Defender Code Security skills overview - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Product
Microsoft Security Exposure Management
Track documentation and Message Center changes for Microsoft Security Exposure Management.
Microsoft Learn documentation ↗Latest Microsoft Security Exposure Management changes
Explore with the attack surface map in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Exposure insights overview in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The document’s author metadata changed from “dlanger” to “DebLanger.”
External Attack Surface Management Initiative in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Getting value from your data connectors in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Integrate the Armis OT data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The page author metadata changed from limwainstein to DebLanger.
Integrate the Dragos OT data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The page’s author metadata changed from limwainstein/lwainstein to DebLanger/dlanger.
Integrate the Forescout OT data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The page author changed from limwainstein to DebLanger, and the Microsoft author alias changed from lwainstein to dlanger.
Integration and licensing for Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author metadata changed from “dlanger” to “DebLanger.”
Microsoft Defender Vulnerability Management integration with Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The vulnerability management integration page author changed from “dlanger” to “DebLanger.”
OT data connectors in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from limwainstein to DebLanger, and the ms.author value changed from lwainstein to dlanger.
Overview of attack surface management in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
Overview of critical asset management in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The document author changed from “dlanger” to “DebLanger.”
Overview of data connectors in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The data connectors overview now lists DebLanger instead of dlanger as the author.
Palo Alto Prisma data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The document author changed from “dlanger” to “DebLanger.”
Predefined classifications in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Prerequisites and support in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The prerequisites page author attribution changed from “dlanger” to “DebLanger.”
Query the enterprise exposure graph in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The Enterprise Exposure Graph documentation now lists DebLanger instead of dlanger as the author.
Rapid7 data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The documentation page author changed from “dlanger” to “DebLanger.”
Review and classify critical assets in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author was changed from “dlanger” to “DebLanger.”
Review Security Initiatives in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The author metadata changed from “dlanger” to “DebLanger” on the Initiatives page.
Review security metrics in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
Review security recommendations in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Schemas and operators in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
Security initiatives catalog in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The initiatives list documentation now credits DebLanger instead of dlanger as the author.
ServiceNow data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The page author changed from dlanger to DebLanger.
Start using Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The document’s author name changed from “dlanger” to “DebLanger.”
Tenable data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The document author changed from dlanger to DebLanger.
What is Microsoft Security Exposure Management? - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from dlanger to DebLanger.
What's new in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The Exposure Management What's New page now lists the author as DebLanger instead of dlanger.
Wiz data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Developer and API
The document author changed from dlanger to DebLanger.
Work with attack paths in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
Vulnerabilities and exposure
The page author changed from “dlanger” to “DebLanger.”
Create Azure Devops Connector
Developer and API
The instructions now direct administrators to Agentic code scanning management, select Add another beside Source code environment, and choose Azure DevOps to open the connector flow.
Create Github Connector
Developer and API
The guide now instructs administrators to select GitHub under Source code environment, rather than Azure DevOps, and proceed to the GitHub connector flow.
Create Github Connector
Developer and API
The instructions now direct administrators to Agentic code scanning management, select Add another under Source code environment, and choose Azure DevOps. Connector naming remains optional.
Ai Code Security Overview
Vulnerabilities and exposure
The AI code security overview now lists `aspm-data-externalapi-prd.security.aspm.microsoft.com`.
Mdash Foundry Integration
Vulnerabilities and exposure
The page clarifies that Standard deployments use each of the three models once, refers to required model deployments for the Foundry resource, and consolidates the guidance that disconnecting Foundry disables agentic code scanning unless another connection is provided.
Codename MDASH Overview
Vulnerabilities and exposure
The documentation now describes direct GitHub and Azure DevOps connectors, on-demand local or CI/CD scans through Defender CLI, and integration with AI coding environments. It also changes the status label from “private preview” to “preview” and reorganizes capability, language-support, and setup information.
Compare Secure Score Security Exposure Management
Vulnerabilities and exposure
The article comparing Secure Score with Security Exposure Management was deleted, including its comparison table and prerequisites link.
Configure your data connectors in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title and description now use the imperative wording “Configure your data connectors.”
Create an Azure DevOps connector for agentic code security
Developer and API
Documentation now describes connecting Azure DevOps organizations to Microsoft Defender for repository discovery and remote on-demand agentic code scans, with optional write access for remediation workflows.
Defender CLI setup for agentic code security
Vulnerabilities and exposure
The documentation adds a prerequisite requiring accounts to have at least one listed permission before running Defender CLI commands and updates the Defender.InteractiveLogin scope identifier.
Explore with the attack surface map in Microsoft Security Exposure Management
Vulnerabilities and exposure
Added author metadata, corrected the Attack surface navigation notation, and updated the attack path reference link.
Exposure insights overview in Microsoft Security Exposure Management
Vulnerabilities and exposure
The overview now focuses on initiative scores and metric basics, linking to separate pages for reviewing initiatives and investigating metrics. Detailed metric, unavailable-metric, versioning, and recommendation-management content was removed from this page.
