Daily Defender News
Aboutmerill.net
Microsoft Security Exposure Management
Vulnerabilities and exposure

Overview of critical asset management in Microsoft Security Exposure Management

4 September 2026Doc update+10 / −10 lines

In brief

The page now adds alert and incident-investigation context, including the crown indicator for business-critical assets, condenses the capability list, and links to related classification and protection guidance.

What Defender admins need to know

Administrators have clearer navigation for reviewing, classifying, and protecting critical assets; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • Microsoft Defender automatically detects and categorizes critical assets, streamlining identification and enabling immediate protection.
  • Your security team can prioritize security investigations, posture recommendations, and remediation steps to focus on critical assets and systems first.

Predefined classifications

Security Exposure Management provides an out-of-the-box catalog of predefined critical asset classifications for assets that include devices, identities, and cloud resources across the unified inventory. Predefined classifications include:

Working with asset classifications

You can work with criticalcreate custom asset settings as follows:

  • Create custom classifications: You can create new critical asset classifications for devices, identities, and cloud resources from any domain (Azure, AWS, GCP, or on-premises), tailored to your organization.
    • You use the query builder to define a new classification. For example, you might build a query to define devices with a specific naming convention as critical, or cloud resources with specific tags as critical.
    • Creating critical asset classification queries is also useful for limited cases where not all assets of interest are identified across the unified inventory.
  • Add assets to classifications: You can manuallyclassifications, add assets from any domain to critical asset classifications in the unified asset management experience.
  • Modifymanually, modify criticality levels: You can choose tolevels, and edit criticality levels according to your organization's risk profile across all asset types.
  • Edit custom classifications: You can edit, delete, andor turn off custom classifications. Predefined classifications can't be modified. The "turn off" rule functionality is available for predefined queries. However, it might not be visible to some users due to specific issues.
  • Third-party connector data integration: Assets discovered via third-party connectors (such as ServiceNow CMDB) can be automatically tagged as critical if they meet certain criteria, enhancingalso trigger automatic critical asset identification across the unified inventory.
tagging. For step-by-step instructions, see Review and classify critical assets.

Reviewing critical assets

Next steps