Microsoft Defender EASM - Simply Explained
Microsoft Defender External Attack Surface Management, or Defender EASM, helps organizations understand a critical security question: what can someone outside your company actually see? Your public footprint is much larger than your official website. Forgotten subdomains, old campaign pages, test environments, cloud services, public IP addresses, certificates, and internet-facing servers can remain visible long after the teams that created them have moved on. Defender EASM approaches security from an attacker's perspective and helps discover that external footprint.
ㅤ
YOU CAN'T PROTECT WHAT YOU CAN'T SEE
Traditional security inventories usually start from inside the organization. IT knows about managed laptops, servers, applications, and user accounts. Marketing may maintain its own websites, while cloud teams and suppliers manage additional services. The problem exists between those inventories. Projects end, but test websites remain online. Subdomains are forgotten. IP addresses change. Certificates expire. Suppliers may continue operating public services that internal security teams no longer actively track. If something remains reachable from the public internet, attackers can potentially discover it even when your organization has forgotten about it.
ㅤ
WHAT MICROSOFT DEFENDER EASM ACTUALLY DOES
Microsoft Defender EASM is designed to find, map, and monitor the parts of an organization that face the public internet. EASM stands for External Attack Surface Management. External means resources visible outside your internal network. Attack surface represents the public locations, systems, and services that could potentially be reached or inspected. Management means continuously understanding and maintaining that external picture. Defender EASM can discover domains, subdomains, hosts, public IP addresses, web pages, certificates, and internet-facing services associated with an organization.
ㅤ
EASM IS NOT ANOTHER FIREWALL OR ANTIVIRUS
The Defender name can create some confusion. Defender EASM doesn't replace firewalls, endpoint protection, patch management, email security, or cloud workload protection. Instead, it helps answer the question that comes before those controls: what does the public internet know about your organization? Internal security tools can tell you about systems you already manage. Defender EASM starts from outside and can potentially uncover assets that never made it into your internal inventory.
ㅤ
HOW EASM DISCOVERY WORKS
Discovery begins with something Microsoft calls a seed. A seed is a known piece of public information associated with your organization. This could include a domain, public IP address or range, hostname, email contact, Autonomous System Number, or company information contained in public registration data. You don't need to provide a complete inventory. Instead, Defender EASM follows relationships between publicly available information to build a broader picture of your external attack surface.
ㅤ
FROM ONE DOMAIN TO AN ENTIRE MAP
Imagine starting with your primary company domain. That domain could reveal a subdomain. A certificate associated with the subdomain could contain additional names. Those names could point toward hosts, which could lead to public IP addresses and internet-facing services. Each discovery can create another clue. Microsoft describes this as recursive discovery. Defender EASM follows public relationships and continuously expands the map of assets potentially associated with your organization.
ㅤ
OWNERSHIP STILL MATTERS
Finding a relationship doesn't automatically mean your company owns the resource. An IP address could belong to a shared cloud provider. A certificate might contain names associated with several customers. A public website could be operated by an external agency or supplier. Defender EASM helps identify these relationships, but organizations still need to determine ownership and responsibility. Discovery groups can help organize this process around specific companies, brands, business units, domains, or public IP ranges. Items that don't belong to the organization can also be excluded from the working inventory.
ㅤ
YOUR ATTACK SURFACE NEVER STOPS CHANGING
External attack surface management isn't a one-time inventory exercise. Organizations continuously launch websites, create cloud services, retire applications, change infrastructure, work with new suppliers, and acquire other companies. A public footprint that was accurate last month may already be incomplete today. Regular discovery helps maintain a more current picture of what outsiders can see.
ㅤ
FROM INVENTORY TO SECURITY ACTION
Finding hundreds of domains, certificates, IP addresses, and services doesn't automatically improve security. The inventory needs context. Defender EASM maintains relationships between discovered assets. A domain might connect to a certificate, which connects to several hostnames, which lead to IP addresses and public services. These relationships allow security teams to ask better questions about who owns an asset, why it exists, whether it should remain public, and whether it requires remediation.
ㅤ
OBSERVATIONS AND EXPOSURES
Defender EASM can surface observations that deserve investigation. These could include forgotten subdomains, outdated public pages, exposed remote-access services, certificates approaching expiration, or configurations that don't match organizational expectations. But not every finding represents the same risk. Teams need to consider exposure, known weaknesses, business importance, and ownership before deciding what deserves attention first.
ㅤ
SHADOW IT AND FORGOTTEN ASSETS
One of the most useful scenarios for EASM is discovering technology that exists outside the organization's normal inventory. A marketing team might have created a campaign website. A developer may have deployed a temporary cloud service. A supplier might operate a portal. The original project can disappear while the infrastructure remains online. This is one form of shadow IT. The objective isn't automatically to remove everything unexpected. The objective is to establish whether the asset belongs to the organization, whether it is still required, who owns it, and what protection it needs.
ㅤ
HOW EASM FITS INTO MICROSOFT SECURITY
Defender EASM provides the outside perspective while other Microsoft security products protect different areas of the organization. Microsoft Defender for Endpoint focuses on devices such as laptops and servers. Defender for Office 365 helps protect email and collaboration environments. Defender for Cloud addresses security across cloud workloads. Microsoft Entra ID provides identity and access controls. Defender EASM complements these tools by showing what is publicly discoverable before an attacker reaches those internal systems.
