12.1 Defender CSPM and Secure Score

12.1 Defender CSPM and Secure Score

Quick Answer: Foundational CSPM (free) gives inventory, recommendations, Microsoft cloud security benchmark (MCSB), and Secure Score. Defender CSPM (paid plan) adds attack path analysis, governance, cloud security explorer, agentless scanning, risk prioritization, advanced compliance, and related posture features. Use recommendations and attack paths to identify security risks, then remediate and govern owners until Secure Score improves.

SC-500 blueprint language under Manage security posture by using Defender for Cloud includes identify security risks by using Defender CSPM. This section builds the posture-management mental model: what is free vs paid, how Secure Score works, how recommendations and attack paths prioritize work, and how governance turns findings into accountable remediation.

---

CSPM in the Defender for Cloud CNAPP

Microsoft Defender for Cloud is a Cloud Native Application Protection Platform (CNAPP) with two complementary pillars:

CSPM is continuous assessment against security standards. Defender for Cloud evaluates Azure subscriptions, connected AWS accounts, and GCP projects, then issues security recommendations. By default, the Microsoft Cloud Security Benchmark (MCSB) is a primary standards lens; Secure Score is driven largely by MCSB-aligned recommendation health. A higher Secure Score indicates a lower identified risk level.

Do not confuse CSPM with SIEM alerting. CSPM findings are primarily misconfigurations and posture risks; workload security alerts come from enabled CWPP plans (covered in the next section). SC-500 scenarios often mix both: fix posture first, then investigate threats.

---

Foundational CSPM vs Defender CSPM

Defender for Cloud offers two CSPM offerings:

Foundational CSPM (free)

Foundational CSPM provides baseline multicloud posture capabilities. Historically it has been enabled by default when Defender for Cloud is active on a subscription. Microsoft has announced that starting October 27, 2026, Foundational CSPM moves to an opt-in model for new Azure subscriptions (existing subscriptions keep current configuration; the free plan remains available at no cost). Exam scenarios still treat foundational capabilities as the free baseline.

Typical foundational capabilities include:

• Asset inventory across supported clouds and hybrid resources
• Security recommendations and remediation guidance
• Secure Score tracking
• Microsoft Cloud Security Benchmark assessments
• Workflow automation hooks and data export for SIEM/reporting
• Visualization with Azure Workbooks

Defender CSPM (paid plan)

Defender CSPM is the optional paid posture plan. It includes foundational capabilities and unlocks advanced features that SC-500 candidates must recognize by name:

Exam trap: Enabling Defender for Cloud on a subscription is not the same as enabling the Defender CSPM plan. Foundational features can run without the paid plan; attack path analysis, explorer risk hunting, governance at scale, and several agentless insights require Defender CSPM (or, for some agentless machine scanning features, Defender for Servers Plan 2—see section 12.3).

Pricing awareness (high level): Do not memorize dollar tables for the exam. Know that Foundational CSPM is free, Defender CSPM is paid, billing is based on specific billable resource types (for example compute, storage, and database resources that meet inclusion rules), and Microsoft publishes current rates on the Azure pricing page and cost calculator. Billing can apply across Azure, AWS, and GCP when those environments are connected and the plan is enabled.

---

Secure Score deep dive

Secure Score summarizes posture from recommendation status. Conceptually:

1. Defender for Cloud evaluates resources against controls/recommendations.
2. Unhealthy recommendations reduce the contribution of related security controls.
3. Remediation (or justified exemption where appropriate) raises the score.
4. Leadership dashboards use the score as a trendable KPI, not a one-time audit grade.

Operational points that matter on scenario questions:

• Score is recommendation-driven. You improve it by fixing misconfigurations (or correctly exempting with business justification), not by silencing unrelated SIEM noise.
• Not every recommendation carries equal weight; Microsoft groups guidance into security controls so you can tackle high-impact families (identity, network, data protection) systematically.
• Multicloud resources on connected AWS/GCP environments contribute to posture views when assessments apply.
• Score is a risk indicator, not a compliance certificate. Passing an ISO audit and maximizing Secure Score are related but separate workstreams.

