Security reports

15 reports belong to the Security area. An API or MCP client sees them when it holds a grant for this area. Kind: a findings list rates each row by severity; a table lists objects. Data: Cached opens at once, On demand reads Microsoft 365 when first opened, Scan runs on request.

Tenant

Report	The question it answers	Kind	Data
Defender Alerts	Which alerts did Microsoft Defender raise in the last 30 days, from which source, and which are still open?	Table	Cached
Phishing Simulation Results	Who clicks or gives away credentials in phishing simulations, who does it again, and who has overdue training?	Table	Cached
Secure Score & Top Improvement Actions	Where does the tenant stand on Microsoft Secure Score, how did it move, and which controls give the most points for the least effort?	Table · dashboard tile	Cached
Security Alerts & Incidents	Which Microsoft Defender incidents of the last 30 days are still open, how severe are they, and which has nobody picked up?	Table · dashboard tile	Cached

Tenant › Defender & Security Operations

Report	The question it answers	Kind	Data
Azure Subscription Owners & Root Elevation	Who holds Owner on Azure subscriptions, management groups or the root, including guests, service principals and stale assignments?	Findings list · dashboard tile	On demand
Browser Extensions & Their Permissions	Which browser extensions are installed on managed devices, and which can read all sites, cookies or downloads?	Findings list · dashboard tile	On demand
Defender for Endpoint Onboarding Gaps	Which Intune-managed devices are not onboarded to Defender for Endpoint, or have an inactive or impaired sensor?	Findings list · dashboard tile	On demand
Defender for Identity Sensor Health	Are the Defender for Identity sensors running, and which health issues are open?	Findings list · dashboard tile	On demand
Device Hardening Gaps (Secure Configuration Assessment)	Which device hardening settings fail on the most devices, ranked by impact?	Findings list · dashboard tile	On demand
Exposed Devices & Exploitable Vulnerabilities	Which vulnerabilities affect the most devices, and which of them have public exploits?	Findings list · dashboard tile	On demand
Global Secure Access Health	Are Global Secure Access forwarding profiles enabled and branch tunnels up?	Findings list · dashboard tile	On demand
Malicious-link Clicks & Mail ZAP Did Not Remove (30 days)	Who clicked malicious links in the last 30 days, and which malicious mail did zero-hour auto purge not remove?	Findings list · dashboard tile	On demand
Removable Storage (USB) Activity (30 days)	Which devices mounted USB drives in the last 30 days, and how many files were copied to them?	Findings list · dashboard tile	On demand
Shadow SaaS from Defender for Cloud Apps (30 days)	Which cloud apps did Defender for Cloud Apps discover in the last 30 days, with how many users, how much upload and what risk?	Findings list · dashboard tile	On demand
Tenant Configuration Drift	Which tenant settings have drifted from the approved baseline, and since when?	Findings list · dashboard tile	On demand