ㅤ
SECURITY EXPOSURE MANAGEMENT
Microsoft Security Exposure Management can bring information from different Microsoft security products into a broader exposure picture. For example, Defender EASM might identify a public-facing server while Defender for Cloud provides information about how that server is configured. Combining these perspectives can help security teams understand relationships between external exposure and internal security posture when prioritizing remediation.
ㅤ
LOG ANALYTICS, SENTINEL AND SECURITY COPILOT
Defender EASM data can also become part of broader security operations. Asset data and attack-surface insights can be exported for analysis. Log Analytics provides a place to search information from multiple Microsoft services, while Azure Data Explorer can support larger-scale analysis and custom reporting. Microsoft Sentinel can use exported information alongside security alerts and logs, helping analysts determine whether incidents involve public-facing assets and what other resources may be connected. Security Copilot can provide another interface for investigating this information using natural-language questions, while security professionals remain responsible for interpreting findings and deciding what action should be taken.
ㅤ
HOW TO GET STARTED WITH DEFENDER EASM
Start with information you already trust. Identify your primary company domains, approved public IP ranges, brands, products, and business units. Create a discovery group and allow Defender EASM to build the inventory. Then involve the teams that understand those assets: web, cloud, networking, security, and relevant suppliers. Classify discovered assets according to ownership and purpose. Determine whether they are owned, shared, no longer required, or outside your organization's control. Finally, establish regular discovery and review cycles. Turn findings into practical actions such as closing unnecessary services, renewing certificates, updating exposed systems, or removing websites that no longer serve a business purpose.
ㅤ
ㅤ
THE KEY TAKEAWAY
Microsoft Defender EASM helps organizations see their infrastructure from the outside. Instead of relying entirely on internal inventories, it discovers the domains, hosts, IP addresses, certificates, services, and other assets that outsiders may be able to find. The goal is simple: know what is exposed, understand why it is there, establish who owns it, and determine what needs to be secured or removed. A useful first exercise is to identify three public domains your organization uses and ask three questions about each one: Who owns it? Why does it need to remain online? Who is responsible for fixing it if something changes tomorrow?
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
00:00:00,000 --> 00:00:02,960
What exactly can strangers see when they look at your company online?
2
00:00:02,960 --> 00:00:07,360
You might think of your company website, maybe your public LinkedIn page and your email address,
3
00:00:07,360 --> 00:00:09,240
but the public view is much bigger than that.
4
00:00:09,240 --> 00:00:13,640
There could be an old test website still online, a forgotten subdomain from a past project,
5
00:00:13,640 --> 00:00:19,240
a cloud service created by a team that has since moved on, or a public server, nobody has written down anywhere.
6
00:00:19,240 --> 00:00:20,720
These are digital doors and windows.
7
00:00:20,720 --> 00:00:24,920
They already face the internet, which means anyone can see them, not just your IT team.
8
00:00:24,920 --> 00:00:30,560
Most security tools start from inside your company and protect known devices, known users, and known files.
9
00:00:30,560 --> 00:00:34,320
An attacker starts outside, they don't need your company map or a login.
10
00:00:34,320 --> 00:00:36,040
They only need to look for what is visible.
11
00:00:36,040 --> 00:00:40,920
I'm Mirko Peters from M365FM, and in this knowledge nugget, we're going to look at Microsoft Defender,
12
00:00:40,920 --> 00:00:44,360
external attack service management, or EASM in plain English.
13
00:00:44,360 --> 00:00:48,200
You'll see how it finds public facing assets, why that list changes over time,
14
00:00:48,200 --> 00:00:53,000
and how a small clue you already know about can lead to something your team never knew existed.
15
00:00:53,000 --> 00:00:55,480
The problem, you can't lock what you can't see.
16
00:00:55,480 --> 00:00:57,600
Imagine your company as an office building.
17
00:00:57,600 --> 00:01:01,240
Inside you may have security at the front desk, staff use badges.
18
00:01:01,240 --> 00:01:02,840
Important rooms have locks.
19
00:01:02,840 --> 00:01:05,040
Cameras watch the main hallway, that's a good start.
20
00:01:05,040 --> 00:01:09,000
But someone walking around outside might find a side entrance that nobody checks anymore,
21
00:01:09,000 --> 00:01:12,160
maybe it belonged to an old team or contractor used it years ago.
22
00:01:12,160 --> 00:01:14,400
The sign has faded, but the door still opens.
23
00:01:14,400 --> 00:01:16,160
Online security has the same problem.
24
00:01:16,160 --> 00:01:21,680
Your IT team may keep a list of laptops, user accounts, approved applications, and company servers.
25
00:01:21,680 --> 00:01:26,720
The marketing team keeps a separate list of websites, a cloud team tracks its own services.
26
00:01:26,720 --> 00:01:30,680
A supplier runs another public site for a campaign, each list can be correct on its own.
27
00:01:30,680 --> 00:01:33,360
The trouble starts in the spaces between those lists.
28
00:01:33,360 --> 00:01:35,840
A project ends, but its test site stays online.
29
00:01:35,840 --> 00:01:39,680
Someone creates a subdomain for a short term event and forgets to remove it.
