Microsoft has given security teams a new reason to visit the Defender portal: a prioritized to-do list for their most dangerous exposures. On July 30, the company rolled out a public preview of the Exposure Resolution dashboard inside Microsoft Security Exposure Management, condensing signals from device, cloud, and identity security into two clear buckets: things you need to fix right now, and things you need to watch.
What's Actually New in the Dashboard
The new dashboard replaces the old scatter of vulnerability, endpoint, and cloud posture reports with a unified view. It's not pulling in data that wasn't already in the system—it's changing how that data is presented and, crucially, what it asks you to do first.
The star of the show is the Resolve Now queue. This isn't a raw list of CVEs. Microsoft applies its own risk-scoring algorithms to surface exposures that combine three factors: the severity of the weakness, whether the asset is internet-facing, and whether the asset is business-critical. That means a medium-severity vulnerability on a domain controller or an exposed Azure workload might bump a critical-but-isolated desktop flaw down the list.
Resolve Now breaks your work into three lanes:
- Patch – Software updates for known vulnerabilities, ordered by exposure risk.
- Mitigate – Risks you can't patch immediately, like zero-days, with suggested compensating controls.
- Fix – Misconfigurations and security weaknesses, especially on internet-exposed cloud assets.
Each item is actionable: select one, and you're guided to the relevant remediation workflow, whether that's deploying a Windows update or tightening a network security group rule.
Beside Resolve Now sits Monitor Exposure, a dashboard for tracking longer-term posture. It includes a live count of internet-exposed resources (cloud assets, devices, even shadow IT) and a set of domain initiative scores—Code, Endpoint, Cloud, Identity, SaaS—each measured against a target you set. These scores give you a quick gut check on whether your security hygiene is improving or slipping.
Why This Changes the Game for Windows and Cloud Admins
For years, vulnerability management in Microsoft environments meant staring at endless CVE lists in Microsoft Defender for Endpoint, cross-referencing with Azure Security Center recommendations, and manually connecting dots between identity alerts and device patches. The new dashboard doesn't eliminate that work, but it hands you a curated starting point.
Here's what that means on Monday morning: instead of scanning 200 vulnerability alerts, you open Resolve Now and see four items marked "Patch," two under "Mitigate," and a handful of configuration fixes. Microsoft claims these are the exposures most likely to get you breached. As a result, your triage meeting just went from an hour to fifteen minutes—and you have more time to actually fix things.
For IT managers, the dashboard provides a defensible, data-driven way to allocate finite patching resources. You can show your boss (or an auditor) exactly why you prioritized that Exchange server patch over twenty other updates. The domain scores also give you a trendline: are endpoints getting better or worse over time? Is cloud posture improving? These are powerful narratives for teams fighting for budget or headcount.
But there's a caveat: this is a prioritization engine, not a fix robot. You'll still need to run Windows Update, adjust cloud policies, and confirm that compensating controls are in place. The dashboard doesn't bypass change management. It also doesn't integrate directly with third-party patching tools (though most can be triggered manually once you identify the needed action). Think of it as a GPS for your security queue—it tells you where to go, but you're still driving.
How We Got Here: The Long Road to Exposure-Centric Management
The new dashboard is the latest chapter in Microsoft's pivot from "vulnerability management" to "exposure management." The distinction matters. Vulnerability management typically counts CVEs and assigns severity; exposure management layers on context: Is this device on the internet? Is it a domain controller? Is there an attack path that chains several low-risk issues into a high-risk scenario?
Microsoft started this journey in earnest in 2022 when it merged its Defender for Endpoint and Defender for Cloud posture capabilities. By 2025, it had rebranded the unified tools as "Microsoft Security Exposure Management" and began surfacing attack paths—visualizations of how a hacker could hop from an internet-exposed device to a critical server.
In May 2026, the company previewed an updated Exposure Score that refined how these risks are calculated, incorporating more asset and vulnerability context. The new dashboard, unveiled in late July, is the practical output: an interface that turns that score into a prioritized work queue.
The shift reflects industry-wide pressure. Tools from CrowdStrike, Qualys, and Rapid7 have long championed risk-based vulnerability management, arguing that patch-everything-fast approaches are unrealistic. Microsoft's massive telemetry—from billions of Windows devices, Azure workloads, and Entra ID identities—gives it a unique ability to blend signals and claim that its Resolve Now picks are truly the ones most likely to be exploited in the wild.
How to Start Using the Dashboard Right Now
If your organization is a Microsoft Security Exposure Management customer, the preview is live. Here's how to get to it:
- Go to security.microsoft.com and sign in with an account that has the appropriate permissions (Security Reader or higher, typically).
- In the left navigation, select Exposure Management, then Overview.
- The new dashboard should appear as the default view. If not, check that you're on the preview ring—some tenants may need to opt in via the "What's new" panel.
Not sure if you're eligible? The dashboard requires one of these licenses:
- Microsoft 365 E5
- Microsoft 365 E3 with the E5 Security add-on
- Microsoft Defender for Endpoint Plan 2 (often bundled with E5)
- Any license suite that includes Microsoft Security Exposure Management (check the Microsoft Learn prerequisites page)
During the preview, Microsoft recommends that you compare the Resolve Now queue against your existing incident-response and vulnerability-management priorities. Don't throw out your current processes on day one. Use the dashboard as a second opinion. Does it surface a zero-day you missed? A cloud misconfiguration that's been open for months? Over time, as you gain confidence in its rankings, it can become your primary triage lens.
Also, pay attention to the domain initiative scores. If your Endpoint score is 65% against an 80% target, that's a signal to push Windows patching harder. If Identity is lagging, maybe your next project should be tightening Entra ID conditional access.
What's Next: From Preview to Mission Control
The preview tag means this dashboard will evolve. Microsoft is likely to refine its risk models based on customer feedback and real-world attack data. Expect tighter integration with Microsoft Sentinel and Defender XDR, so that a Resolve Now item can automatically generate an incident or trigger a Logic App runbook.
Down the road, Microsoft might enable one-click remediation for certain low-risk fixes—like enabling a recommended Azure policy—straight from the dashboard. But given the enterprise sensitivity around automated changes, this will be opt-in and heavily audited.
The competitive landscape will also keep the pressure on. Google's Security Command Center already offers an "attack exposure score" for cloud alone. CrowdStrike's Falcon Exposure Management spans endpoints and cloud. Microsoft's advantage is the depth of its native Windows and Azure integration; its challenge is making the dashboard feel indispensable, not just another pane of glass.
For now, though, this is a genuinely useful step. If you're drowning in CVEs and tired of context-switching, the new Exposure Resolution dashboard might be the clarity you've been waiting for. Just remember: a prioritized list only works if you act on it. Open Resolve Now, pick the top item, and start fixing.