> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/secure-and-measure/microsoft-dashboards.md). # Microsoft Dashboards Microsoft has security dashboards and scores spread across several portals. Most organizations never open them. This page shows where to look, what each one tells you, and what they leave out. {% hint style="info" %} What you see depends on your licenses and admin role. Review these **monthly**, and look at the trend, not just the number. {% endhint %} ### Scores at a glance | Score | Portal | Measures | | ----------------------------------- | -------- | ----------------------------------------------------------------------------------------------------- | | **Microsoft Secure Score** | Defender | Overall Microsoft 365 security settings: identity, devices, email, apps and data | | **Identity Secure Score** | Entra | Entra ID settings, such as MFA, risk policies and admin roles | | **Defender for Cloud Secure Score** | Azure | How well Azure resources are configured | | **Regulatory compliance** | Azure | Azure controls passed against a standard, such as the Microsoft cloud security benchmark, CIS or NIST | | **Compliance Manager score** | Purview | Progress on data protection and regulatory requirements | ## Entra admin center [Microsoft Entra admin center](https://entra.microsoft.com)
| Dashboard | Where | Answers | | ----------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------- | | **Identity Secure Score** | **Identity Secure Score** | Which identity settings should we fix next, and what license does each fix need? | | **Risky users** | **ID Protection** → **Risky users** | Which users does Microsoft think are compromised? | | **Risky sign-ins** | **ID Protection** → **Risky sign-ins** | Which sign-ins looked suspicious? | | **Risk detections** | **ID Protection** → **Risk detections** | What specifically was detected, such as leaked credentials or impossible travel? | | **Risky workload identities** | **ID Protection** → **Risky workload identities** | Which apps and service principals look compromised? | | **Conditional Access** | **Conditional Access** → **Policies** | Which policies are on, off or in report-only mode? | ## Defender portal [Microsoft Defender portal](https://security.microsoft.com)
| Dashboard | Where | Answers | | ---------------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------- | | **Secure score** | **Exposure management** → **Secure score** | How do our settings compare with Microsoft's recommendations? | | **Exposure overview** | **Exposure management** → **Overview** | What's our overall exposure across identities, devices and cloud? | | **Initiatives** | **Exposure management** → **Initiatives** | How ready are we for specific threats, such as ransomware? | | **Attack surface** | **Exposure management** → **Attack surface** | How could an attacker reach our most critical assets? | | **Vulnerability management** | **Exposure management** → **Vulnerability management** | Which devices have vulnerable software, and what should we patch first? | | **Identities dashboard** | **Identities** → **Dashboard** | How many identities is Defender protecting, and where are the gaps? | | **Coverage & Maturity** | **Identities** → **Coverage & Maturity** | Which identity sources are connected? | | **Service accounts** | **Identities** → **Service accounts** | Which non-human accounts exist, and which are risky? | | **Cloud discovery** | **Cloud apps** → **Cloud discovery** | Which cloud apps are employees using, including unapproved ones? | | **OAuth apps** | **Cloud apps** → **OAuth apps** | Which apps have access to our data, and with what permissions? | ### Advanced hunting [Microsoft Defender portal](https://security.microsoft.com) → **Investigation & response** → **Hunting** → **Advanced hunting** Advanced hunting lets you search up to **30 days** of raw data from Defender for Endpoint, Office 365, Identity and Cloud Apps, plus Entra ID, using **KQL** (Kusto Query Language). It's the same data your SOC uses to investigate. | Feature | What it does | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------ | | **Schema** | Lists every table you can search, grouped by category, such as Alerts & behaviors or Apps & identities | | **Getting started** and **query library** | Ready-made queries you can run or adapt | | **Threat hunting assistant** | Describe what you're looking for in plain language, and Security Copilot writes the query | | **Create detection rule** | Turns a query into a custom alert that runs on a schedule |
{% hint style="info" %} **Results depend on your licenses.** Each table only has data for the Defender products you have. Check **Schema** to see what's available in your tenant. {% endhint %} {% hint style="info" %} **Want help building detections?** RedLegg's SOC writes and tunes detection rules for your Microsoft data. See **RedLegg Managed SOC**. {% endhint %} ## Azure portal [Azure portal](https://portal.azure.com) → **Microsoft Defender for Cloud** Defender for Cloud alerts and cloud posture also appear in the **Defender portal** under **Cloud security**, but settings are changed here, in the Azure portal.
