Skip to main content
The security command center shows what is happening right now across Microsoft Defender, Microsoft Sentinel, Entra ID Protection, and Defender for Cloud Apps. Open it from Security > Dashboard. The dashboard is read-only. To act on a detection, open it in the threat queue. Changes you make in the queue, such as a new status or assignee, update the dashboard automatically.

​
Posture score

A radial gauge shows your overall security posture score and how it changed since last week. Rings around the gauge break the score down into Identity, Endpoint, Data, and Apps, so you can see which area is lowering the score.

​
Detection stream

A chart of detections by severity (Critical, High, Medium, and Low). Switch between yearly, quarterly, and monthly ranges.

​
Attack vectors

A donut chart shows the top attack categories. The most common category appears in the center, with a ranked legend underneath.

​
Top threats

The five critical or high threats that need the most attention, with triage actions on each row. Click a row to open it in the threat queue.

​
Defender coverage

Shows coverage status for Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender for Office 365. Use it to spot gaps between coverage and enrollment.

​
Watchlist

A list of users, devices, IP addresses, and resources your security team is monitoring. You can filter the threat queue by the same list.