MC941863 – Microsoft Secure Score: Changing Microsoft Defender for Endpoint recommendation

Product:

Defender, Defender for Endpoint, Defender XDR

Platform:

Online, US Instances, World tenant

Status:

Change type:

Admin impact

Links:

Details:

We're updating the Microsoft Secure Score improvement action of Microsoft Defender for Endpoint (MDE) to ensure a more accurate representation of security posture.
As part of this change, we will gradually retire the MDE recommendation on SCID-2020, Turn on all system-level Exploit protection settings.
We are working to refine the recommendation, ensuring it aligns more accurately with recommended policies and enhances the overall security value.
[When this will happen:]
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out early December 2024 and expect to complete by early January 2025.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2024-11-26

updated:
2024-11-26

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

Microsoft is updating its Secure Score by removing the SCID-2020 recommendation related to system-level Exploit protection settings in Microsoft Defender for Endpoint to better align with updated security policies.

Direct effects for Operations**

Removal of Exploit Protection Settings
The removal of the recommendation to turn on all system-level Exploit protection settings may lead to a temporary decrease in the overall security posture of the organization, potentially increasing vulnerability to exploits during the transition period.
   - roles: IT Security Manager, System Administrator
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-secure-score-improvement-action-update/ba-p/3851230

User Awareness and Training
Users may be unaware of the changes in security recommendations, leading to confusion or misconfiguration of security settings, which could negatively impact their experience and security awareness.
   - roles: End User, IT Support Specialist
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-secure-score-improvement-action-update/ba-p/3851230

Documentation and Policy Updates
The need to update documentation and policies to reflect the new security recommendations may lead to inconsistencies if not managed properly, potentially causing users to follow outdated procedures.
   - roles: Compliance Officer, IT Documentation Specialist
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-secure-score-improvement-action-update/ba-p/3851230

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only