| Dashboard | Where | Answers | | --------------------------- | ------------------------- | ---------------------------------------------------------------------------------------- | | **Recommendations** | **Recommendations** | Which Azure resources are misconfigured, and how much would fixing them raise our score? | | **Regulatory compliance** | **Regulatory compliance** | How many controls do we pass for each standard we track? | | **Attack path analysis** | **Attack path analysis** | Is there a path an attacker could use to reach critical resources? | | **Defender plans coverage** | **Environment settings** | Which protection plans are on for each subscription? | ## Purview portal [Microsoft Purview portal](https://purview.microsoft.com) → **Compliance Manager**
| Dashboard | Where | Answers | | ----------------------- | ----------------------- | -------------------------------------------------------------------- | | **Compliance score** | **Overview** | How far along are we on data protection and compliance requirements? | | **Improvement actions** | **Improvement actions** | What should we do next, and how many points is each action worth? | {% hint style="warning" %} **Look at "Your points achieved."** Much of the Compliance Manager score usually comes from **Microsoft-managed** actions that Microsoft completes for you. Your organization's own progress is often much lower than the headline number. {% endhint %} ## Security Copilot [Microsoft Security Copilot](https://securitycopilot.microsoft.com) Security Copilot lets you ask questions about your security data in plain language, instead of searching through each portal. It works across Defender, Entra, Intune, Purview, Sentinel and Defender for Cloud.
### What's in the portal | Area | What it's for | | ------------------ | ---------------------------------------------------------------------------------------------------- | | **Home** | Ask a question in the prompt box, or start from **Prompts to try** | | **Agents** | AI agents that handle tasks such as alert triage, phishing review or Conditional Access optimization | | **Promptbooks** | Saved sets of prompts that run together, such as a full incident investigation | | **History** | Your past sessions, including ones started inside other portals | | **Owner** | Admin settings: plugins, roles, workspaces and **usage monitoring** | | **Security Store** | Additional agents and plugins from Microsoft and partners | {% hint style="info" %} **Use the Role and Plugin filters** on **Prompts to try** to find prompts for your job and the tools you have, such as Intune, Sentinel or Entra. {% endhint %} ### Try asking * *"What is my current Identity Secure Score and top improvement actions?"* * *"Summarize the high-severity Defender incidents from the last 7 days."* * *"Which users are flagged as risky, and why?"* * *"Show failed user sign-ins in the last 24 hours."* * *"What groups is \[app name] assigned to?"* * *"List common cloud security misconfigurations and how to avoid them."* ### Also inside other portals Security Copilot also appears as a **Copilot** panel inside the Defender portal, Entra admin center, Intune, Purview and Defender for Cloud. Sessions started there show up in **History** here. {% hint style="info" %} **Requires:** included with **Microsoft 365 E5 or E7** once rolled out in your tenant. Otherwise, it needs **Security Compute Units (SCUs)** set up in Azure. Admins can track usage under **Owner** → **Usage monitoring**. {% endhint %} ## What the scores don't tell you * **They show risk, not activity.** Scores and attack paths show where you're exposed, not whether someone is attacking you right now. That's what your SOC is for. * **Attack paths are modeled, not tested.** Attack path analysis shows how an attacker *could* reach critical assets based on your settings and vulnerabilities. It doesn't prove an attack would succeed, or that your defenses would stop it. * **They only cover what's connected.** Defender for Cloud can include AWS, GCP, GitHub, Azure DevOps and more, and Exposure management can pull in third-party tools through **Data connectors**. Anything not connected, such as unmanaged devices, on-premises systems or unconnected cloud apps, isn't in the score. * **They can be gamed.** Marking recommendations as "risk accepted" or "resolved through third party" raises the score without changing anything. | For… | Use | | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | | Knowing whether attacks are happening now | **RedLegg's 24x7 SOC** | | Testing whether your settings would stop a real attacker | **RedLegg Penetration Testing** | | Finding which gaps matter most for your business | **RedLegg Advisory** | | Endpoint management and phishing response playbooks | **RedLegg Automation** | | Identity Governance and Administration (IGA), application access review automation and privileged access management (PAM) | **AOHWV** | ## Related * [Top 10 Hardening Steps](/get-expert-help/overview.md) — The highest-impact settings to fix first * [Quick Start](/quick-start/getting-started.md) — Make sure your SOC can see what happens in your tenant * [Get Expert Help](/get-expert-help/overview.md) — AOHWV and RedLegg services --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://msdocs.aohwv.com/secure-and-measure/microsoft-dashboards.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.