STIGQter: STIG Summary: Microsoft Defender for Endpoint Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Microsoft Defender for Endpoint (MDE) must enable Device discovery.

DISA Rule

SV-275987r1119717_rule

Vulnerability Number

V-275987

Group Title

SRG-APP-000279

Rule Version

MSDE-00-000900

Severity

CAT II

CCI(s)

• CCI-001243 - Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.

Weight

10

Fix Recommendation

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Set the slide bar for "Device discovery" to "On".

Check Contents

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Verify the slide bar for "Device discovery" is set to "On".

If the slide bar for "Device discovery" is not set to "On", this is a finding.

Vulnerability Number

V-275987

Documentable

False

Rule Version

MSDE-00-000900

Severity Override Guidance

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Verify the slide bar for "Device discovery" is set to "On".

If the slide bar for "Device discovery" is not set to "On", this is a finding.

Check Content Reference

M

Target Key

5693