Vulnerability Remediation Agent

A single CVE (Common Vulnerabilities and Exposures) could touch thousands of devices at once. Remediating it meant pulling threat signal from Defender, cross-referencing it against Intune’s device inventory, and manually building a deployment plan — risk assessment, device targeting, grouping, and rollout strategy, stitched together by hand across two products and two teams. Nothing about that process scaled.

VRA needed permissions spanning two products, not one — read access to Defender’s vulnerability data, plus read access to Intune’s apps and device configurations. Getting that right was the first real test of whether the framework’s access model held up across a product boundary, not just within Intune. That cross-product reach is also why VRA runs under its own dedicated Microsoft Entra agentic identity, distinct from how the other agents handle permissions — operating across Defender and Intune, rather than within one product, needed an identity model built for it.

The other early problem was volume, not access. CVEs don’t arrive one at a time, and admins had no way to know what mattered most in the pile. Before VRA could recommend anything, it had to rank what it was looking at.

I owned the UX end to end — discoverability, setup, the approval workflow itself, and the patch-deployment summary at the close of a session — and co-led navigation and modal alignment with the Entra team so admins moving between the two products didn’t feel a seam.

The framework staged autonomy deliberately — crawl, walk, run. For VRA, the open question was how much of that staged model to design upfront.

Dedicated vulnerable-device groups kept execution targeted and remediation scope clear — admins deployed to a defined set, not a moving target. Marking a suggestion applied isn’t automatic confirmation the fix worked, either — it’s a timestamped record the admin attests to, something to track future runs against, not a signal the agent verified anything on its own.

Shipped feature, published by Microsoft — learn.microsoft.com. Shown as reference for the shipped experience.

I designed the interaction model to support all three autonomy levels from the start — a deliberate bet that cost more upfront for a smoother path later. That bet is still paying off: there’s more in active development beyond what’s shipped today, some of which I can’t detail here yet.

As the flagship agent, VRA also set precedent for every agent that followed. Built within Fluent and Intune’s shared, cross-product component library rather than custom, one-off patterns — slower than a bespoke build, but it meant VRA felt like it belonged in Intune from day one, not like a bolted-on AI feature.