30
00:01:39,680 --> 00:01:44,200
A public IP address moves from one service to another, while the old records never change.
31
00:01:44,200 --> 00:01:48,880
A certificate reaches its expiry date and suddenly a website fails when customers try to use it.
32
00:01:48,880 --> 00:01:53,560
The internet doesn't care whether the service belongs to marketing, IT, a developer, or an outside supplier.
33
00:01:53,560 --> 00:01:57,280
If it responds to a request from the public internet, it can attract attention.
34
00:01:57,280 --> 00:02:00,120
An attacker's don't need to break into your office first to find it.
35
00:02:00,120 --> 00:02:04,840
They can search public records, look at domain names and website details, and inspect certificates,
36
00:02:04,840 --> 00:02:07,760
public IP addresses, and services that answer on the internet.
37
00:02:07,760 --> 00:02:10,400
They build a picture from clues that were already visible.
38
00:02:10,400 --> 00:02:12,840
You've probably seen a small version of this yourself.
39
00:02:12,840 --> 00:02:16,720
You search for your company name and find an old page still appearing in the results.
40
00:02:16,720 --> 00:02:21,400
Maybe it lists a phone number nobody uses anymore, or it refers to a product that no longer exists.
41
00:02:21,400 --> 00:02:24,880
For a security team, the same thing can happen with far more technical items.
42
00:02:24,880 --> 00:02:29,760
A domain can lead to a subdomain which can point to a host, which can reveal a public service.
43
00:02:29,760 --> 00:02:31,840
None of this means there is automatically a problem.
44
00:02:31,840 --> 00:02:36,440
Public websites need to be public, email systems need to accept messages, and remote access.
45
00:02:36,440 --> 00:02:37,920
Maybe there for a good reason.
46
00:02:37,920 --> 00:02:39,480
The issue is ownership and awareness.
47
00:02:39,480 --> 00:02:41,560
Can someone tell you who owns that asset?
48
00:02:41,560 --> 00:02:43,000
Do they know why it is public?
49
00:02:43,000 --> 00:02:44,000
Is it still needed?
50
00:02:44,000 --> 00:02:47,480
And if a weakness appears, does the right person know they need to fix it?
51
00:02:47,480 --> 00:02:50,840
This gets harder because a company's public footprint never stays still.
52
00:02:50,840 --> 00:02:54,680
People launch new websites, teams try cloud services, companies by other companies,
53
00:02:54,680 --> 00:02:57,640
vendors create portals, and developers build test systems.
54
00:02:57,640 --> 00:03:02,400
Then people change jobs, projects close, and the original reason for an asset disappears.
55
00:03:02,400 --> 00:03:04,320
That is often called shadow IT.
56
00:03:04,320 --> 00:03:09,680
Shadow IT means a tool, service, or system that operates outside the normal company list.
57
00:03:09,680 --> 00:03:11,280
It doesn't always come from bad choices.
58
00:03:11,280 --> 00:03:13,680
Often someone simply needed to get work done quickly.
59
00:03:13,680 --> 00:03:16,720
But if nobody knows it exists, nobody checks whether it is safe.
60
00:03:16,720 --> 00:03:20,360
So a yearly spreadsheet of public assets can become outdated very quickly.
61
00:03:20,360 --> 00:03:24,000
The old way it depends on asking every team, collecting their answers, and hoping nothing
62
00:03:24,000 --> 00:03:25,000
was missed.
63
00:03:25,000 --> 00:03:28,000
That gives you an inside view, but it doesn't prove what the internet can actually see.
64
00:03:28,000 --> 00:03:30,840
Microsoft Defender ESM starts from the other direction.
65
00:03:30,840 --> 00:03:34,880
It begins with a small clue about your company, then follows the public trail outward.
66
00:03:34,880 --> 00:03:37,560
What Microsoft Defender ESM actually is?
67
00:03:37,560 --> 00:03:41,320
Microsoft Defender external attack service management is Microsoft service for finding,
68
00:03:41,320 --> 00:03:44,800
slapping, and monitoring the parts of your company that face the public internet.
69
00:03:44,800 --> 00:03:47,680
That's a mouthful, so let's break it down in plain English.
70
00:03:47,680 --> 00:03:50,040
External means outside your company network.
71
00:03:50,040 --> 00:03:52,560
On the public internet where anyone can see.
72
00:03:52,560 --> 00:03:57,120
A attack service refers to every public spot that someone or something could reach, inspect,
73
00:03:57,120 --> 00:04:01,160
or try to misuse, and management means keeping that picture up to date so your team can review
74
00:04:01,160 --> 00:04:03,520
it and take action when something needs attention.
75
00:04:03,520 --> 00:04:07,400
Put those three words together, and ESM gives you an outside view of your company's
76
00:04:07,400 --> 00:04:08,400
public footprint.
77
00:04:08,400 --> 00:04:11,280
Think of a property inspector walking along a row of business units.
78
00:04:11,280 --> 00:04:14,040
They don't enter every room or read every file inside.
79
00:04:14,040 --> 00:04:18,840
Instead, they check only the parts visible from the street, which entrances exist, which
80
00:04:18,840 --> 00:04:23,280
signs point to the business, which windows are broken, and which old storage door still
81
00:04:23,280 --> 00:04:26,360
has a lock, but no one seems responsible for it.
