Software usage insights
Applies to:
- Microsoft Defender Vulnerability Management
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender XDR
- Microsoft Defender for Servers Plan 1 & 2
Important
Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
Defender Vulnerability Management software usage information gives you insights into the total number of devices using an application in your organization and the median usage (in days) for that application over the past 30 days.
Software usage information is critical when it comes to evaluating software vulnerabilities in your organization. When vulnerable applications are widely and frequently used, it poses a security risk. These insights can help organizations understand the potential affect of blocking vulnerable applications.
Tip
Did you know you can try all the features in Microsoft Defender Vulnerability Management for free? Find out how to sign up for a free trial.
Minimum requirements
Microsoft Defender Antivirus (active or passive mode): The detection of file execution events requires Microsoft Defender Antivirus to be enabled in active or passive mode. To learn more, see Deploy Microsoft Defender Antivirus.
View software usage information
Daily software usage is calculated from process events collected by the core endpoint detection and response service for all onboarded devices. Software usage information can be viewed through the following experiences in the Microsoft Defender portal.
Software inventory view
You can view software usage by selecting an application in the software inventory page. A flyout panel will open with more details including data related to that software's usage over the past 30 days.
Software page view
Software usage for a specific application is also available in the software page. To view the software page:
- Go to Vulnerability management > Software inventory
- Select an application from the list
- Select Open software page in the flyout
The Software page opens with the software usage information displayed on the Overview tab:
Select the Installed devices tab to see the number of days the software was in use, per device, in the last 30 days.
You can also view Software usage (days) on the Version distribution tab in the software page.
Security recommendations page
Software usage insights can be helpful to determine the overall impact of a vulnerability. To view the Software usage insights when reviewing security recommendations:
- Go to Vulnerability management > Recommendations
- Select an application from the list
The Recommendations page opens with the software usage information displayed:
Note
If you don't see usage insights, it's because that application is currently not supported. Software usage is currently not supported for:
- Software usage related to operating systems
- Software usage related to apps for macOS and Linux
- Software usage for apps where Microsoft does not have sufficient information about the application