DeviceTvmSecureConfigurationAssessment

Important

The improved Microsoft 365 security center is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new.

Applies to:

  • Microsoft 365 Defender
  • Microsoft Defender for Endpoint

Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration from Threat & Vulnerability Management. Use this reference to check the latest assessment results and determine whether devices are compliant.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
DeviceId string Unique identifier for the device in the service
DeviceName string Fully qualified domain name (FQDN) of the device
OSPlatform string Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.
Timestamp datetime Date and time when the record was generated
ConfigurationId string Unique identifier for a specific configuration
ConfigurationCategory string Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls
ConfigurationSubcategory string Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features.
ConfigurationImpact string Rated impact of the configuration to the overall configuration score (1-10)
IsCompliant boolean Indicates whether the configuration or policy is properly configured
IsApplicable boolean Indicates whether the configuration or policy applies to the device
Context string Additional contextual information about the configuration or policy
IsExpectedUserImpact boolean Indicates whether there will be user impact if the configuration or policy is applied