Daily Defender News
Aboutmerill.net
Microsoft Defender EASM
General

Using And Managing Discovery

4 September 2026Doc update+13 / −10 lines

In brief

The article now includes an introductory explanation, clearer terminology for seed assets, updated section labeling and navigation, and more descriptive screenshot captions. Metadata was also updated.

What Defender admins need to know

Administrators can use clearer guidance when configuring discoveries and reviewing run history; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Discovered assets are indexed in your inventory to provide a dynamic system of record of web applications, third-party dependencies, and web infrastructure under your organization's management through a single pane of glass.

This article explains how to access your automated attack surface, configure and run custom discoveries, and review discovery results.

Before you run a custom discovery, see What is discovery? to understand the key concepts discussed here.

Access your automated attack surface

Customize discovery

Custom discoveries are ideal if your organization requires deeper visibility into infrastructure that might not be immediately linked to your primary seed assets. Seed assets (or discovery seeds) are known domains, hosts, IP ranges, or other identifiers that Defender EASM uses as starting points for discovery. By submitting a larger list of known assets to operate as discovery seeds, the discovery engine returns a wider pool of assets. Custom discovery can also help your organization find disparate infrastructure that might relate to independent business units and acquired companies.

Discovery groups

  1. The Discovery page shows your list of discovery groups by default. This list is empty when you first access the platform. To run your first discovery, select Add Discovery Group.

    Screenshot of the Discovery page with Add Discovery Group highlighted to start a new discovery group.

  2. Name your new discovery group and add a description. The Recurring Frequency field allows you to schedule discovery runs for this group by scanning for new assets related to the designated seeds on a continuous basis. The default recurrence selection is Weekly. We recommend the Weekly cadence to ensure that your organization's assets are routinely monitored and updated.

  3. Review your group information and seed list and select Create & Run.

    Screenshot of the Review + Create page showing the discovery group settings and selected seeds before creation.

    You're taken back to the main Discovery page that displays your discovery groups. After your discovery run is finished, you see new assets added to your approved inventory.

You can manage your discovery groups from the main Discovery page. The default view displays a list of all your discovery groups and some key data about each one. From the list view, you can see the number of seeds, recurrence schedule, last run date, and created date for each group.

Screenshot of the Discovery groups list showing each group's seeds, recurrence schedule, last run date, and created date.

Select any discovery group to view more information, edit the group, or start a new discovery run.

RunView run history

The discovery group details page contains the run history for the group. ThisThe run history section displays key information about each discovery run that was performed on the specific group of seeds. The Status column indicates whether the run is In Progress, Complete, or Failed. ThisThe run history section also includes started and completed timestamps and a count of all new assets added to your inventory after that particular discovery run. This count includes all assets brought into inventory, regardless of state or billable status.

Run history is organized by the seed assets that were scanned during the discovery run. To see a list of the applicable seeds, select Details. A pane opens on the right of your screen that lists all the seeds and exclusions by kind and name.

Screenshot of a discovery group's run history showing run status, start and completion times, and new asset counts.

View seeds and exclusions

When you input seeds, remember to validate the appropriate format for each entry. When you save the discovery group, the platform runs a series of validation checks and alerts you of any misconfigured seeds. For example, IP blocks should be input by network address (for example, the start of the IP range).

Screenshot of the Seeds view listing seed values with columns for Type, Source Name, and Discovery Groups.

View discovery exclusions