---
name: Microsoft Security Exposure Management Baseline
description: Runs a Microsoft Security Exposure Management baseline assessment to identify critical attack paths, score initiative coverage, and prioritise the highest-impact security improvements across the Microsoft 365 and Azure estate.
---

# Microsoft Security Exposure Management Baseline

> **TL;DR:** This skill runs a Microsoft Security Exposure Management baseline to map critical attack paths, score exposure by initiative, and produce a prioritised remediation list that concentrates effort on the exposures with the highest breach impact across the Microsoft 365 and Azure estate.

## What does the Microsoft Security Exposure Management baseline assess?

Microsoft Security Exposure Management (MSEM), which reached general availability in mid-2025, provides a Continuous Threat Exposure Management (CTEM) capability within the Microsoft Defender portal. It ingests signals from Defender XDR, Defender for Cloud, Entra, Intune, and Defender for Cloud Apps, then correlates them to surface attack paths, blast radius estimates, and initiative-based coverage scores. Unlike point-in-time vulnerability scans, MSEM tracks exposure dynamically as assets change. This skill establishes the baseline: reads the current exposure initiatives and scores, maps the top attack paths to their entry-point assets, and produces an action-ranked remediation table for the security operations and architecture teams. It is directly useful for organisations building a formal CTEM programme under the ASD IRAP, Essential Eight, or ISO 27001 frameworks.

## When should you run this skill?

- "Run a security exposure management baseline"
- "What are our highest-risk attack paths?"
- "Score our exposure management initiative coverage"
- "Identify the critical assets most exposed to lateral movement"
- "Produce a CTEM programme baseline for the board"
- "Find the biggest security gaps across our Microsoft estate"

## How this skill works, step by step

1. Open the Microsoft Defender portal → Exposure management → Overview
2. Record the current overall exposure score and trend (improving / deteriorating / stable)
3. Navigate to Exposure management → Initiatives and capture the score for each active initiative: Zero Trust, Identity, Endpoint, Data, Cloud, SaaS Applications
4. Navigate to Attack path analysis and export the top 20 attack paths by blast radius
5. For each attack path identify: entry-point asset, choke-point recommendation, destination critical asset, current exposure level (Critical / High / Medium)
6. Navigate to Critical assets and note any assets tagged as Critical with an exposure level of High or Critical
7. Cross-reference attack path choke-point recommendations with the current Secure Score improvement actions (avoid duplicate remediation effort)
8. Rank remediation actions by: (blast radius × exposure level weight) ÷ estimated effort
9. Produce the initiative scorecard, attack path table, and action list below

## Output format

### Initiative scorecard

| Initiative | Score | Trend | Critical Gaps |
| --- | --- | --- | --- |
| Zero Trust | 54 / 100 | Improving | MFA gaps on privileged accounts |
| Identity | 61 / 100 | Stable | PIM activation not enforced |
| SaaS Applications | 38 / 100 | Deteriorating | No session controls, 12 risky OAuth apps |

### Top attack paths

| Entry Point | Choke Point Recommendation | Destination | Blast Radius | Priority |
| --- | --- | --- | --- | --- |
| Unmanaged device — Exchange OWA | Enable CAAC session control | Exchange mailbox (executive) | High | 1 |
| Guest account with stale access | Remove stale guest, enforce MFA | SharePoint — Highly Confidential site | High | 2 |

Summary:

- Overall exposure score: N / 100
- Critical exposure attack paths: N
- Critical assets at High exposure: N
- Recommended choke-point actions: N

## Scope and safety

Read-only — this skill does NOT:

- Modify assets, policies, or configurations
- Alter Defender XDR incident or alert state
- Automatically remediate any finding

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Security Exposure Management | Microsoft Defender XDR (included in Microsoft 365 E5 or E5 Security) |
| Attack path analysis and blast radius scoring | Microsoft Defender for Endpoint Plan 2 + Defender XDR |
| Initiative scoring across cloud and SaaS | Microsoft Defender for Cloud and/or Defender for Cloud Apps (for full coverage) |

### Least-privilege roles

- Security Reader (read-only review of exposure management, attack paths, and initiatives)
- Security Operator (export data and run queries)

### Microsoft Graph permissions (read-only)

- Exposure Management data is accessed through the Microsoft Defender portal and the Defender XDR Advanced Hunting API
- `ThreatHunting.Read.All` — run KQL queries against the exposure management tables (ExposureGraphNodes, ExposureGraphEdges) via Advanced Hunting

## Sources and compliance

- [Microsoft Security Exposure Management overview (Microsoft Learn)](https://learn.microsoft.com/en-us/security-exposure-management/microsoft-security-exposure-management)
- [Continuous Threat Exposure Management with MSEM](https://learn.microsoft.com/en-us/security-exposure-management/continuous-threat-exposure-management)
- Supports Essential Eight ML3 evidence — systematic exposure identification and prioritisation across the estate
- Aligns with ISO 27001:2022 Annex A 8.8 (Management of technical vulnerabilities) and the ASD IRAP evidence framework
- Pair with Zero Trust Maturity Baseline and Secure Score Improvement Plan for a complete security posture picture
- Output in Australian English