82
00:04:26,360 --> 00:04:27,960
Defender ESM works the same way online.
83
00:04:27,960 --> 00:04:33,280
It can find domains and subdomains like Contoso, Com and Events, dot Contoso.com, identify
84
00:04:33,280 --> 00:04:37,680
hosts that are named systems connected to those addresses, and map public IP addresses,
85
00:04:37,680 --> 00:04:41,240
web pages, certificates, and internet services linked to your company.
86
00:04:41,240 --> 00:04:43,000
Make certificates as an example.
87
00:04:43,000 --> 00:04:47,080
When you visit a secure website, your browser checks a digital certificate to prove which
88
00:04:47,080 --> 00:04:49,360
site you reached and protect the connection.
89
00:04:49,360 --> 00:04:54,120
But certificates also leave public clues about names connected to a company, and ESM uses
90
00:04:54,120 --> 00:04:55,800
those clues as part of its view.
91
00:04:55,800 --> 00:04:57,680
It can also show connections that matter.
92
00:04:57,680 --> 00:05:02,040
A company domain may point to a website, which connects to a host, which uses a public IP
93
00:05:02,040 --> 00:05:04,320
address where a service might be answering.
94
00:05:04,320 --> 00:05:09,120
Looking at each item alone gives you a list, but seeing how they connect gives you context.
95
00:05:09,120 --> 00:05:14,480
Many people hear the word Defender, and assume ESM protects every device or blocks every attack,
96
00:05:14,480 --> 00:05:15,880
but it doesn't work that way.
97
00:05:15,880 --> 00:05:20,760
ESM doesn't replace a firewall, patch old software, or take the place of antivirus on laptops,
98
00:05:20,760 --> 00:05:23,480
email protection, or cloud security settings.
99
00:05:23,480 --> 00:05:28,760
Those tools handle different jobs, a firewall controls traffic, patching fixes software problems,
100
00:05:28,760 --> 00:05:31,600
and Microsoft Defender for Endpoint Protects devices.
101
00:05:31,600 --> 00:05:35,920
ESM helps you see what the public internet can find before you decide what needs fixing,
102
00:05:35,920 --> 00:05:36,920
removing or watching.
103
00:05:36,920 --> 00:05:37,960
You need both views.
104
00:05:37,960 --> 00:05:41,640
The tools inside your company can tell you about devices and services you already manage,
105
00:05:41,640 --> 00:05:45,080
but ESM starts from the outside and asks a different question.
106
00:05:45,080 --> 00:05:49,440
If someone knew nothing about your company except its public name, what could they discover?
107
00:05:49,440 --> 00:05:53,400
That outside view can uncover a service your internal inventory missed, and it can also
108
00:05:53,400 --> 00:05:57,320
confirm that an internet-facing application you already know about still looks the way
109
00:05:57,320 --> 00:05:59,280
you expect from the public side.
110
00:05:59,280 --> 00:06:00,440
And that difference matters.
111
00:06:00,440 --> 00:06:04,320
A long-asset list by itself can feel like more work, not more security.
112
00:06:04,320 --> 00:06:08,400
A useful part comes from how Defender ESM turns public clues into a connected picture that
113
00:06:08,400 --> 00:06:12,040
helps you separate the assets that belong to you from the ones that don't.
114
00:06:12,040 --> 00:06:13,520
How Discovery works?
115
00:06:13,520 --> 00:06:15,360
From one known clue to a map.
116
00:06:15,360 --> 00:06:19,000
So how does Defender ESM find things your company never put on a list?
117
00:06:19,000 --> 00:06:20,000
It starts with a seed.
118
00:06:20,000 --> 00:06:24,160
A seed is a known piece of public information that points ESM toward your company.
119
00:06:24,160 --> 00:06:25,800
It could be a domain like Contoso.
120
00:06:25,800 --> 00:06:31,480
Com, a public IP address, or range, a host name, an email contact, an autonomous system
121
00:06:31,480 --> 00:06:36,720
number, ASN for short, or a company name found in public domain registration details, an
122
00:06:36,720 --> 00:06:39,480
ASN sounds technical, but the idea is simple.
123
00:06:39,480 --> 00:06:43,640
Internet providers and large organizations use ASNs to identify the networks they run.
124
00:06:43,640 --> 00:06:47,280
So if your company owns part of a public network, that number can help point Discovery
125
00:06:47,280 --> 00:06:48,440
toward the right place.
126
00:06:48,440 --> 00:06:50,560
You don't need every seed before you begin.
127
00:06:50,560 --> 00:06:52,160
In fact, that would miss the point.
128
00:06:52,160 --> 00:06:56,240
You give Defender ESM the clues you already trust, and it uses public connections around
129
00:06:56,240 --> 00:06:58,320
those clues to build a wider picture.
130
00:06:58,320 --> 00:07:00,440
Imagine you know one public website address.
131
00:07:00,440 --> 00:07:05,200
Internet address might reveal a subdomain like portal, Contoso.com, and a public certificate
132
00:07:05,200 --> 00:07:08,400
connected to that subdomain may contain other names.
133
00:07:08,400 --> 00:07:12,200
One of those names can point to a host, which may connect to a public IP address where
134
00:07:12,200 --> 00:07:15,320
a web service or another internet facing service responds.
