In many of the tenants I review, risk assessment is split between endpoint security, identity and cloud, and nobody has the whole picture. Security Exposure Management in the Microsoft Defender portal closes that gap, and as of Ignite November 2024 it is generally available. I've been using it since the public preview in March. It gives you one place to look at exposures, whether they come from devices, privileged accounts or shadow IT in the cloud. That makes it much easier to concentrate on your most critical assets and the attack paths that lead to them.

Security Exposure Management pulls risk data into one module

For eligible tenants, Security Exposure Management shows up as its own module in the Defender portal. It combines risk data from endpoints, Entra ID, Defender for Identity and cloud workloads. The main idea is that you classify and visualize your critical assets, such as domain controllers, Entra Connect servers and Global Administrators, along with high-value applications and identities. Microsoft's documentation is a good place to start. The result is a single view of your exposure that shows misconfigurations, excessive privileges, patch gaps and risky dependencies you would probably miss if you only looked at each area separately.

Licensing sits on top of the Microsoft Defender and security workload entitlements you already have, so whether you see the module and how much of it you get depends on what your tenant is licensed for. If you have Defender for Endpoint, Defender for Identity or Microsoft Defender XDR, the new module will most likely appear in your portal navigation. Detailed attack path analysis usually also requires Defender for Identity and Entra ID P2.

Critical asset management starts with honest classification

Everything else builds on defining and classifying your critical assets. In practice, most organizations only have a vague idea of which servers, accounts and applications they really can't do without. Security Exposure Management pushes you to write that down. In the Critical Asset Management section, you tag hosts, users, groups and apps as critical or sensitive. Microsoft's asset management guide helps you decide what belongs on the list. Domain controllers and privileged accounts are obvious, but service accounts, break-glass admin accounts and core cloud apps are easy to forget. This step matters because Security Exposure Management can only map attack paths and find the real choke points in your environment once the classification is in place.

Practical tip: Start by tagging only your top-tier assets. An incomplete list is still better than none, and you'll get more relevant attack path results straight away. You can adjust the classifications later as the exposure map fills in.

Attack paths and choke points give each finding its context

For me, attack path analysis is the strongest part of the product. It shows how an attacker could get from a compromised user account, through a server where that account has local admin rights, to a domain controller or a cloud admin role. Microsoft has a useful conceptual overview. I've found that looking at attacks as paths instead of isolated threats makes things clearer and keeps you from spending time on low-risk issues. The platform also points out choke points, meaning assets or permissions where one fix can break several attack paths at once.

Here is a simple flowchart of a path I run into a lot. A compromised user account reaches a server with overly broad admin privileges, moves on to a domain controller and ends at a global admin account.

flowchart TD
  user["User account"] --> server["Server (local admin)"]
  server --> dc["Domain controller"]
  dc --> ga["Global admin"]

Figure: Sample attack path from a standard user account to privileged assets.

Seeing it drawn out like this makes weak links much easier to find and remediation easier to prioritize, particularly in large hybrid environments.

Advanced hunting lets you query the exposure graph directly

Another feature I use a lot is that you can query the exposure graph directly in Defender's "Advanced Hunting". You need at least Security Reader privileges on Defender for Endpoint and the right data connectors enabled. The two tables that matter are ExposureGraphNodes and ExposureGraphEdges. With them you can pull out dependencies, recurring choke points or the critical assets with the most exposure. This simple KQL query, for example, lists all nodes classified as critical assets:

ExposureGraphNodes 
| where NodeCriticalAsset == true

You can run it under Defender portal → Hunting → Advanced Hunting, with Defender for Endpoint Plan 2. Building on that, you can create custom dashboards and even set up proactive alerting as you link up data from across your environment.

I think prioritizing what matters beats tool overload

If your security program has so far depended on scattered alerts or separate dashboards, Security Exposure Management is a clear improvement. Tag your key assets first, then go through the top attack paths it shows for your tenant. Compare the results with your current Conditional Access policies and other controls. I've written up some practical starter policies in /blog/conditional-access-entra-id-getting-started.

The hard part, in my experience, isn't learning the tool. It's being honest about what is actually critical in your environment. Once that's settled, Security Exposure Management helps you put money and effort where they count, whether that means Zero Trust, Copilot security or better incident response. Getting the priorities right gets you a long way, and this platform makes that noticeably easier.