NuGetAuditMode: should I audit direct or all packages?

Audit all packages. NuGetAuditMode has two values, direct and all. Direct checks only the packages you reference yourself. All also checks transitive packages, which is where many advisories sit. The default is all for projects targeting net10.0 or higher, and direct for older targets.

What the setting does

NuGet Audit runs during restore. It compares the packages in your project against a list of known vulnerabilities from your audit sources. NuGetAuditMode controls how much of the graph is compared.

If a project multi-targets and any one target framework selects all, audit uses all for every target framework.

Why direct is not enough

A typical application references a handful of packages and pulls in dozens more. You did not choose those, and you may not know they exist. An advisory on a transitive package still affects the code you ship. Auditing direct references alone gives you a view of the part of the graph you can see easiest.

How to set it for a whole repository

Microsoft recommends configuring audit at the repository level, so every project behaves the same. Put the property in a Directory.Build.props file at the repo root.

<Project>
  <PropertyGroup>
    <NuGetAudit>true</NuGetAudit>
    <NuGetAuditMode>all</NuGetAuditMode>
    <NuGetAuditLevel>low</NuGetAuditLevel>
  </PropertyGroup>
</Project>

NuGetAuditLevel is the minimum severity to report. Its default is low, so you see everything. Raising it to moderate hides low advisories, which can cut noise but also hides information.

Handling the extra noise

Switching to all will usually surface more warnings than you expected. That is the point, but you need a plan so the team does not simply turn it off.

1. Turn it on in a branch and count the warnings by package.
2. Fix direct packages first, since one update often clears several transitive findings.
3. For the rest, work from the package closest to your direct references outward.
4. Consider package pruning on newer SDKs, which removes packages the runtime already provides and reduces false positives.
5. Decide which severities fail the build and which only warn.

Which SDK supports what

Per the feature table in Microsoft's docs, NuGetAudit for PackageReference arrived with NuGet 6.8 and the .NET 8 SDK. The change that makes all the default for net10.0 came with NuGet 7.0 and the .NET 10 SDK. If you build with an older SDK, set the property yourself.

Try it yourself

Click through it at your own pace, or open it full screen. Compare the direct list with the full list and note how much larger the second one is.

Safeguard's dependency scanning reads the whole resolved graph, and a free scan shows transitive findings next to direct ones.

Quick check

Sources

• Auditing package dependencies for security vulnerabilities, Microsoft Learn
• NuGet PackageReference in project files, Microsoft Learn

Last reviewed: 19 October 2026.