(Updated) Microsoft Secure Score: New recommendation to reduce inbound internet exposure

(Updated) Microsoft Secure Score: New recommendation to reduce inbound internet exposure

Microsoft Secure Score in Microsoft Defender for Endpoint introduces a new default recommendation to reduce unnecessary inbound internet exposure by identifying internet-facing devices. Rolling out from June 2026, it helps admins validate and remediate exposure risks, improving enterprise security posture with no user impact or required configuration.

2026-06-09T16:08:02.240Z

Updated message,New feature,Admin impact

<p>Updated June 9, 2026: We have updated the timeline. Thank you for your patience.&nbsp;</p><p><b>[What and Why:]</b></p> <p>We’re introducing a new Microsoft Secure Score recommendation in <b>Microsoft Defender for Endpoint (MDE)</b> to help organizations reduce unnecessary inbound exposure from the public internet. This update strengthens your <b>enterprise security posture</b> by giving admins clear visibility into internet-facing devices, helping validate whether exposure is expected, approved, and appropriately secured. By highlighting potential attack surface risks, this recommendation supports proactive risk reduction and aligns with Microsoft’s commitment to enterprise-ready security and manageability.</p><p><b>[Rollout Schedule:]</b></p> <ul> <li>Public Preview (Worldwide): Rollout started on June 3, 2026.</li> <li>General Availability (Worldwide):&nbsp;We will begin rolling out in <b>mid-June 2026 </b>(previously early June)&nbsp;and expect to complete by <b>end of June 2026</b> (previously&nbsp;mid-June).</li> </ul> <p><b>[Impact on Your Organization:]</b></p> <ul> </ul><p><b>Who is affected:</b> Admins managing Microsoft Defender for Endpoint and Microsoft Secure Score</p><p><b>Platforms/Services:</b> Microsoft Defender for Endpoint, Microsoft Secure Score</p><p><b>What will happen:</b></p><ul><li>A new Secure Score recommendation, "<b>Reduce unnecessary inbound internet exposure on internet-facing devices</b>," will appear.</li><p>Screenshot: <i>New Secure Score recommendation in Microsoft Defender:</i></p><p><img src="https://cxcs.microsoft.net/static/public/messagecenter/neutral/40334c8c-0079-4ba3-85bb-af5933f26217/e7104fdb087d8fd730303115173bff63a36e48e0.png" style="width: 400px;" alt="user settings"></p></ul><ul><li>Admins will gain visibility into devices with observed inbound connectivity from the public internet.</li><li>Devices or services reachable from the internet will be identified for review.</li><li>Secure Score will reflect progress as remediation or validation actions are taken.</li><li>The recommendation is <b>on by default</b> and <b>requires no configuration</b> to appear.</li><li>No user experience changes.</li> </ul><ul> </ul> <p><b>[Action Required / Recommendations:]</b></p> <ul> </ul><p>No immediate action is required to enable this feature.</p><p>Recommended actions for admins:</p><ul> <li>Review the new recommendation in Microsoft Secure Score once it appears.</li><li>Identify devices flagged as internet-facing.</li><li>Validate whether each exposure is expected, approved, and required.</li><li>Follow provided remediation guidance to reduce unnecessary exposure.</li><li>For devices that must remain internet-facing:<ul><li>Ensure the exposure is approved, documented, and properly secured.</li><li>Consider applying an exception where the risk is accepted by your organization.</li></ul></li></ul><p>For more information, review documentation on Microsoft Defender for Endpoint and Microsoft Secure Score in Microsoft Learn.</p><p><b>[Compliance considerations:]</b></p><p></p><p>No compliance considerations identified, review as appropriate for your organization.</p>