How to find high-risk devices in Microsoft Defender

Before you start

Use an account that can view alerts in the Microsoft Defender portal, such as Security Reader. Microsoft says that once Defender for Endpoint's own role-based access is turned on, read-only accounts also need a Defender for Endpoint role. The PowerShell example requests SecurityAlert.Read.All; your organisation may require administrator consent.

The devices come from alerts that aren't resolved, so a device with no open alert isn't listed. Each alert gives the device's risk score as Defender for Endpoint rated it. The examples read and export and change nothing.

Option 1

Find high-risk devices with PowerShell

Install the module once, then connect, read the open Defender for Endpoint alerts page by page and export the devices they name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'SecurityAlert.Read.All' -NoWelcome
try {
    $filter = "status ne 'resolved' and serviceSource eq 'microsoftDefenderForEndpoint'"
    $uri = 'https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=' +
        [uri]::EscapeDataString($filter)
    $devices = @{}
    while ($uri) {
        $page = Invoke-MgGraphRequest -Method GET -Uri $uri
        foreach ($alert in $page.value) {
            $evidence = @($alert.evidence | Where-Object {
                $_.'@odata.type' -eq '#microsoft.graph.security.deviceEvidence' })
            foreach ($device in $evidence) {
                $id = $device.mdeDeviceId
                if (-not $id) { continue }
                if (-not $devices.ContainsKey($id)) {
                    $devices[$id] = [pscustomobject]@{
                        Device = $device.deviceDnsName
                        RiskScore = $device.riskScore
                        OpenAlerts = 0
                        HighSeverityAlerts = 0
                    }
                }
                $devices[$id].OpenAlerts++
                if ($alert.severity -eq 'high') { $devices[$id].HighSeverityAlerts++ }
            }
        }
        $uri = $page.'@odata.nextLink'
    }
    $report = @($devices.Values |
        Where-Object { $_.RiskScore -eq 'high' -or $_.HighSeverityAlerts -gt 0 } |
        Sort-Object HighSeverityAlerts, OpenAlerts -Descending)
    if ($report.Count -eq 0) {
        Write-Output 'No device has a high risk score or an open high-severity alert.'
    } else {
        $report | Export-Csv -Path './high-risk-devices.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) high-risk devices written to high-risk-devices.csv."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each device, those with the most high-severity alerts first, with its name, its risk score and its number of open alerts. The filter runs in Microsoft Graph, so only open Defender for Endpoint alerts come back. To list every device with an open alert, whatever its risk, remove the Where-Object line before Sort-Object.

Option 2

Find high-risk devices in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Assets > Devices. The High risk count at the top shows how many devices have a High risk level.
3. Filter on Risk level and choose High, or sort by the Risk level column.
4. Select a device to read its active alerts. Leave its response actions alone, such as isolating the device.

This suits an investigation in progress, with Microsoft's own risk level and each device's alerts a click away. For a list to keep and compare from one month to the next, use PowerShell or Altivane.

Common questions

What's the difference between risk level and exposure level?

Risk level comes from a device's active alerts and unresolved alert history, so it points to threats already detected. Exposure level comes from its unresolved security recommendations, such as unpatched software and insecure settings. To work through those, see how to list security recommendations in Microsoft Defender.

How do I bring a device's risk level down?

Investigate its active alerts on the device page and act on them. Microsoft bases the level on the device's active alerts, their severity and its unresolved alert history.

Why does a device show no data for exposure?

Microsoft says Defender for Endpoint can't work out an exposure level when a device hasn't reported for over 30 days, runs an unsupported operating system or has an out-of-date agent. Check that the device is on and onboarded.