Every pillar in this series is a product you can license separately. The thing that makes them a suite is a platform layer nobody sells you, that arrives free with the first qualifying licence, and that most tenants never deliberately configure.
Secure Score is the only figure that aggregates every pillar into one number, which makes it a governance instrument first and a security tool second. Instruments that boards read get gamed, so the design work is deciding what your organisation is allowed to do to it.
Grant the role, classify what actually matters, choose an initiative set deliberately rather than accepting a default, and prove with a query that the graph can see the asset you just told it about.
Vulnerability management tells you what is weak. Exposure Management arranges those weaknesses the way an attacker would use them, as routes to the assets that end your week. That reframing, not the new console, is the product.
Wire the handoff end to end: the toggle that defaults to off, the request that carries a ticket into Intune, the exception you file when the answer is no, and a round-trip test that proves a finding reached a machine and came back confirmed.
Requesting remediation deploys nothing, changes nothing, and does not notify the person who has to act. That is the design rather than the defect, and it makes the handoff between the security organisation and the endpoint organisation the decision that actually matters.
An E5 tenant does not own a vulnerability scanner. It owns three separate measurement systems that run in opposite directions, answer to different owners, and are calculated independently of each other.
Session control reaches inside a live browser session, but it rides Conditional Access and carries real limits. Access versus session, in-browser preview versus reverse proxy, and the two dependencies that lock users out.
