14.1 Microsoft Defender External Attack Surface Management (EASM)

The Blind Spot EASM Closes

Every posture tool discussed so far looks outward from your subscription: Defender for Cloud enumerates resources you own in a cloud you control. Defender External Attack Surface Management (EASM) looks inward from the internet. It answers a different question — what can an attacker see and reach that belongs to us? — and the answers routinely include assets nobody in the security team knew existed:

• A marketing microsite registered on a corporate credit card and hosted at a third party.
• A subsidiary's domain still resolving to an unpatched web server after an acquisition.
• A staging host with an expired TLS certificate and a default admin page.
• An IP range that used to be yours and now serves someone else's content.

None of these appear in Azure Resource Graph, so no amount of Defender for Cloud tuning finds them.

---

How Discovery Works

EASM is deployed as an Azure resource in a resource group and needs no agents and no credentials in the target environment, because it observes from outside.

Seeds → discovery → inventory:

1. Discovery seeds are things you know are yours: domain names, IP blocks, host names, ASNs, WHOIS contact details, and organization names.
2. A discovery group bundles seeds and a run schedule. Microsoft also offers pre-built attack surfaces for many organizations as a starting point.
3. EASM performs recursive discovery, following relationships — shared WHOIS registrant, shared SSL certificate, DNS records, hosting relationships — to infer further assets. Each inferred asset carries a discovery chain showing the evidence path back to a seed.
4. Results land in the inventory in a state such as Approved Inventory, Candidate, Dependency, Monitor Only, or Requires Investigation.

You must review and approve candidates. Recursive discovery is deliberately generous; an asset that merely shares a hosting provider is not yours. Approving assets into the Approved Inventory is the human step that makes the data trustworthy, and labels let you group assets by business unit, subsidiary, or environment.

---

Asset Types

Each asset carries observed metadata: detected web technologies and versions, HTTP response headers, open ports and services, certificate chain and expiry, and the discovery chain that justified its inclusion.

---

Dashboards and Insights

EASM ships four dashboards that map cleanly to security conversations:

Insights are the findings themselves, classified high, medium, or low, each listing the affected assets and the observation that produced it. High-severity insights typically include CVEs on identified technology versions and services that should never face the internet.

---

Operationalising EASM

EASM is only useful if its findings reach the teams that fix things:

• Data connections push asset data and insights to Azure Log Analytics or Azure Data Explorer on a schedule. From Log Analytics, Microsoft Sentinel can run analytics rules over the data — for example, alert whenever a newly discovered host appears in Approved Inventory that is not in the CMDB, or whenever an insight of high severity is raised.
• The REST API supports pulling inventory and insights into ticketing and CMDB systems.
• Defender CSPM in Defender for Cloud consumes external attack surface data to enrich internet-exposure context in attack path analysis, so an internet-facing VM's real reachability is assessed with outside-in evidence rather than only NSG configuration.
• Billing is per asset per day in the Approved Inventory, which is another practical reason to keep the approval discipline tight rather than approving every candidate.

The operating rhythm is straightforward: schedule discovery, triage new candidates weekly, treat high-severity insights as incidents, and reconcile the Approved Inventory against your asset register so that "shadow IT" becomes a measured number that trends downward.