Microsoft Secure Score: New AI-readiness recommendations for device security

Microsoft Secure Score will add four new AI-readiness recommendations for device security in Microsoft Defender for Endpoint, focusing on TPM 2.0, VBS, HVCI, and LAPS. These will help identify and remediate devices lacking key protections, rolling out from early to late September 2026 with no action required to receive them. Microsoft is adding four new Microsoft Secure Score recommendations in Microsoft Defender for Endpoint to help organizations assess device readiness for AI accelerated threats and strengthen foundational device security. The new recommendations identify eligible Windows devices that do not have key security capabilities enabled: Trusted Platform Module (TPM) 2.0 Virtualization-based Security (VBS) Hypervisor-Protected Code Integrity (HVCI), also known as Memory Integrity Windows Local Administrator Password Solution (LAPS) These capabilities help protect credentials, improve platform integrity, and strengthen device security. The new recommendations provide visibility into devices that do not meet these security baselines so administrators can prioritize remediation and track improvement over time. Rollout schedule Public Preview: Beginning in early September 2026 and expected to complete by mid-September 2026 General Availability (Worldwide, GCC, GCC High, DoD): Beginning in mid-September 2026 and expected to complete by late September 2026 Impact on your organization Who is affected Administrators who manage Microsoft Defender for Endpoint and monitor Microsoft Secure Score Organizations with Windows devices onboarded to Microsoft Defender for Endpoint that are eligible for TPM 2.0, VBS, HVCI, or LAPS Platforms and services Microsoft Defender for Endpoint Microsoft Secure Score in the Microsoft Defender portal Windows devices onboarded to Microsoft Defender for Endpoint What will happen Four new recommendations will be added to Microsoft Secure Score: Ensure that TPM 2.0 is present, enabled, and activated Enable Virtualization-based Security (VBS) Enable Memory Integrity (HVCI) Ensure LAPS is enabled on every endpoint and server The recommendations will: Identify eligible devices where TPM 2.0, VBS, HVCI, or LAPS are not enabled. Help administrators prioritize remediation activities. Reflect progress in Secure Score as eligible devices are brought into compliance. Appear automatically and require no configuration. Because these are new Secure Score recommendations, your available points and overall Secure Score percentage may change after the rollout. Action required […]

The post Microsoft Secure Score: New AI-readiness recommendations for device security appeared first on M365 Admin.