Strengthening Endpoint Security: Microsoft’s New Vulnerability Remediation Agent for Intune

When we first wrote about the Vulnerability Remediation Agent for Intune, Microsoft had only announced it. It is now available in the Microsoft Intune admin center as a Security Copilot agent, and Microsoft still lists it as a public preview feature (checked October 2026). This post covers what the agent does today, what it needs, and where it fits in an endpoint security routine.

What Is the Vulnerability Remediation Agent?

The agent uses data from Microsoft Defender Vulnerability Management to find Common Vulnerabilities and Exposures (CVEs) on your managed devices. It ranks them for remediation and gives step-by-step guidance for fixing each one with Intune. You open it from the Intune admin center, under either Agents or Endpoint security.

For each suggestion, the agent shows the number of associated CVEs, a Copilot-assisted summary of the impact, the affected systems and exposed devices, and suggested actions. Where it helps, it also lists settings catalog configurations you can deploy to reduce the attack surface.

One point is easy to miss: the agent advises, it does not act. Your administrators deploy the fix through Intune, then mark the suggestion as applied. Marking a suggestion as applied makes no change on any device. It simply records when the remediation was done, so later runs can be compared against it.

How It Prioritizes

The agent weighs factors such as CVSS scores, exposure impact and device count, so the most critical issues come first. Its guidance usually falls into two groups:

• Apps: deploy an updated app version, or an Intune profile that limits risky app behaviour.
• Operating system: deploy a quality update policy, with guidance on using update rings for a controlled rollout. When a CVE scores 9.0 or higher on CVSS, the suggestion starts with "Expedite" and explains how to push the update quickly with an expedite policy.

What You Need Before You Turn It On

• Licences: Microsoft Intune Plan 1, Microsoft Security Copilot with enough security compute units (SCUs), and Microsoft Defender Vulnerability Management (included with Defender for Endpoint P2, or as a standalone product).
• Plugins: the Microsoft Intune and Microsoft Defender plugins in Security Copilot.
• Identity and permissions: during setup, the agent creates its own agentic identity in Microsoft Entra ID. You then delegate read permissions to it in the Entra and Defender admin centers and pass the Run Readiness Check before it can run.
• Scope: it covers Windows devices and apps in Intune. Windows Server editions are not included, and it supports only the public cloud, not government clouds. Scope tags are not supported during the preview.

Two operational notes from Microsoft's documentation: once a run starts it cannot be paused or stopped, and admins with access to the Intune admin center can see the agent's suggestions even for devices outside their assigned roles or scope. Plan who gets access accordingly.

Where It Fits

The agent shortens the gap between "Defender found a vulnerability" and "we know what to deploy in Intune". It does not replace a patching routine, change control or testing. The organizations that get the most from it already have update rings, a settings catalog baseline and a clear owner for each fix. If that groundwork is still missing, start there; our post on patch management as a service covers it. To see your Intune estate more clearly before and after remediation, read From Noise to Clarity: Intune dashboards.

Because Windows Server is out of scope, servers still need their own patching and lifecycle plan. If some of yours are still on Windows Server 2012 R2, see Windows Server 2012 R2 after October 13. For more on Copilot across Intune, Defender and Azure, see Enhancing IT Operations with Microsoft Copilot.

How BITSUMMIT Helps

We help organizations get Intune, Defender and Microsoft 365 working together:

• Readiness: checking licences, Security Copilot capacity, plugins and the agent's permissions before you switch it on.
• Foundations: setting up update rings, quality update and expedite policies, and settings catalog baselines, so the agent's guidance has somewhere to land.
• Process: agreeing who reviews suggestions, who deploys fixes, and how applied remediations are tracked over time.
• Enablement: training your IT team to run the cycle themselves.

Talk to a Senior Engineer

If you are weighing the Vulnerability Remediation Agent or tightening how vulnerabilities get fixed across your endpoints, talk to a senior engineer about your Intune and Defender setup.