---
title: Understanding the Microsoft Defender for Cloud integrations for Security Exposure Management
description: The Microsoft Defender for Cloud integrations included with the Microsoft Defender Integration for Security Exposure Management application import cloud misconfiguration findings, compliance data, and container image vulnerabilities.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/cc\_asc\_overview.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-07-16"
reading_time_minutes: 2
breadcrumb: [Microsoft Defender Integration for Security Exposure Management, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Understanding the Microsoft Defender for Cloud integrations for Security Exposure Management

The Microsoft Defender for Cloud integrations included with the Microsoft Defender Integration for Security Exposure Management application import cloud misconfiguration findings, compliance data, and container image vulnerabilities.

The Microsoft Defender Integration for Security Exposure Management application is available with a subscription from the ServiceNow Store.

The Microsoft Defender Integration for Security Exposure Management integrates with the Configuration Compliance application to map tests to configuration items \(CIs\) to create test results. It continuously discovers new cloud resources deployed across workloads and determines whether they are configured according to security standards such as the Center for Internet Security \(CIS\).

## Multiple deployments of the Microsoft Defender for Cloud Platform

If you have multiple deployments of the Platform application, you can add an integration for each deployment. Resources that are identified by multiple third-party deployments are consolidated and reconciled with your Configuration Management Database \(CMDB\). This consolidation takes place even when scan processes overlap between the multiple deployments.

## Integrations

The Microsoft Defender for Cloud integrations that are included with the Microsoft Defender Integration for Security Exposure Management application enrich the compliance data on your instance. These integrations retrieve data from the Microsoft Defender for Cloud product. A series of scheduled jobs invokes the integrations automatically. You can also run these scheduled jobs manually. Scheduled jobs simplify the test results remediation life cycle by keeping the instance synchronized with Microsoft Defender for Cloud.

There is a configured run-as user for each integration record, with the default value **VR.System**. This value must remain the same.

**Note:** If you don't set a valid run-as user, duplicate or multiple data retrieval attachments are created for the data source records. The number of attachments increases each time the integration is run. This increases the processing time, resulting in inconsistent transform results.

The integration tasks require the following roles.

-   sn\_vul\_msft\_tvm.configure\_integration: Ability to read, write, and delete records.
-   sn\_vul\_msft\_tvm.read\_integration: Ability to read records.

## Viewing the Microsoft Defender for Cloud Integrations

You can view the integrations by navigating to **All** > **Microsoft Defender Integration for USEM** > **Administration** > **Integrations**.

The following integrations are included in the base system.

|Integration|Description|
|-----------|-----------|
|Microsoft Defender for Cloud Policy Definitions Integration|Retrieves policies and creates policy entries in your instance.|
|Microsoft Defender for Cloud Comprehensive Assessment Integration|Retrieves assessment metadata and creates tests in your instance.|
|Microsoft Defender for Cloud Compliance Standards & Controls Integration|Retrieves standards and controls and creates the authorization source and citations. It then links them to the tests created.|
|Microsoft Defender for Cloud Assessment Integration|Retrieves assessments and processes them in your instance. The output of this integration is test results.|
|Microsoft Defender for Cloud Assessment Metadata Integration|Retrieves assessment metada and stores it in the ASC Assessment Metadata Import \[sn\_vul\_msft\_tvm\_assesment\_metadata\_import\] table.|
|Container Image Vulnerabilities Integration|Retrieves vulnerabilities of Container Images and creates Container vulnerable items in your instance.|

## Create CIs using the Identification and Reconciliation Engine

Use the Identification and Reconciliation Engine \(IRE\) to create CIs, when an existing CI cannot be matched with a host imported from a third-party scanner.

If a CI is not matched in the CMDB, a CI is created in the **cmdb\_ci\_cmp\_resource** class. Later, when a discovery finds the same CI, it enriches the CI or creates another one.

**Note:** Automatic reconciliation does not happen for cloud resources.