Microsoft Defender Vulnerability Management · direct connection
Microsoft Defender Vulnerability Management reports for every client
Defender already knows which devices are vulnerable. Connect a client's Microsoft tenant to Varaxon Scan Hub and turn that data into a ranked, plain-language report, without exporting a file.
What Scan Hub reads from Microsoft Defender
Read-only access.
A Global Administrator of the client's tenant approves read-only access for Scan Hub through Microsoft's own consent screen. No password or secret is stored.
Devices and their vulnerabilities.
Scan Hub reads the devices Defender knows and the vulnerabilities it reports on them, then ranks them by CISA KEV, EPSS and CVSS.
On demand or automatic.
Build a report when you need one, or turn on automatic reports for the client.
How to connect Defender
- Check the client has Defender for Business (included in Microsoft 365 Business Premium), Defender for Endpoint Plan 2, Defender Vulnerability Management or Defender for Servers.
- In Scan Hub, open Connections, choose Microsoft Defender and pick the client.
- A Global Administrator of the client's tenant signs in to Microsoft and approves read-only access.
- Build the first report, or turn on automatic reports.
What the report states explicitly
- The report says the data came from Microsoft Defender, and when it was read.
- Devices Defender does not see are outside the report's scope, and the report says so.
- Known exploited vulnerabilities (CISA KEV) go to the top, whatever their CVSS score.
Common questions
- Which Microsoft licences does this need?
- Microsoft Defender for Business (included in Microsoft 365 Business Premium), Defender for Endpoint Plan 2, Defender Vulnerability Management or Defender for Servers.
- What access does Scan Hub get?
- Read-only access, approved by a Global Administrator of the client's tenant on Microsoft's consent screen. Scan Hub stores no password or secret, and the admin can remove access in Microsoft Entra at any time.
- Why not just use the Defender portal?
- The portal is built for the admin. Scan Hub writes a report the client can read: the few fixes that matter most, in plain language, with the evidence behind each one.
Guide
What is CISA KEV?Why exploited vulnerabilities go first, whatever their CVSS score.Read the guide