External Attack Surface Management Initiative in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title, headings, terminology, prerequisites, navigation steps, and linked guidance were updated. Instructions now explicitly refer to the initiative and clarify the pre-built footprint workflow and its limitations.
Getting Started with Codename MDASH
Vulnerabilities and exposure
The onboarding requirements now support remote scanning through either GitHub or Azure DevOps, refer to a linked list of required models, and document two authentication methods for the Foundry project endpoint. Detailed RBAC requirements are now provided through linked guidance.
Install and run Defender CLI
Vulnerabilities and exposure
The guide now describes two authentication methods, tenant environment variables, asynchronous scan execution with Job IDs, and selectable AI model profiles, including a MAI-augmented preview profile. Installation instructions were also reorganized by platform.
Mdash Initiative
Vulnerabilities and exposure
The MDASH Scans documentation now explains how to cancel queued or running scans, what the confirmation dialog displays, and how to provide a cancellation reason. Consumed tokens are not refunded.
Microsoft Defender Code script for Azure DevOps connector
Developer and API
Adds documentation for the Grant-DefenderConsent.ps1 PowerShell script, including service-principal provisioning, tenant-wide admin consent, and optional token validation modes.
Microsoft Defender Vulnerability Management integration with Exposure Management
Vulnerabilities and exposure
Added author metadata, linked the licensing statement to Microsoft Defender for Endpoint licensing requirements, and replaced the Secure Score link with Microsoft Security Exposure Management.
Overview of attack surface management in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page adds author metadata and a link to the attack paths guide, keeps the attack surface map link, and removes the Microsoft Security Exposure Management Graph blog link.
Overview of critical asset management in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page now adds alert and incident-investigation context, including the crown indicator for business-critical assets, condenses the capability list, and links to related classification and protection guidance.
Overview of data connectors in Microsoft Security Exposure Management
Vulnerabilities and exposure
The documentation title and heading now use “data connectors” instead of “connecting data sources.” Author metadata was also added.
Predefined classifications in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title and description now identify it as a list of current predefined classifications. Its heading was also simplified.
Prerequisites and support in Microsoft Security Exposure Management
Vulnerabilities and exposure
The documentation now states that Defender for Cloud with CSPM and Microsoft Defender Vulnerability Management must be enabled for full dashboard value. It also specifies that the service is available only in the public cloud, not national or sovereign clouds.
Qualys data connector in Microsoft Security Exposure Management
Developer and API
The page title changed from “Integrate Qualys data connector in Microsoft Security Exposure Management” to “Qualys data connector in Microsoft Security Exposure Management.”
Query the enterprise exposure graph in Microsoft Security Exposure Management
Developer and API
The article’s metadata, introductory wording, and query instructions were updated, including capitalization of Defender portal navigation labels.
Review and classify critical assets in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page now includes author metadata and uses “Exposure insights > Initiatives” instead of an arrow separator in the navigation path.
Review Attack Paths
Vulnerabilities and exposure
The documentation page describing attack path prerequisites, dashboards, grouping, choke points, blast radius, path examination, and recommendations was deleted.
Review Security Initiatives in Microsoft Security Exposure Management
Vulnerabilities and exposure
The article now uses updated Microsoft Security Exposure Management terminology, adds prerequisite guidance and a direct link to the initiatives page, and refreshes navigation steps, headings, anchors, and descriptions of favorites and initiative trends.
Review security metrics in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title and main heading changed from “Investigate” to “Review,” and author metadata for dlanger was added.
Review security recommendations in Microsoft Security Exposure Management
Vulnerabilities and exposure
The article is now labeled as a how-to guide, adds author and AI-use metadata, simplifies its introduction, and reformats the transition tip. It continues to explain that seeing both recommendation formats or Preview-tagged recommendations is expected during the transition.
Risk evaluation framework changelog
Vulnerabilities and exposure
The changelog now lists 80+ Defender for SQL Vulnerability Assessment recommendations as generally available, with a link to the database-level recommendations experience.
Schemas and operators in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title changed to “Schemas and operators,” and author metadata was added for dlanger.
Security Events
Vulnerabilities and exposure
The `security-events.md` page was deleted, including prerequisites and steps for reviewing, filtering, and opening security events in the Microsoft Defender portal.
Security initiatives catalog in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page title, description, heading, and introductory text now use “Security initiatives catalog.” Author metadata was also added.
ServiceNow data connector in Microsoft Security Exposure Management
Developer and API
The page title was shortened, author metadata was added, and the ServiceNow navigation path changed from “System OAuth -> Application Registry” to “System OAuth > Application Registry.”
Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration
Vulnerabilities and exposure
The MDASH integration documentation now describes Keyless authentication as recommended, API-key authentication, required permissions, onboarding values, and updated steps for creating a Foundry project.
Start using Microsoft Security Exposure Management
Vulnerabilities and exposure
The article now directs users to Exposure Management > Overview and describes the Resolve Now and Monitor Exposure sections, including prioritized remediation categories and internet-exposed resource views. Prerequisites are now linked separately.
