PLATFORM NOTES · MICROSOFT

Microsoft Defender EASM: CAASM and asset inventory facts (2026)

SHORT ANSWER

Microsoft Defender EASM is the easiest outside-in start here: a prebuilt inventory, recursive discovery from seeds, a 30-day free trial and billing on the Azure bill, with confidence-based asset states. It covers external assets only, describes no built-in remediation workflow, and does not support cross-tenant resource access.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

Visit Defender EASM's site

Which approaches does Defender EASM describe?

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

From Defender EASM's own pages.
Approach	Status	What the pages say	Source
CAASM aggregation	Not in our sources	Not described on the pages we read.	None
Agent-based inventory	Not in our sources	Not described on the pages we read.	None
External attack surface management	Described	A prebuilt inventory for many organisations plus recursive discovery from seeds you supply.	Source: Microsoft Learn: what is discovery · Read 27 Sep 2026
CMDB-centred inventory	Not in our sources	Not described on the pages we read.	None
Exposure management	With a condition	Dashboards for vulnerabilities, compliance and hygiene on external assets; remediation happens downstream through Log Analytics and Azure Data Explorer.	Source: Microsoft Learn: data connections · Read 27 Sep 2026

Which parts of an estate does Defender EASM cover?

Estate coverage described on Defender EASM's pages.
Servers and network devices	Not in our sources
Cloud workloads	Not in our sources
SaaS applications	Not in our sources
Identities as assets	Not in our sources
Off-network laptops	Not in our sources
OT and IoT devices	Not in our sources
Internet-facing discovery	Matches Prebuilt inventory and recursive discovery from seeds. Source: Microsoft Learn: what is discovery · Read 27 Sep 2026

How does Defender EASM collect and reconcile data?

Collection and reconciliation described on Defender EASM's pages.
Deployment	An Azure resource. Cross-tenant resource access, including Azure Lighthouse, is not supported. Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026
Offers its own agent	Not in our sources
Works without new agents	Matches An Azure service that discovers from seeds and a prebuilt inventory. Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026
Merges records from several sources	Not in our sources
Integrations	Data connections to Log Analytics and Azure Data Explorer, and a Security Copilot integration in preview. Source: Microsoft Learn: data connections · Read 27 Sep 2026

What does Defender EASM do with the inventory?

What Defender EASM's pages describe doing with asset data.
Feeds or updates a CMDB	Not in our sources
Cross-source queries and reports	Partly Dashboards for vulnerabilities, compliance and hygiene. Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026
Workflows, tickets or actions	Partly Data connections to Log Analytics and Azure Data Explorer trigger remediation actions downstream. Source: Microsoft Learn: data connections · Read 27 Sep 2026
Platform it is part of	Microsoft: Native to Azure, billed on the Azure bill, with a Security Copilot integration in preview. Source: Microsoft Learn: Defender EASM documentation · Read 27 Sep 2026
Platforms it connects to	None in our sources

What does Defender EASM cost?

Billed through Azure on billable assets (approved host:IP combinations, domains and IP addresses) after a 30-day free trial. Microsoft's pricing page did not show a rate when we read it; check it for the current figure.

Source: Microsoft Learn: understanding billable assets · Read 27 Sep 2026

Free tier or trial Matches A 30-day free trial, then Azure billing.

Source: Microsoft Learn: understanding billable assets · Read 27 Sep 2026

Where is Defender EASM strong, and where are its limits?

Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.

Strengths

The easiest start for an outside-in view: a prebuilt inventory, a 30-day free trial and billing on the Azure bill.
Confidence-based asset states (Approved Inventory, Dependency, Monitor Only, Candidate, Requires Investigation) make doubtful matches visible.
Data connections to Log Analytics and Azure Data Explorer for teams already working in Azure.

Limits

External assets only: internal devices, SaaS apps and identities are not covered.
No built-in remediation workflow, and no cross-tenant resource access for groups with several Azure tenants.

What does Defender EASM say about itself?

No vendor figures are quoted in these notes.

What has Defender EASM announced recently?

No dated announcements in our sources.

Who should shortlist Defender EASM?

Consider Defender EASM if you are on Azure and want an external inventory without a sales call, or if you want an outside-in baseline before choosing an inventory platform.

In our example finder profiles, Defender EASM is in the first group for: azure team worried about what faces the internet.

Run the finder with your answers

How does Defender EASM compare with each other vendor?

Questions people ask

Does Defender EASM need an agent?

Own agent: Not in our sources. Works without new agents: Matches. An Azure service that discovers from seeds and a prebuilt inventory.

Does Defender EASM work with a CMDB?

Not in our sources. Not described on the pages we read.

Does Defender EASM publish its prices?