135
00:07:15,320 --> 00:07:17,040
Each clue leads to another clue.
136
00:07:17,040 --> 00:07:19,040
Microsoft calls this recursive discovery.
137
00:07:19,040 --> 00:07:23,400
In plain English, ESM finds a public relationship, checks where it leads, then keeps following
138
00:07:23,400 --> 00:07:27,080
connected information to figure out what likely belongs to your company.
139
00:07:27,080 --> 00:07:30,480
It doesn't need a company user account. It uses information that already appears on the
140
00:07:30,480 --> 00:07:36,800
public internet like domain records, certificates, host names, web content, and the public behavior
141
00:07:36,800 --> 00:07:38,200
of services.
142
00:07:38,200 --> 00:07:41,880
These are the same kinds of clues and outside researcher or an attacker can use to build
143
00:07:41,880 --> 00:07:42,880
a map.
144
00:07:42,880 --> 00:07:47,240
But finding a connection doesn't automatically prove ownership, and that part matters a lot.
145
00:07:47,240 --> 00:07:51,120
A public IP address might belong to a shared cloud provider, a certificate could include
146
00:07:51,120 --> 00:07:56,360
names for several customers, and a website may use a service run by a supplier.
147
00:07:56,360 --> 00:08:01,760
And a ESM helps you investigate those relationships, but your team still needs to decide what actually
148
00:08:01,760 --> 00:08:03,320
belongs to your company.
149
00:08:03,320 --> 00:08:06,800
Think about a business that uses a web agency for a short campaign.
150
00:08:06,800 --> 00:08:10,760
The campaign domain might point to systems owned by the agency, so some parts are yours,
151
00:08:10,760 --> 00:08:14,880
some belong to the agency, and some are shared services used by many customers.
152
00:08:14,880 --> 00:08:19,360
Treating every related item as your asset would create noise and confusion, so ESM gives
153
00:08:19,360 --> 00:08:21,560
you a starting point for that ownership conversation.
154
00:08:21,560 --> 00:08:24,280
You can create discovery groups to keep the search focused.
155
00:08:24,280 --> 00:08:28,160
A discovery group might cover your main company name, another could focus on a new brand
156
00:08:28,160 --> 00:08:33,040
or business unit, and you can also build a group around known domains and public IP ranges.
157
00:08:33,040 --> 00:08:37,040
That approach helps when a large company has separate teams and separate public services.
158
00:08:37,040 --> 00:08:41,320
Instead of one huge pile of results, you can ask more focused questions.
159
00:08:41,320 --> 00:08:43,760
What does the public internet show for this brand?
160
00:08:43,760 --> 00:08:45,600
What changed around this business unit?
161
00:08:45,600 --> 00:08:49,200
And which assets connect to the domains used by this product team?
162
00:08:49,200 --> 00:08:52,920
You can also exclude items that you already know don't belong in the inventory that doesn't
163
00:08:52,920 --> 00:08:54,320
erase the public record.
164
00:08:54,320 --> 00:08:57,960
It simply keeps your working view cleaner so your team can spend time on the assets they
165
00:08:57,960 --> 00:08:59,560
can actually manage.
166
00:08:59,560 --> 00:09:00,960
Discovery also isn't a one-time job.
167
00:09:00,960 --> 00:09:04,840
A company can launch a new public service on Monday, change a cloud setting on Wednesday,
168
00:09:04,840 --> 00:09:08,000
and retire a site on Friday without removing every public reference.
169
00:09:08,000 --> 00:09:12,040
The public footprint changes because the business changes, so a weekly recurring discovery
170
00:09:12,040 --> 00:09:15,160
schedule is a sensible starting point for many organizations.
171
00:09:15,160 --> 00:09:19,240
You can also run discovery once for a snapshot, but regular discovery keeps the inventory
172
00:09:19,240 --> 00:09:20,240
connected to real life.
173
00:09:20,240 --> 00:09:24,760
A new seed can lead to a new branch of public information, and boom, that's often where
174
00:09:24,760 --> 00:09:26,800
teams find something they didn't expect.
175
00:09:26,800 --> 00:09:30,320
Not because Defender EASM creates the asset, but because it connects clues that existed
176
00:09:30,320 --> 00:09:32,600
separately until someone looked at them together.
177
00:09:32,600 --> 00:09:34,880
Still, discovery only gives you the map.
178
00:09:34,880 --> 00:09:39,240
A map can show hundreds of domains, IP addresses, certificates, and services.
179
00:09:39,240 --> 00:09:41,000
The next question is harder.
180
00:09:41,000 --> 00:09:42,920
Which of those findings need attention first?
181
00:09:42,920 --> 00:09:45,360
What should your team actually do about them?
182
00:09:45,360 --> 00:09:46,680
From inventory to action?
183
00:09:46,680 --> 00:09:48,360
What EASM helps you spot?
184
00:09:48,360 --> 00:09:52,480
So once Defender EASM builds an inventory, you need to treat it as a living record, is
185
00:09:52,480 --> 00:09:53,880
not the final answer.
186
00:09:53,880 --> 00:09:58,600
Some items are recent, showing what EASM has seen as part of your current public footprint.
187
00:09:58,600 --> 00:09:59,960
Others are historic.
