SAMPLE-DEF-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Microsoft Defender and Secure Score Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Email protection, endpoint onboarding, attack surface reduction, identity coverage and incident handling for one fictional tenant of 160 devices.
Executive summary
The tenant scores reasonably, but some of that score comes from accepted risks with no recorded reason. A quarter of devices are not onboarded, attack surface reduction rules run in audit only, and many incidents have no owner.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Secure Score action list | All actions with status | Provided |
| E-02 | Preset security policy assignments | Standard and custom policies | Provided |
| E-03 | Onboarded device list | 160 devices expected, onboarded count | Provided |
| E-04 | ASR rule status export | Rules and modes | Provided |
| E-05 | Incident list, 90 days | All incidents with owner and status | Provided |
| E-06 | Licence summary | Plans in use | Provided |
What was not checked
- Individual alert detail
- Mail flow rules
- Threat hunting queries
- Defender for Cloud and cloud app security
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | 38 of 160 devices are not onboarded to Defender for Endpoint | E-03 | Onboard the missing devices or document why each is excluded. |
| F-02 | High | All attack surface reduction rules are in audit mode and have not been reviewed | E-04 | Review audit results and move the standard protection rules to block, as Microsoft recommends. |
| F-03 | Medium | 14 incidents open for over 30 days with no owner | E-05 | Assign owners, close stale incidents with a classification, and set notifications. |
| F-04 | Medium | Preset security policies cover a pilot group only; custom policies cover the rest inconsistently | E-02 | Decide on Standard or Strict presets for each group and retire overlapping custom policies. |
| F-05 | Medium | 6 Secure Score actions marked accepted risk with no reason recorded | E-01 | Record the reason and an owner for each, or complete the action. |
| F-06 | Low | Defender for Identity is licensed but not deployed on 1 of 3 domain controllers | E-06 | Deploy it on the remaining controller or record why not. |
Fix first
- Onboard or document the 38 missing devices Effort: Medium.
- Review and move ASR rules from audit to block Effort: Medium.
- Assign owners to open incidents Effort: Low.
- Rationalise preset and custom email policies Effort: Medium.
- Record reasons for accepted risks Effort: Low.
30/60/90-day plan
- First 30 days: Assign incident owners; record reasons for accepted risks; review ASR audit results.
- By 60 days: Onboard missing devices; move standard ASR rules to block; settle preset policies.
- By 90 days: Deploy Defender for Identity on the last controller; set a monthly Secure Score and incident review.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.