Which Defender Service Includes Microsoft Secure Score for Devices?

Why the Answer Is Correct

Microsoft Secure Score for Devices is a device-focused measure of how well your endpoints are hardened, and it is delivered as part of Microsoft Defender for Endpoint's vulnerability management capability (now Defender Vulnerability Management). The score is visible in the Defender Vulnerability Management dashboard inside the Microsoft Defender portal and rolls up the configuration state of onboarded devices. Because the metric depends on device onboarding, telemetry and vulnerability data that only Defender for Endpoint collects, no other Defender workload can produce it. The SC-900 objective of mapping security capabilities to the right Defender service therefore points squarely at option B.

Why the Other Options Are Wrong

Microsoft Defender for IoT (A) secures operational technology and unmanaged IoT/OT devices and reports through its own inventory and alert views, not Secure Score for Devices. Microsoft Defender for Identity (C) monitors on-premises Active Directory signals such as lateral movement and recon, and it contributes to the overall Microsoft Secure Score but never to the device-level score. Microsoft Defender for Office 365 (D) protects email, Teams and collaboration workloads with its own threat and configuration posture, again without a device vulnerability score. Only Defender for Endpoint combines endpoint onboarding, vulnerability management and the device hardening recommendations that feed Secure Score for Devices.

Community Comment Notes

Consensus on the page is unanimous at 100% for option B, and no commenter argues for the other three workloads. LegendaryZA, KindFlame and TechyStacy simply record "Microsoft Defender for Endpoint" as their pick, which matches the official mapping. chiliman adds useful nuance, stating that Microsoft Secure Score for Devices is "included as part of Microsoft Defender Vulnerability Management" and is viewed in the Defender Vulnerability Management dashboard of the Microsoft Defender portal, tied to Defender for Endpoint Plan 2 onboarding. That detail is worth remembering: on SC-900, the phrase "for Devices" is the signal that points to the endpoint workload.