Critical asset classifications are reviewed and approved

​

What this check verifies

Microsoft Defender XDR critical asset management classifications with a lower classification confidence score must be approved by a security administrator. Asset classifications that have not yet been reviewed and approved may result in incomplete critical asset visibility.

​

Risk

Stale pending approvals lead to limited visibility in Microsoft Defender XDR. Critical assets that are not properly identified and classified may not receive appropriate security monitoring and protections, creating gaps in the organization’s security posture.

​

Recommendation

Regularly review and approve pending critical asset classifications to ensure accurate asset visibility in Microsoft Defender XDR. Stale approvals reduce the effectiveness of security monitoring and incident response for critical assets.

​

Remediation

Dashboard steps

1. Navigate to Microsoft Defender at https://security.microsoft.com/
2. Go to Settings > Microsoft Defender XDR > Critical asset management
3. Review each pending approval listed in the check results
4. Verify the correct classification for each asset
5. Approve or reject the classification as appropriate

​

References

• https://learn.microsoft.com/en-us/security-exposure-management/classify-critical-assets
• https://learn.microsoft.com/en-us/security-exposure-management/classify-critical-assets#review-critical-assets

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defenderxdr_critical_asset_management_pending_approvals. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks