Stay ahead of evolving threats with the latest AI in Intune

Microsoft Intune is transforming endpoint management and extending AI innovation for IT with the introduction of Security Copilot agents. Agents empower organizations to improve their security posture, boost productivity, and simplify IT operations, while helping to address the constant pressure IT and security teams are under to manage complex endpoint environments and stay ahead of evolving threats.

A recent study found that IT professionals using Security Copilot were 35% more accurate in completing tasks. Now, Copilot in Intune is expanding its capabilities with Security Copilot agents. These agents bring powerful, adaptive automation to IT and security operations teams — streamlining critical tasks and enabling them to act faster and with greater confidence. The first of these agents in Intune is the Vulnerability Remediation Agent, launching in May 2025 in public preview. This marks a major advancement in endpoint management as it brings AI-powered automation to vulnerability remediation.

From discovery to remediation: the next step for Copilot in Intune

Copilot introduced AI assistance in Intune to help IT admins manage endpoints more efficiently and make informed decisions, whether it’s planning and deploying policies, troubleshooting endpoint issues, or assessing app risk when elevating privileges. By providing quick analysis and guidance, Copilot continues to enhance critical IT workflows and improve admin productivity.

The next evolution of Copilot in Intune is to remove the friction in identifying and remediating vulnerabilities across your endpoint estate. The Vulnerability Remediation Agent will monitor your endpoints for vulnerabilities, and it will evaluate their risk and impact, to create a prioritized list of remediation actions that enable you to resolve the highest impact vulnerabilities and reduce the attack surface in your environment. This experience extends Copilot in Intune beyond analysis and guidance to AI-powered automation, with admin control fully integrated into the Intune admin center.

The Vulnerability Remediation Agent in Microsoft Intune admin center

Discover, prioritize, and remediate vulnerabilities

Security threats are constantly evolving, and attackers are refining their tactics to exploit zero-day vulnerabilities leaving organizations increasingly exposed. With an average of 65 days to fix a critical vulnerability, organizations can be exposed far longer than they should be. As these threats evolve, vulnerabilities that may have been low risk yesterday, can be actively exploited and become high risk tomorrow.

For security and IT teams, assessing the impact of vulnerabilities and prioritizing which ones to remediate can be overwhelming, adding complexity, time and resources to ongoing vulnerability assessment and remediation.

Microsoft Security processes more than 78 trillion security signals daily and with broad set of vulnerability data feeds from Microsoft Defender Vulnerability Manager, and by harnessing AI, Copilot can do the hard work in identifying vulnerabilities for your IT and security teams and turn the tides in favor of defenders. 

However, the challenge isn’t just identifying vulnerabilities—it’s knowing which ones to prioritize. With AI driven risk assessment, the Copilot agent in Intune will evaluate the risk severity and impact on your devices. For the first time, IT will not only have visibility in Intune of the vulnerabilities in their environment but also a prioritized set of tasks that will resolve highly impactful vulnerabilities. With the information they need to ease decision making, admins can simply select what actions they want to take, choosing from either automated or guided options, to quickly remediate.

This is the first step toward vulnerability remediation at scale.

Let’s explore the agent in Intune

IT admins can access the Vulnerability Remediation Agent in the Intune admin center under the Endpoint security blade, where you’ll have visibility into your device vulnerability exposure score, suggestions on what to do next, and a history of recent activity.

The Vulnerability Remediation Agent dashboard page

It takes just a few simple steps to configure and run the agent to discover common vulnerabilities and exposures on your endpoints. Once deployed, the agent runs based on your configured schedule. The agent uses data from Defender Vulnerability Management to continuously monitor and assess ongoing vulnerabilities, surfacing the vulnerabilities directly to the Intune admin for remediation. In Intune, the agent provides the total Common Vulnerabilities and Exposures (CVEs) evaluated, the total CVEs identified for remediation, and their Common Vulnerability Scoring System (CVSS) scores. Removing barriers to risk and vulnerability information access across IT and security teams increases operational efficiency for all.

Review the Vulnerability Remediation Agent run results

From the Vulnerability Remediation Agent run results, admins can quickly access the AI-driven impact analysis for the individual CVEs prioritized for remediation. Each identified CVE includes key information such as severity, exploitability, affected systems, and organizational exposure. This information empowers IT admins with the assessment of potential risk to their environment and guidance to decide which risk they want to address first.

Vulnerability impact analysis for a specific flagged CVE

The Vulnerability Remediation Agent provides a set of prioritized tasks and options to remediate scenarios such as OS updates, and app and policy configurations. This prioritization of and options for remediation keep administrators in control. They know what to act on first and have an “easy button” to either execute an automated remediation, for example to expedite Windows OS update, or get the curated, guided steps and actions to take manually—all scoped based on their specific endpoint estate, security policies, and device configurations. Copilot can guide administrators of all levels of experience step by step through the required process to quickly patch the most impactful vulnerabilities.

Recommended remediation step – Approve Windows expedited update

Once remediation is complete, a remediation summary confirms the vulnerabilities addressed, ensuring IT teams have full oversight of the process.

The agent helps IT teams proactively improve their endpoint security posture. IT can use the new AI capabilities to strengthen defenses, enforce best practices, and develop more resilient endpoint security strategies improving their endpoint security posture.

What’s next?

Our vision is to offer organizations the power of AI agents to fully scale endpoint vulnerability remediation using data across from across Microsoft security and our device ecosystems. The Vulnerability Remediation Agent in Intune marks a major step toward this vision with Copilot and AI-driven automation for improving security outcomes and organizational efficiency. This is just the beginning. Read about additional new Copilot in Intune capabilities and data and analytics enhancements.

Learn more about the innovations designed to help your organization protect data, defend against cyber threats, and stay compliant. Join Microsoft leaders online at Microsoft Secure on April 9. Being secure is the first step towards AI innovation. Learn how to harden your defenses by exploring new AI-first tools, demos, and best practices. Register now.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune on X to continue the conversation.