Vulnerability Remediation Agent

👋 Introduction

As Security Copilot becomes available in Microsoft 365 E5 tenants, users gain access to Security Copilot agents. The Vulnerability Remediation Agent is one of these agents, connecting Defender and Intune. It makes vulnerability remediation much easier in Intune by using security information from Defender.

The agent helps remediate vulnerabilities identified by Microsoft Defender. In addition, you can get explanations and ask questions in natural language about these vulnerabilities and their remediation.

How it works

1. Data collection: Collects vulnerability data and CVEs from Defender Vulnerability Management.
2. Analysis and prioritization: Evaluates vulnerabilities based on severity, exposure, and affected devices.
3. Remediation guidance: Provides step-by-step remediation recommendations using Intune capabilities.
4. Tracking and reporting: Tracks suggested remediations and helps measure security improvements.

Prerequisites

Required licenses (all included in Microsoft 365 E5):

• Microsoft Intune Plan 1
• Microsoft Defender Vulnerability Management
• Microsoft Security Copilot

Security Copilot plugins:

• Microsoft Intune
• Microsoft Defender

To enable the Vulnerability Remediation Agent:

• Read Only Operator (Intune role) or a custom role with
  • Security Tasks / read
  • Mobile apps / read
  • Device configurations / read
  • Organization / read
• Copilot owner (Security Copilot role)

To run the agent:

• Read Only Operator (Intune role) or custom role with
  • Mobile apps / read
  • Device configurations / read
• Security Reader role (Entra role)
• Copilot contributor (Security Copilot role)

To view the agent, you only need the Read Only Operator role or a custom role with:

• Security Tasks / read
• Mobile apps / read
• Device configurations / read
• Organization / read

INFO

• The agent is currently only supported on the public cloud.
• The Vulnerability Remediation Agent supports Windows and Intune Apps evaluation and recommendations.

▶️ Getting started

To get started, you can provision the agent either in the Intune admin center or the Security Copilot portal. To learn how to provision it through the Security Copilot portal, see this guide.

Set up

1. Open the Intune admin center and select the Agents blade from the left menu.

2. When you click View details before starting the agent, you get the option to set it up.

3. After the automatic setup, the agent will show that it lacks permissions. To resolve this, go to the Permissions page in Settings.

4. When you click Manage agentic user, you can give the newly created identity the permissions it needs to work. See the prerequisites above.

5. Click Run readiness check and confirm that everything is in order.

WARNING

Be aware that you cannot run the agent without completing the readiness check.

6. The only other setting available for this agent is the option to run it regularly, which you can configure on the Triggers page.

Remediation

To start remediating vulnerabilities, start a run manually or wait for the scheduled trigger time.

After the run, you will find suggestions and the agent's run history in the Overview tab.

• Agent status: Tiles show whether the agent is available and its current run status.
• Agent suggestions: A short list of the top vulnerabilities (by impact) to address, updating after every run.
• Activity: Tracks most recent runs.

Next to Overview, you will find the Suggestions tab, where you can see all reviewed vulnerabilities in a prioritized list. The suggestions are generated with the latest data from your Defender Vulnerability Management.

The list shows important details about each suggestion.

• Suggested next steps: Recommended actions to help remediate the vulnerability.
• Remediation type: The remediation target.
• Impact: Potential impact based on the exposure score from Defender.
• Exposed devices: Number of affected devices.
• Status: Not applied or applied.
• Last applied: Date the suggestion was last applied.

When you open a suggestion, you will get more in-depth information about the vulnerability and the suggested action.

You will find the following sections:

• Suggested action: A summary of the recommendation, details about the associated vulnerabilities, and suggested remediation actions with step-by-step guides.
• Configurations: Device configuration policy settings from the settings catalog to reduce your attack surface, including recommended configurations for each setting and links to the CSP documentation.
• References: Links to Defender references used for the recommendation.

INFO

The agent recommends remediation based on the vulnerability type.

• Apps: Updated app versions or Intune profiles to manage app behavior.
• Operating system: Quality update policies or expedited deployment using Windows Update rings.

At the bottom of the Remediation page, you’ll find Suggestion details. This section shows whether the recommendation has been marked as applied, along with the impact, the affected systems, the exposed devices, and the associated CVEs.

Once you’ve remediated a suggestion, mark it as applied with the Mark as applied button so you can keep track of what you’ve fixed over time.

• Confirms that the remediation steps are complete.
• The action does not trigger any device changes by the agent.
• It adds a Last marked as applied timestamp to track when the remediation was implemented.

IMPORTANT

Because CVE details and remediation guidance can change over time, future agent runs could show updated information, device counts, or remediation steps. If a marked suggestion is updated in a later run, select Mark update as applied to update the recommendation with a Last marked as applied timestamp. Keeping track of what you’ve already remediated helps you see how risks change over time.

When you follow the reference links in the remediation details, you will find that the same vulnerabilities are listed in the Defender portal recommendations. If you apply the recommendation in Intune, it will automatically show the recommendation as applied in Defender, which makes cooperation between endpoint and security teams much smoother.

⚠️ Common Errors

Agent runs can fail for several reasons. The following are errors and recommended actions.

The agent doesn't provide accurate suggestions

The agent may lack sufficient data, or its settings may not match your organization's environment.

Use the like/dislike buttons on suggestions to provide feedback.

The agent didn't finish the run

Details: The agent couldn't start or complete the run. The cause is unknown, but administrators can still view and manage suggestions from previous runs.

Try running the agent again first. If the issue persists, the agent may have lost authorization and require reauthorization. Possible causes include:

• The 90-day authorization period expired.
• The installation account requires periodic reauthentication.
• An access token was revoked.

To reauthorize the agent, remove it and set it up again.

💡 Conclusion

The Vulnerability Remediation Agent is a valuable tool for organizations looking to strengthen their security posture and reduce the risk caused by vulnerable devices and applications. Its ability to combine Defender vulnerability data with Intune remediation guidance makes it easier to prioritize the most important issues and turn recommendations into practical actions. It can run regularly, helping you keep track of new vulnerabilities and changing device exposure while consuming SCUs only when it checks new vulnerable systems.

References

• Microsoft Learn - Vulnerability Remediation Agent in Microsoft Intune