Trigger an on-demand agentic scan (private preview)
Vulnerabilities and exposure
The documentation now covers SCM connectors, including GitHub and Azure DevOps. Repositories may take up to one hour to become available after connector activation, and each scan can use the default GPT-General profile or the MAI-Augmented preview profile.
What is Microsoft Security Exposure Management?
Vulnerabilities and exposure
The documentation now states that Microsoft Security Exposure Management is available only in Public Cloud and unavailable in national or sovereign clouds, including US Gov and China Gov. It also adds descriptions of the Overview dashboard’s Resolve Now and Monitor Exposure views.
What's new in Microsoft Security Exposure Management
Vulnerabilities and exposure
The August 2026 entries cover keyless Microsoft Foundry authentication, portal scan cancellation, an Azure DevOps connector preview, MAI-Augmented scan profiles, and an updated overview dashboard preview. Attack-path links and older release-note content were also updated.
Work with attack paths in Microsoft Security Exposure Management
Vulnerabilities and exposure
The page was retitled and reorganized as a how-to guide covering attack-path generation, data sources, data availability, fluctuating results, and the separate Defender for Cloud cloud-only experience. The previous dashboard overview and screenshot were removed.
Agentic code security audit log reference (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/mdash-audit-log-events.md.
Autofix agentic code vulnerabilities (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/auto-fix-ai-vulnerabilities.md.
CI/CD example for Defender CLI (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-cli-cicd.md.
Codename MDASH - Agentic code scanner initiative (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/mdash-initiative.md.
Codename Mdash Faq
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/codename-mdash-faq.md.
Codename MDASH overview (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/ai-code-security-overview.md.
Connect Microsoft Foundry (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/mdash-foundry-integration.md.
Create a GitHub connector (private preview)
Developer and API
Updated Microsoft Defender documentation in exposure-management/create-github-connector.md.
Defender CLI setup for agentic code security (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-cli-authentication.md.
Defender Code Security skills overview (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-code-security-plugin.md.
Install and run Defender CLI (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/defender-cli.md.
Integrate Qualys data connector in Microsoft Security Exposure Management
Developer and API
Updated Microsoft Defender documentation in exposure-management/Qualys-data-connector.md.
Review agentic code scan results from the terminal (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/review-terminal-results.md.
Review agentic code scan results in the Microsoft Defender portal (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/review-portal-results.md.
Trigger an on-demand agentic scan (private preview)
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/trigger-on-demand-scan.md.
Whats New
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/whats-new.md.
Agentic code security audit log reference
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/mdash-audit-log-events.md.
Autofix agentic code vulnerabilities
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/auto-fix-ai-vulnerabilities.md.
CI/CD example for Defender CLI
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-cli-cicd.md.
Codename MDASH - Agentic code scanner initiative
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/mdash-initiative.md.
Codename MDASH - FAQ
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/codename-mdash-faq.md.
Codename MDASH Overview
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/ai-code-security-overview.md.
Configure Data Connectors
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/configure-data-connectors.md.
Create a GitHub connector for agentic code security
Developer and API
Added Microsoft Defender documentation in exposure-management/create-github-connector.md.
Defender CLI setup for agentic code security
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-cli-authentication.md.
Defender Code Security skills overview
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-code-security-plugin.md.
Getting Started with Codename MDASH
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/ai-code-security-onboarding.md.
Initiatives List
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/initiatives-list.md.
Install and run Defender CLI
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/defender-cli.md.
Microsoft Defender Code admin consent script
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/microsoft-defender-code-admin-consent-script.md.
Prerequisites
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/prerequisites.md.
Review agentic code scan results
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/understanding-mdash-results.md.
Review agentic code scan results from the terminal
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/review-terminal-results.md.
Review agentic code scan results in the Microsoft Defender portal
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/review-portal-results.md.
Review Attack Paths
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/review-attack-paths.md.
Run agentic code scans
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/run-ai-code-security-scans.md.
Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/mdash-foundry-integration.md.
Trigger an on-demand agentic scan
Vulnerabilities and exposure
Added Microsoft Defender documentation in exposure-management/trigger-on-demand-scan.md.
Whats New
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/whats-new.md.
Work Attack Paths Overview
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/work-attack-paths-overview.md.
Configuring the data connectors in Microsoft Security Exposure Management
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/configure-data-connectors.md.
Connecting data sources in Microsoft Security Exposure Management
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/overview-data-connectors.md.
Critical Asset Management
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/critical-asset-management.md.
Criticality Levels for Classifications
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/predefined-classification-rules-and-levels.md.
External Attack Surface Management Initiative
Vulnerabilities and exposure
Updated Microsoft Defender documentation in exposure-management/external-attack-surface-management-initiative.md.
Integrate the Armis OT data connector in Microsoft Security Exposure Management
Developer and API
Added Microsoft Defender documentation in exposure-management/armis-data-connector.md.
Integrate the Dragos OT data connector in Microsoft Security Exposure Management
Developer and API
Added Microsoft Defender documentation in exposure-management/dragos-data-connector.md.