Microsoft Defender Vulnerability Management now assesses vulnerabilities in selected applications installed through the Microsoft Store. Microsoft lists general availability in its October 2026 updates. For businesses with 10 to 250 employees already using Defender for vulnerability management, the task is practical: review Store applications, identify affected versions, and check the outcome after updating them. Distinguish actual assessment from an application’s mere presence in the software inventory.
What the new assessment provides for Store apps
According to Microsoft, Defender detects supported Store applications, adds them to the software inventory, and assesses them for vulnerabilities. The associated CVE evidence includes a Microsoft Store tag. A suggested query shows the vulnerable application, its version, and its file location. This gives administrators a more specific way to connect a finding to installed software rather than working from a product name alone.
The capability extends coverage without replacing a complete software inventory. Microsoft explicitly limits assessment to selected, commonly used Store applications. Check the relevant inventory entry to establish whether an application is supported. Organizations operating Microsoft Defender should not interpret this announcement as assurance that every Store package receives vulnerability assessment.
Which coverage limits remain visible in the inventory
The software inventory can also display applications that vulnerability management does not support. Microsoft documents visible indicators for these entries. Missing assessment data must not be interpreted as confirmation that software is free of vulnerabilities. In everyday reviews, the following distinctions are particularly important:
- For unsupported software, the Weaknesses field shows Not available, rather than a confirmed count of zero vulnerabilities.
- The exposed-devices field can show a dash; the presence of an inventory entry alone does not establish complete assessment coverage.
- According to Microsoft, unsupported software pages do not include security recommendations, discovered vulnerabilities, or event timeline sections.
- Store assessment covers selected applications only; it is not a coverage commitment for the entire Microsoft Store.
Deadlines and availability: distinguish the facts
Microsoft’s update page specifies October 2026 and general availability, but does not identify a particular launch day. Both Learn pages used here were updated within the last 14 days. Microsoft does not give a mandatory activation deadline or a general retirement date for this capability. The appropriate response is an inventory check within existing operations, not an urgent redesign based on an invented cutoff.
Allow time for the follow-up check. According to Microsoft, overview data updates every three to four hours; synchronization cannot currently be forced. An unchanged entry immediately after an application update therefore does not establish that remediation has failed. Keep the update and the later inventory check distinct.
Read the evidence without manually changing app files
Microsoft documents two navigation routes to the software inventory. Existing customers use Endpoints > Vulnerability management > Inventories. For the specified XDR/Identity preview experience, the route is Exposure management > Vulnerability management > Inventories. Then select the Software tab. Different menu layouts do not automatically indicate that the capability is broken or unavailable.
The software page and Software evidence area explain a finding through its version and path. However, the path is evidence, not a repair instruction. Microsoft warns against directly accessing or managing app files in WindowsApps because this can cause operating system issues. Manage application versions through the Microsoft Store instead. Manually deleting files is not a substitute for documented version management.
Concrete next steps for a small IT team
We recommend a limited review with clear ownership. The following sequence is ReByteIT’s operational recommendation based on the documented Microsoft capabilities, not an additional requirement imposed by Microsoft:
- Open the software inventory with the intended working account and review Store applications actually used in your organization.
- Distinguish supported assessments from entries marked Not available; explicitly record where assessment coverage is missing.
- For a finding, review the CVE evidence, Store tag, affected version, and suggested query together rather than in isolation.
- Identify the affected devices and assign responsibility for updating the application, rather than forwarding only its product name.
- Manage the application version through the Microsoft Store, without directly changing files located under
WindowsApps. - Check the finding again after the inventory updates; use the documented Report inaccuracy function when assessment data appears inconsistent.
Official Microsoft sources
- Microsoft Learn: Defender for Endpoint updates, October 2026
- Microsoft Learn: software inventory, Store applications, and assessment limits
Our Microsoft Security Assessment reviews your technical Defender workflows and verifiable remediation steps. You can book a discussion to assess your current environment; this does not include a licensing recommendation.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
