Business Premium Already Includes a Vulnerability Scanner. Most Tenants Never Turn It On.

Here is a budget line most MSPs never collect on: if your clients run Microsoft 365 Business Premium or Defender for Endpoint Plan 2, they already own continuous vulnerability scanning for every workstation. No agent to buy, no per-device add-on. What stands between most environments and 24/7 visibility into unpatched software is a short onboarding checklist and a working process for acting on what the scanner finds. This post covers both, including how we prioritize remediation once the findings start flowing.

What is actually at stake with unpatched software?#

• Vulnerabilities will arise on existing software. Without an approved inventory, exploits against users, devices, and apps go unnoticed until they create loss for the business.
• Hackers exploit outdated software to gain access, steal data, or install ransomware.
• Even strong security tools cannot protect you when an attacker walks through an unpatched application.
• Cyber insurers and compliance frameworks often require software to be kept up to date.
• If your team is unknowingly using vulnerable apps, the business is carrying risk without realizing it.

Maintaining visibility and control over installed software is hard, especially at scale, but failing to do so creates real consequences: data breaches, ransomware, financial loss, downtime. And some applications without any published CVEs still get used maliciously; Quick Assist shows up in social engineering attacks regularly.

The fix is structural: an approved software inventory plus continuous vulnerability scanning. Together they form the baseline for reducing risk and improving operational control. We covered building the inventory side in our guide to application inventory management; this post is the scanning side.

What does the built-in scanner include?#

With Microsoft 365 Business Premium or Defender for Endpoint Plan 2, the native vulnerability management toolset gives you:

• 24/7 software vulnerability scanning
• An exposure score dashboard
• Detailed insights into app versions, patch age, and severity
• Built-in remediation recommendations

How do you get devices reporting in?#

Onboard the endpoints#

1. Head to the Microsoft 365 Defender portal.
2. Go to Settings → Endpoints → Onboarding.
3. Choose your onboarding method:
   • Intune (preferred for MDM environments)
   • Group Policy
   • Local script for testing
4. Make sure Intune integration is enabled under Advanced Features. Microsoft documents the full process here: Onboard and configure devices with Microsoft Defender for Endpoint via Microsoft Intune (opens in new tab).

After enrollment is pushed out and activated, expect around 24 hours before devices start showing up in the Defender admin center.

Wire up notifications#

Configure email notifications for new vulnerabilities (opens in new tab) so findings reach the team without anyone living in the portal. One caveat: Windows OS updates can generate noise when they have not hit their patch window yet. Use PSA tools or helpdesk rules to triage these efficiently instead of muting the alerts entirely.

Reading the dashboard once data arrives#

Once Defender starts reporting, the headline number is the Exposure Score: the higher it climbs, the more vulnerabilities and security misconfigurations exist across your devices.

Drill into Inventories on the left to see the software list. Clicking any application opens its software page. Spend time here getting familiar with:

• Known vulnerabilities and CVEs
• Severity and exploitability
• Version distribution across devices
• Remediation recommendations

This view is what makes prioritization possible, and it surfaces known exploited vulnerabilities automatically.

Approve, remove, patch: the SOP that survives a 300-app list#

This is where the rubber meets the road. The inventory will show 300+ applications, and staring at the list is not a strategy. We work through this decision matrix:

Start by reviewing every application in the vulnerability management dashboard that has a public exploit or weakness. Keep in mind that some weaknesses and public exploits simply have not had time to resolve on their own yet, like OS updates waiting on Patch Tuesday or CVEs that were just published.

1. Is it approved?
   • Yes: add it to your documented inventory.
   • No: open a ticket to investigate or remove it.
2. Is it centrally managed?
   • If yes, deploy updates via RMM or Intune.
   • If no, consider manual removal or user guidance.
3. Does it need action now?
   • Look at the age of the vulnerability and the version distribution.
   • Focus on older versions and high-priority threats first.

For the deployment mechanics of pushing fixes, see remediating vulnerabilities with app deployments in Intune.

Which filters find the real problems first?#

You can export the full software inventory from the Inventories tab in Defender. A few cuts that get you to action quickly:

• Start with anything carrying public exploits or weaknesses. Always the top of the queue.
• Sort by number of devices installed. Higher count usually means higher priority.
• Filter out Microsoft and Apple. Hone in on third-party software instead of the noise natively installed on every device.
• Search for red flags. Remote tools, file-sharing apps, password managers, unknown vendors.

Example: Dropbox installed on 100+ devices when the client standardized on OneDrive is your cue to start the shadow IT cleanup.

Where CloudCapsule picks up the workflow#

CloudCapsule was built to run this exact workflow for MSPs and IT teams across many customers at once:

• Visualize all applications across customers
• Approve or unapprove apps in bulk
• Use predefined proposals to clean up the software inventory
• Export reports for QBRs or security reviews

What does week one look like?#

Nobody cleans up an inventory in a day, and trying to is how the project dies. With the right tools and a clear SOP, you chip away at it over time and turn a sprawling, risky app landscape into a governed one. The starting stack:

• Layered protections, meaning no local admin rights, App Control policies, and similar guardrails
• 24/7 vulnerability scanning via Defender
• A living, breathing approved software inventory

Get those three moving and you are ahead of most environments already.