Scenario: A CISO demands “Secure Score above 80% by quarter end.” As the security engineer, you export top unhealthy recommendations, map them to owners via governance (Defender CSPM), fix high-impact public exposure and weak encryption recommendations first, and report score deltas weekly. Buying more CWPP plans alone does not magically raise Secure Score if configuration recommendations remain unhealthy.

---

Recommendations as the risk identification engine

Security recommendations are the primary CSPM output for identifying risks. Each recommendation typically includes:

• Affected resources and severity/risk context
• Why the issue matters (security control mapping)
• Remediation steps (portal, Policy, CLI/Bicep/Terraform patterns)
• Sometimes quick fix or policy-based enforce options

How to work recommendations on the job (and on the exam):

1. Filter by subscription/environment, severity, resource type, and internet exposure.
2. Prioritize using Defender CSPM risk signals and attack paths when available—do not only sort by static severity.
3. Remediate preferred paths: IaC fix for lasting change; portal quick fix for emergency; Azure Policy for prevent recurrence.
4. Exempt only with documented business justification and review dates—exemptions can hide real risk if abused.
5. Automate repetitive response with workflow automation (Logic Apps) for owner assignment or ticketing.

Recommendations also power regulatory compliance dashboards (MCSB and additional standards). Chapter 4 covered standards selection; here remember that compliance views and Secure Score share the recommendation engine.

---

Attack path analysis (high level)

Attack path analysis (Defender CSPM) builds on the cloud security graph. Instead of treating each recommendation as an isolated ticket, the graph connects identities, compute, network exposure, vulnerabilities, and sensitive data context into potential exploit chains.

Example conceptual path:

Internet-exposed VM → unpatched critical CVE → over-privileged managed identity → sensitive storage account

What you should do with an attack path:

• Break the chain at the cheapest high-impact node (often remove public exposure or strip standing privileges).
• Prefer fixes that eliminate multiple paths (for example, disable public network access on a database that appears in several graphs).
• Use attack paths to justify remediation priority to workload owners who argue “that medium recommendation can wait.”

Exam trap: Attack path analysis is a CSPM graph capability, not a Microsoft Sentinel analytics rule and not the same as Microsoft Defender XDR device timelines—though all may appear in a unified Microsoft security operations story.

---

Governance for at-scale remediation

Governance in Defender CSPM turns recommendations into managed work items:

• Assign owners (who is accountable)
• Set due dates and grace periods
• Track completion across many subscriptions
• Drive consistent remediation SLAs for high-risk findings

Without governance, Secure Score improvements stall because recommendations sit in a shared queue with no owner. With governance, platform security defines rules such as “all internet-facing critical recommendations must have an owner within 24 hours and remediation within 7 days.”

Governance is complementary to Azure Policy: Policy prevents or audits configuration drift; governance drives human accountability for remaining findings and exceptions.

---

Identify security risks with Defender CSPM — practical workflow

A SC-500-aligned posture loop looks like this:

1. Confirm Foundational CSPM is active (and Defender CSPM where advanced features are required).
2. Review Secure Score and unhealthy security controls.
3. Open recommendations filtered to production and internet-facing resources.
4. Inspect attack paths for chains touching critical assets.
5. Hunt with cloud security explorer for specific risk patterns (public IPs + secrets + privileged identities).
6. Assign governance rules and remediate via IaC/Policy/quick fix.
7. Re-check Secure Score and path elimination after change windows.

Scenario: Finance has an Azure subscription plus a connected AWS account. Foundational recommendations show open security groups and unencrypted storage. After enabling Defender CSPM, attack path analysis shows an internet-facing EC2-equivalent path to a sensitive bucket-equivalent resource. You close the exposure, attach governance owners for remaining high-risk recommendations, and Secure Score rises as unhealthy assessments clear.

---

Exam traps checklist

Master the free-vs-paid feature split, Secure Score mechanics, recommendation-driven risk identification, attack path prioritization, and governance at scale—and you can answer the bulk of Defender CSPM questions in the posture domain.