Microsoft Defender Integration for Security Exposure Management

concept australia Updated Sep 10, 2026 2 min read ms-defender-sem.md

The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.

The Microsoft Defender Integration for Security Exposure Management application replaces the standalone Microsoft Defender for Cloud Integration for Security Operations application.
If you're upgrading from the standalone application, see Migrate from the standalone Microsoft Defender for Cloud Integration to the Microsoft Defender Integration for Security Exposure Management.

Note: The integrations support commercial cloud environments by default. If you require non-commercial support (GCC High, DoD, etc.), see the Non-commercial configuration for Microsoft Defender Integration for Security Exposure Management Knowledge Base article [KB3141167] for more information.

The Microsoft Defender Integration for Security Exposure Management application bundles two independent integrations, each with its own configuration steps and distinct API URLs:

Microsoft Threat and Vulnerability Management (MS TVM)

Imports vulnerability data, security recommendations, and asset information. Use this data to prioritize and remediate vulnerabilities across your environment. For configuration instructions, see Understanding the Microsoft Threat and Vulnerability Management Vulnerability integrations for Security Exposure Management and Install and configure the Microsoft TVM integrations for Security Exposure Management.
Microsoft Defender for Cloud

Imports cloud resource misconfigurations, security assessment findings, compliance assessment data, and container image vulnerabilities. Use this data to manage your cloud security posture. For configuration instructions, see Understanding the Microsoft Defender for Cloud integrations for Security Exposure Management and Install and configure Microsoft Defender for Cloud integrations for Security Exposure Management.

To view the integrations included with this application, navigate to All > Microsoft Defender Integration for USEM > Administration > Integrations.

37 lines · 3.8 KB Wrap lines

---
title: Microsoft Defender Integration for Security Exposure Management
description: The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/ms-defender-sem.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Microsoft Defender Integration for Security Exposure Management

The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.

-   The Microsoft Defender Integration for Security Exposure Management application replaces the standalone Microsoft Defender for Cloud Integration for Security Operations application.
-   If you're upgrading from the standalone application, see [Migrate from the standalone Microsoft Defender for Cloud Integration to the Microsoft Defender Integration for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/mstvm-migrate.md).

**Note:** The integrations support commercial cloud environments by default. If you require non-commercial support \(GCC High, DoD, etc.\), see the [Non-commercial configuration for Microsoft Defender Integration for Security Exposure Management](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3141167) Knowledge Base article \[KB3141167\] for more information.

The Microsoft Defender Integration for Security Exposure Management application bundles two independent integrations, each with its own configuration steps and distinct API URLs:

-   **Microsoft Threat and Vulnerability Management \(MS TVM\)**

    Imports vulnerability data, security recommendations, and asset information. Use this data to prioritize and remediate vulnerabilities across your environment. For configuration instructions, see [Understanding the Microsoft Threat and Vulnerability Management Vulnerability integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/mstvm-integration.md) and [Install and configure the Microsoft TVM integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/mstvm-install-and-configure.md).

-   **Microsoft Defender for Cloud**

    Imports cloud resource misconfigurations, security assessment findings, compliance assessment data, and container image vulnerabilities. Use this data to manage your cloud security posture. For configuration instructions, see [Understanding the Microsoft Defender for Cloud integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/cc_asc_overview.md) and [Install and configure Microsoft Defender for Cloud integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/cc_asc_install_configure.md).


To view the integrations included with this application, navigate to **All** &gt; **Microsoft Defender Integration for USEM** &gt; **Administration** &gt; **Integrations**.