Why a status check?
Buyers ask whether Microsoft is still investing in Defender EASM. We can only report what the public documentation says. The Defender EASM documentation landing page we read in September 2026 had been updated on 18 May 2026, carried no retirement notice and listed a Security Copilot integration in preview.
What does it do well?
- Starting. Microsoft offers a prebuilt inventory for many organizations, and discovery can also start from seeds such as domains, IP blocks, hosts, email contacts, ASNs and Whois organizations.
- Classifying. Every asset carries a state: Approved Inventory, Dependency, Monitor Only, Candidate or Requires Investigation, based on how strongly it connects to the organization.
- Buying. Billing runs through Azure on billable assets (approved host and IP combinations, domains and IP addresses) after a 30-day free trial. The per-asset rate is on Microsoft's pricing page; our read of that page did not capture a figure, so we do not quote one.
What does it leave to you?
- Proof. The dashboards cover vulnerabilities, compliance and security hygiene. No exploitability testing is documented.
- Containment. No compensating control is documented.
- The fix loop. Findings export to Log Analytics and Azure Data Explorer through data connections, where you can trigger remediation actions downstream. Ticketing and retesting are yours to build.
- Multi-tenant groups. The documentation says there is no cross-tenant resource access, including through Azure Lighthouse. Groups whose subsidiaries sit in separate Azure tenants should plan for that.
Who does it suit?
Azure-first teams that want an external inventory they can try this week and pay for on the Azure bill, and that already have a SIEM and workflow tooling to act on what it finds. It is a sensible first step and a weak last step.
How does it score here?
Microsoft Defender EASM holds the top score on buying transparency and the lowest on proof and on closing the loop, which places it tenth on our weights. If your weights put buying first, the calculator will move it up.