188
00:09:59,960 --> 00:10:03,760
They were visible at some point, but may no longer respond or connect the same way, even
189
00:10:03,760 --> 00:10:06,080
so that older records still has a purpose.
190
00:10:06,080 --> 00:10:10,960
Imagine an incident starts with a suspicious domain name or an IP address found in a log.
191
00:10:10,960 --> 00:10:15,520
A historic record can tell you that this address once connected to an old business service,
192
00:10:15,520 --> 00:10:19,920
even if that service disappeared months ago, that helps your team figure out who used it,
193
00:10:19,920 --> 00:10:23,000
what it did, and whether a related system might still exist.
194
00:10:23,000 --> 00:10:25,760
The inventory also keeps the links between items visible.
195
00:10:25,760 --> 00:10:27,880
A domain name may connect to a certificate.
196
00:10:27,880 --> 00:10:30,480
That certificate may connect to several host names.
197
00:10:30,480 --> 00:10:33,280
Those hosts can lead to public IP addresses and services.
198
00:10:33,280 --> 00:10:36,920
When you see that chain, you stop treating each result as a random technical detail.
199
00:10:36,920 --> 00:10:38,480
You can ask better questions.
200
00:10:38,480 --> 00:10:41,720
Does this public login page belong to the same team as the main website?
201
00:10:41,720 --> 00:10:44,320
Does this certificate point to an old product name?
202
00:10:44,320 --> 00:10:48,320
Is this exposed service part of an approved cloud setup or did someone leave it behind
203
00:10:48,320 --> 00:10:49,320
after a test?
204
00:10:49,320 --> 00:10:50,480
That's where observations come in.
205
00:10:50,480 --> 00:10:53,880
An observation is something defender EASM has noticed that may need review.
206
00:10:53,880 --> 00:10:57,760
It could be a forgotten subdomain in old web page still appearing online, a remote access
207
00:10:57,760 --> 00:11:01,560
service exposed to the public internet, or a setup choice that doesn't match your company
208
00:11:01,560 --> 00:11:02,560
rules.
209
00:11:02,560 --> 00:11:04,040
Certificates also need attention.
210
00:11:04,040 --> 00:11:07,560
An expired certificate can stop a website from loading properly and create warnings for
211
00:11:07,560 --> 00:11:08,560
users.
212
00:11:08,560 --> 00:11:12,040
A certificate that will expire soon gives the owner time to renew it before customers or
213
00:11:12,040 --> 00:11:14,160
staff run into a broken service.
214
00:11:14,160 --> 00:11:17,400
But EASM doesn't only collect technical names and dates.
215
00:11:17,400 --> 00:11:21,440
Microsoft uses virtual user technology to revisit public web content and check how a page
216
00:11:21,440 --> 00:11:22,920
behaves from the outside.
217
00:11:22,920 --> 00:11:27,200
Think of it as a fresh visitor arriving at the site, rather than relying only on an old record
218
00:11:27,200 --> 00:11:28,400
from months ago.
219
00:11:28,400 --> 00:11:32,240
That can show whether a page changed, whether it still loads and what public content or behavior
220
00:11:32,240 --> 00:11:33,400
it exposes.
221
00:11:33,400 --> 00:11:37,240
This gives security teams current evidence when they investigate a web facing asset.
222
00:11:37,240 --> 00:11:38,240
But here's the thing.
223
00:11:38,240 --> 00:11:39,760
Most people mess up at this point.
224
00:11:39,760 --> 00:11:43,120
This year long list of findings and treat every item as equally urgent.
225
00:11:43,120 --> 00:11:45,720
That creates a queue nobody can realistically work through.
226
00:11:45,720 --> 00:11:48,640
A public asset needs context before it becomes a priority.
227
00:11:48,640 --> 00:11:50,520
First, ask how exposed it is.
228
00:11:50,520 --> 00:11:54,680
A public administration page needs more care than a simple information page.
229
00:11:54,680 --> 00:11:57,520
Then ask whether there is a known weakness or unsafe setup.
230
00:11:57,520 --> 00:11:59,280
After that, look at business importance.
231
00:11:59,280 --> 00:12:02,840
A public customer portal and a forgotten event page don't carry the same risk even if
232
00:12:02,840 --> 00:12:04,560
both sit on the internet.
233
00:12:04,560 --> 00:12:05,960
Finally, find an owner.
234
00:12:05,960 --> 00:12:10,520
Without a named owner, a finding often moves from one team to another until nobody fixes it.
235
00:12:10,520 --> 00:12:14,320
Ownership turns a technical observation into a piece of work that someone can accept,
236
00:12:14,320 --> 00:12:15,920
change, remove or explain.
237
00:12:15,920 --> 00:12:16,920
Take a common example.
238
00:12:16,920 --> 00:12:19,440
The marketing team launches a campaign site for a new product.
239
00:12:19,440 --> 00:12:21,280
The campaign ends six months later.
240
00:12:21,280 --> 00:12:22,800
But the site remains online.
241
00:12:22,800 --> 00:12:24,640
The agency that built it has moved on.
242
00:12:24,640 --> 00:12:26,400
The internal project lead changed roles.
243
00:12:26,400 --> 00:12:31,080
The site runs an older version of its web software and it still shows a public login page.
