A lab company, Contoso, patches a fresh CVE on Wednesday. On Friday the auditor asks a simple question: which devices were exposed, and when was each one fixed? The Defender portal answers with a polite, empty stare.

Rebuilt in my lab tenant with made-up data, checked against Microsoft Learn (October 2026). All names (Contoso, LAB-WIN11-01 , app-mdvm-evidence ) and numbers are lab examples. The diagram and the "portal" table are drawings, not screenshots.

TL;DR

Vulnerability management in Defender shows now , not history . Once a device is patched it simply drops out of the exposed list, and DeviceTvmSoftwareVulnerabilities only has what is still vulnerable.

The proof lives in the delta export API : it returns every change with a Status of New , Fixed or Updated and an EventTimestamp .

Delta export only looks back 14 days , and nothing is kept for you.…