Before you begin
- A role that can open Threat Protection: Admin, Operator, Security Admin, Auditor, or Read Only
- A role with the security posture view permission to open a category's device list
- Microsoft Defender for Endpoint connected for your tenant
Where to find it
Open Threat Protection in the sidebar's Security section. It opens on the Posture tab; Vulnerabilities (exposure, patch compliance, and missing patches) and CVE Catalog sit beside it, and Alerts is its own sidebar entry.
What the Posture tab shows
- Four headline tiles: Total Machines, Active Devices, Not Reporting, and Duplicate Devices (hosts enrolled in Defender more than once).
- Protection Coverage: protected versus unprotected devices and the coverage percentage, the share of enrolled devices actively reporting to Defender.
- Risk Snapshot: Devices Only: how many devices Defender rates High, Medium, and Low, based on each device's exposure level.
- Devices: a searchable table of every device with its host pool, risk level, Defender status, last seen time, OS, and location, filterable and exportable.
Administrators see Refresh Inventory and Install Defender in the page header. Install Defender opens the list of unprotected devices so you can remediate them. The More actions menu also links to security alerts and to duplicate devices to offboard.
Drilling into a category
Click any tile, coverage line, or risk tile to open that category's device list: all, active, not reporting, duplicates, protected, unprotected, or high, medium, or low risk. The list is searchable, sortable by machine, OS, risk score, or last seen, and can be narrowed to devices seen in the last 7, 30, 90, or 180 days, or all time. Each row links to the device's page. Without the security posture view permission, the list shows an access-denied message instead.
A device counts as protected and active only while Defender reports its health as active; any other health state counts as not reporting.
How the data stays current
Posture data comes from Microsoft Defender for Endpoint for the tenant you have selected, covering devices seen in the last 30 days. The page updates in real time as the inventory changes. If Defender for Endpoint is not configured for the tenant, the tab tells you so (and how to fix it) rather than showing an empty fleet.
Roles and access
Viewing posture is read-only. Refreshing the inventory and installing Defender are for administrators, and excluding a device from vulnerability views needs Admin or Security Admin. See Role-Based Access Control for how to grant roles.