244
00:12:31,080 --> 00:12:32,240
Nothing may have gone wrong yet.
245
00:12:32,240 --> 00:12:34,680
Still, this is the kind of asset that deserves a decision.
246
00:12:34,680 --> 00:12:35,800
Is it still needed?
247
00:12:35,800 --> 00:12:36,800
Who owns it?
248
00:12:36,800 --> 00:12:37,800
Can the software be updated?
249
00:12:37,800 --> 00:12:39,200
Should the login page stay public?
250
00:12:39,200 --> 00:12:40,800
Or should the site come down entirely?
251
00:12:40,800 --> 00:12:42,760
The action path can stay simple.
252
00:12:42,760 --> 00:12:44,280
Confirm who owns the asset.
253
00:12:44,280 --> 00:12:48,040
Decide whether it belongs to your company and whether it still has a business purpose.
254
00:12:48,040 --> 00:12:52,480
Then fix the problem, remove the asset, or keep watching it if it must stay public.
255
00:12:52,480 --> 00:12:56,160
Record that decision so the next person doesn't need to start the same investigation again.
256
00:12:56,160 --> 00:12:58,320
Not every discovery is an emergency.
257
00:12:58,320 --> 00:13:00,680
And not every public service should disappear.
258
00:13:00,680 --> 00:13:04,480
Your website, customer portal and public email service exist because people need to
259
00:13:04,480 --> 00:13:05,320
reach them.
260
00:13:05,320 --> 00:13:06,520
The goal is control.
261
00:13:06,520 --> 00:13:10,760
You want every visible asset to have a reason for being there, a person or team responsible
262
00:13:10,760 --> 00:13:13,120
for it and the right level of protection.
263
00:13:13,120 --> 00:13:17,160
Once that outside record exists, it can do more than support one security review.
264
00:13:17,160 --> 00:13:21,120
It can feed the teams already responding to alerts and managing risk across Microsoft security
265
00:13:21,120 --> 00:13:22,120
tools.
266
00:13:22,120 --> 00:13:24,760
How EASM fits into Microsoft security.
267
00:13:24,760 --> 00:13:28,120
Defender EASM becomes more useful when it connects with the security work your teams
268
00:13:28,120 --> 00:13:29,120
already do.
269
00:13:29,120 --> 00:13:31,360
Think of it as the outside patrol around your company.
270
00:13:31,360 --> 00:13:36,280
It watches what the public internet can reach while other Microsoft security tools help protect
271
00:13:36,280 --> 00:13:41,440
the people, devices, email and cloud services behind those public facing services.
272
00:13:41,440 --> 00:13:45,320
Microsoft Defender for endpoint focuses on devices such as laptops and servers.
273
00:13:45,320 --> 00:13:49,440
Microsoft Defender for Office 365 helps protect email and collaboration.
274
00:13:49,440 --> 00:13:54,720
Microsoft Defender for Cloud helps teams find and manage security issues in cloud workloads.
275
00:13:54,720 --> 00:13:56,360
Defender EASM adds a different view.
276
00:13:56,360 --> 00:14:00,400
It asks what is visible before an attacker reaches any of those systems.
277
00:14:00,400 --> 00:14:02,000
Security also belongs in this picture.
278
00:14:02,000 --> 00:14:05,040
Entra ID is the reception desk for your digital identity.
279
00:14:05,040 --> 00:14:09,680
It manages who signs in what they can access and how their account proves who they are.
280
00:14:09,680 --> 00:14:14,600
If an exposed application uses company sign-in, security teams may need to understand both sides.
281
00:14:14,600 --> 00:14:18,680
The public application that someone can reach and the identity controls protecting access
282
00:14:18,680 --> 00:14:19,960
after they arrive.
283
00:14:19,960 --> 00:14:21,720
These tools don't compete with each other.
284
00:14:21,720 --> 00:14:24,400
They cover different parts of the same company.
285
00:14:24,400 --> 00:14:27,800
Microsoft Security Exposure Management brings these views closer together.
286
00:14:27,800 --> 00:14:32,320
It gives security teams a broader picture of exposure across Microsoft security products
287
00:14:32,320 --> 00:14:36,320
so they can look beyond one alert or one device and see where risks connect.
288
00:14:36,320 --> 00:14:41,160
For example, a public facing server might appear in Defender EASM while cloud security data
289
00:14:41,160 --> 00:14:42,640
shows how that server is set up.
290
00:14:42,640 --> 00:14:46,920
A security team can use both pieces of information when deciding what to fix first.
291
00:14:46,920 --> 00:14:52,080
EASM can also send its findings to places where teams search and investigate security data.
292
00:14:52,080 --> 00:14:57,080
Through data connections, you can export asset data, attack surface insights, or both.
293
00:14:57,080 --> 00:15:02,880
Acid data means the discovered items such as domains, hosts, IP addresses and services.
294
00:15:02,880 --> 00:15:06,520
Attack surface insights mean the observations and risks connected to those items.
295
00:15:06,520 --> 00:15:08,200
One destination is log analytics.
296
00:15:08,200 --> 00:15:12,640
Log analytics is a place where you store and search data from Microsoft services.
297
00:15:12,640 --> 00:15:17,000
Security teams can use it to ask questions across many sources rather than opening a separate
298
00:15:17,000 --> 00:15:18,600
tool for every answer.
