surface-in-microsoft-teams.md.
Review agentic code scan results
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/understanding-mdash-results.md.
Review agentic code scan results from the terminal
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/review-terminal-results.md.
Review agentic code scan results in the Microsoft Defender portal
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/review-portal-results.md.