How to list security recommendations in Microsoft Defender

Before you start

Use an account that can run advanced hunting in the Microsoft Defender portal. The PowerShell example requests ThreatHunting.Read.All, the permission the hunting API needs; your organisation may require administrator consent. The tables are filled by Defender for Endpoint, so only onboarded devices appear, and Microsoft says advanced hunting isn't part of Defender for Business.

Microsoft says a configuration change can take 4 to 24 hours to show, and a software change about 2 hours. The examples read and export and change nothing.

Option 1

List security recommendations with PowerShell

Install the module once, then connect, run the query through Microsoft Graph and export the rows.

# Install once, if the module is not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'ThreatHunting.Read.All' -NoWelcome
try {
    # Each failed, applicable configuration, with its name and risk from the knowledge base
    $query = 'DeviceTvmSecureConfigurationAssessment' +
        ' | where IsApplicable == 1 and IsCompliant == 0' +
        ' | summarize ExposedDevices = dcount(DeviceId)' +
        ' by ConfigurationId, ConfigurationCategory' +
        ' | join kind=leftouter (DeviceTvmSecureConfigurationAssessmentKB' +
        ' | project ConfigurationId, ConfigurationName,' +
        ' RiskDescription, ConfigurationImpact)' +
        ' on ConfigurationId' +
        ' | order by ConfigurationImpact desc, ExposedDevices desc'
    $columns = 'ConfigurationName', 'ConfigurationCategory', 'ConfigurationImpact',
        'ExposedDevices', 'RiskDescription', 'ConfigurationId'
    $body = @{ Query = $query } | ConvertTo-Json
    $uri = 'https://graph.microsoft.com/v1.0/security/runHuntingQuery'
    $request = @{ Method = 'POST'; Uri = $uri; Body = $body; ContentType = 'application/json' }
    $response = Invoke-MgGraphRequest @request
    $rows = @($response.results | ForEach-Object { [pscustomobject]$_ } |
        Select-Object $columns)
    if ($rows.Count -eq 0) {
        Write-Output 'Advanced hunting returned no failed security configurations.'
    } else {
        $file = './security-recommendations.csv'
        $rows | Export-Csv -Path $file -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) configuration recommendations written."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each configuration that at least 1 device fails, the highest impact first, then the most devices exposed. ConfigurationImpact is Microsoft's rating of its effect on the configuration score, from 1 to 10. To narrow it to an area, add a line after the first, such as ' | where ConfigurationSubcategory == "Antivirus"' +, with the value in double quotes because the query is in single quotes. For the software update recommendations, query the vulnerable software instead.

Option 2

Review recommendations in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Endpoints > Vulnerability management > Recommendations. In the newer layout it's Exposure management > Recommendations.
3. Read each recommendation's exposed devices, impact, remediation type and status, and add the Category filter to narrow the list.
4. Select a recommendation for its details. Leave Remediation options and Exception options alone: they create a remediation request in Intune or an exception.

This suits working through the recommendations in Microsoft's order, with the effect each would have on your exposure score. For a list to keep and compare from one month to the next, use PowerShell or Altivane.

Common questions

Why is a recommendation I fixed still listed?

Microsoft says configuration changes can take 4 to 24 hours to show, and software changes typically 2 hours. Check again the next day before you follow it up with the device's owner.

Why is a recommendation marked as an exception?

Someone created an exception for it. Microsoft says a recommendation with an exception is no longer active, and its state changes to Full exception or Partial exception for some device groups.

Why is a vulnerable program missing from the recommendations?

Microsoft leaves out software that has no security update available, so a CVE tagged No security update has no recommendation. It still shows in the list of vulnerabilities your devices are exposed to; see how to list vulnerable software in Microsoft Defender.