299
00:15:18,600 --> 00:15:20,720
Another destination is Azure Data Explorer.
300
00:15:20,720 --> 00:15:24,360
That is built for teams that need to store and query large amounts of data quickly,
301
00:15:24,360 --> 00:15:28,520
especially when they want to build their own reports or combine EASM data with other records.
302
00:15:28,520 --> 00:15:30,640
Microsoft Sentinel can use that exported data too.
303
00:15:30,640 --> 00:15:33,480
Sentinel is Microsoft's Security Operations Platform.
304
00:15:33,480 --> 00:15:39,480
It collects security signals, helps analysts investigate incidents, and can trigger follow-up actions through playbooks.
305
00:15:39,480 --> 00:15:45,640
When EASM findings appear alongside alerts and logs, an analyst can quickly check whether an incident involves a public facing asset,
306
00:15:45,640 --> 00:15:49,880
what else connects to it, and whether the asset already carried a known concern.
307
00:15:49,880 --> 00:15:52,280
That can reduce guesswork during an investigation.
308
00:15:52,280 --> 00:15:55,200
Security co-pilot adds another way to work with the data.
309
00:15:55,200 --> 00:15:59,040
Instead of searching through lists manually, you can ask questions in plain English.
310
00:15:59,040 --> 00:16:02,680
You might ask which internet facing assets connect to a certain domain,
311
00:16:02,680 --> 00:16:09,040
what observations exist for a public service, or where a newly found host fits in the company's public footprint.
312
00:16:09,040 --> 00:16:11,600
Co-pilot doesn't replace the need for human review.
313
00:16:11,600 --> 00:16:19,040
It helps teams get to the right questions faster, while the people responsible for security still decide what the findings mean and what action makes sense.
314
00:16:19,040 --> 00:16:23,920
You don't need every connection on day one. Start by making the outside view part of your regular security routine.
315
00:16:23,920 --> 00:16:28,880
Then let the process become more useful as your inventory, ownership records, and incident workflows improve.
316
00:16:28,880 --> 00:16:30,320
A simple starting plan.
317
00:16:30,320 --> 00:16:31,960
Start with what you already know.
318
00:16:31,960 --> 00:16:34,800
Your main company domains and approved public IP ranges.
319
00:16:34,800 --> 00:16:39,160
If you know the public names used by a brand, product, or business unit, add those two.
320
00:16:39,160 --> 00:16:42,480
Create a discovery group and let the inventory build over time.
321
00:16:42,480 --> 00:16:46,080
The first results will include items your team recognizes right away.
322
00:16:46,080 --> 00:16:47,920
Plus some assets that need a closer look.
323
00:16:47,920 --> 00:16:49,800
Now bring the right people into that review.
324
00:16:49,800 --> 00:16:51,640
Your website team knows the public pages.
325
00:16:51,640 --> 00:16:53,360
Your cloud team recognizes the hosts.
326
00:16:53,360 --> 00:16:55,760
Network staff can identify IP addresses.
327
00:16:55,760 --> 00:16:57,760
Security helps judge the exposure.
328
00:16:57,760 --> 00:17:00,720
A supplier may need to confirm if they run part of the service.
329
00:17:00,720 --> 00:17:02,080
Label the result clearly.
330
00:17:02,080 --> 00:17:06,120
Market as owned, shared, no longer needed, or outside company control.
331
00:17:06,120 --> 00:17:10,840
That simple decision stops the same unknown asset from coming back as a mystery every few months.
332
00:17:10,840 --> 00:17:14,040
Set a regular discovery schedule and a regular review meeting.
333
00:17:14,040 --> 00:17:16,000
Then turn findings into small actions.
334
00:17:16,000 --> 00:17:20,160
Close and expose service that shouldn't be public, renew a certificate before it expires,
335
00:17:20,160 --> 00:17:22,840
or remove a site that no longer needs to be online.
336
00:17:22,840 --> 00:17:28,200
Over time, your team gets fewer surprises when a new public service appears or an incident begins.
337
00:17:28,200 --> 00:17:33,000
Microsoft Defender ESM helps you see the public facing parts of your company before an attacker
338
00:17:33,000 --> 00:17:35,120
turns an overlooked asset into a target.
339
00:17:35,120 --> 00:17:37,280
Think of it as watching the outside of your building.
340
00:17:37,280 --> 00:17:39,640
You want to know what's exposed before someone else does.
341
00:17:39,640 --> 00:17:40,880
Here's a simple challenge.
342
00:17:40,880 --> 00:17:43,560
Write down three public domains your company uses.
343
00:17:43,560 --> 00:17:48,040
For each one, ask who owns it, why it needs to stay online, and who would fix it if something
344
00:17:48,040 --> 00:17:49,120
changed tomorrow.
345
00:17:49,120 --> 00:17:51,160
That exercise reveals where the gaps are.
346
00:17:51,160 --> 00:17:55,040
For the next knowledge nugget, keep building the full Microsoft Security picture with Defender
347
00:17:55,040 --> 00:17:57,440
and Microsoft Security Exposure Management.
348
00:17:57,440 --> 00:18:00,200
The public view tells you what strangers can find.
349
00:18:00,200 --> 00:18:03,120
The inside tools help you understand what those public services can reach.
