13.3 Defender for Cloud Inventory, Compliance Standards & Custom Standards

Inventory: The Question "What Do We Actually Have?"

Defender for Cloud's Inventory page is a security-flavoured view over Azure Resource Graph, covering Azure, AWS, GCP, and Azure Arc–connected resources in one list.

Filters that matter operationally:

Two derived views are worth naming:

• Software inventory lists the applications and versions installed on protected machines. It requires Defender for Servers Plan 2 with Microsoft Defender Vulnerability Management integration, and answers "which machines run the vulnerable library announced this morning" in seconds.
• Attack path analysis and the cloud security graph (Defender CSPM) turn the inventory into exploitability chains — "internet-exposed VM → managed identity → Key Vault with production secrets" — so you triage by real reachability rather than by CVSS score alone.

Inventory also supports exporting a filtered set to CSV and opening the equivalent Resource Graph query, which is how inventory questions become repeatable automation.

---

Security Standards and the Compliance Dashboard

Defender for Cloud evaluates your environment against security standards, each of which is a set of recommendations (in Azure, backed by Azure Policy initiatives).

• Microsoft Cloud Security Benchmark (MCSB) is assigned by default to every subscription. It is Microsoft's canonical baseline, mapped to CIS, NIST, and PCI controls.
• Built-in regulatory standards you can add per subscription, management group, or cloud connector include PCI DSS, ISO/IEC 27001, SOC 2, NIST SP 800-53, CIS benchmarks, HIPAA HITRUST, FedRAMP, and country-specific standards. AWS and GCP connectors have their own CIS and PCI equivalents.
• The Regulatory compliance dashboard shows passed and failed controls per standard, with drill-down to the failing resources and, for controls Azure cannot evaluate automatically, manual attestation where you upload evidence.

The Secure Score nuance candidates miss

Assigning a regulatory standard does not change your Secure Score. Secure Score is calculated only from the recommendations in the default MCSB standard. Adding PCI DSS gives you a compliance view of PCI controls; it does not add or remove score points. Conversely, remediating an MCSB recommendation improves both the score and any compliance control mapped to it.

If a scenario says "management wants the Secure Score to reflect our internal baseline", the answer is not "assign a regulatory standard" — it is to author policy-backed recommendations and understand that custom standards report compliance separately from the score.

---

Building a Custom Standard

Custom standards exist for the very common case where an organization's baseline is not any published framework.

The workflow:

1. In Environment settings → Security policies, create a custom security standard at the subscription, management group, or connector scope.
2. Add recommendations to it — any combination of built-in recommendations and your own custom recommendations.
3. Publish it; it then appears alongside MCSB and the regulatory standards on the compliance dashboard.

Custom recommendations are how you assess something Microsoft does not check:

• For Azure, a custom recommendation is backed by an Azure Policy definition (typically an audit or auditIfNotExists definition placed in a custom initiative). Write the policy, add it to the custom standard, and its compliance state becomes a recommendation.
• For AWS and GCP, custom recommendations are authored as KQL queries over the cloud security graph, and require Defender CSPM to be enabled on the connector.

Custom recommendations carry their own severity, remediation steps, and description, so the operations team receives the same experience as for built-in findings.

---

Making Remediation Accountable: Governance Rules

A list of recommendations with no owner never gets fixed. Governance rules (a Defender CSPM capability) let you:

• Assign an owner automatically, by resource tag or by resource group owner.
• Set a remediation due date (for example, 14 days for high severity).
• Apply a grace period during which an overdue item does not damage the Secure Score.
• Send automatic email notifications to owners and their managers on a schedule.

Overdue items are flagged, so the compliance conversation shifts from "here are 4,000 findings" to "here are the 12 items your team owns that are past due".

---

Exemptions and Their Score Effect

When a recommendation genuinely does not apply, create an exemption with a justification and category (Waiver for accepted risk, Mitigated for a compensating control). The exempted resource is removed from the score calculation entirely — from both the numerator and the denominator — so it neither helps nor hurts. Exemptions require Defender CSPM or Defender for Servers Plan 2, and they should carry an expiry so accepted risk is re-reviewed rather than forgotten.

Continuous export sends recommendations, alerts, secure score, and compliance data to a Log Analytics workspace or Event Hub, which is the supported path into Microsoft Sentinel or a third-party SIEM for long-term reporting.