12.3 Vulnerability Management and Defender EASM

12.3 Vulnerability Management and Defender EASM

Quick Answer: Configure Microsoft Defender Vulnerability Management (MDVM) for machines via agentless scanning (disk snapshots; Defender CSPM or Defender for Servers Plan 2) and/or agent-based scanning (Microsoft Defender for Endpoint with Servers P1/P2). Use Microsoft Defender External Attack Surface Management (EASM)—integrated with Defender CSPM—to discover internet-facing assets outside-in and feed exposure validation, attack paths, and explorer hunting.

SC-500 explicitly calls out configure Microsoft Defender Vulnerability Management settings for Azure VMs and discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management (EASM). This section ties host vulnerability assessment to external exposure discovery so posture work covers both inside-out and outside-in views.

---

Microsoft Defender Vulnerability Management in Defender for Cloud

Microsoft Defender Vulnerability Management (MDVM) provides continuous discovery of software vulnerabilities, misconfigurations, and related inventory signals. Inside Defender for Cloud, integrated VA for machines is a core part of Defender for Servers, with results increasingly visible through unified Exposure Management / Vulnerability Management experiences in the Microsoft Defender portal as well as classic Defender for Cloud recommendation views.

Supported machine scopes include:

• Azure VMs
• AWS and GCP machines connected to Defender for Cloud
• On-premises machines onboarded with Azure Arc

Integrated MDVM benefits for security engineers:

• Consistent scanning approach across multicloud and hybrid hosts
• Near real-time discovery of CVEs and missing patches
• Risk-oriented prioritization informed by threat landscape and organizational context
• Software inventory visibility
• Remediation guidance that feeds the same recommendation workflows used for Secure Score/posture work

Settings and enablement mental model

Vulnerability assessment is typically on by default when Defender for Servers is enabled, but SC-500 expects you to know where to configure it when defaults are insufficient:

1. Environment settings → subscription or connector
2. Open Defender for Servers plan settings / Settings & monitoring style blades
3. Confirm vulnerability assessment solution selection (integrated MDVM vs alternatives)
4. Confirm agentless scanning toggles when using P2/CSPM paths
5. Confirm Defender for Endpoint integration for agent-based results

Permissions commonly require elevated rights to deploy components (Owner-level patterns for deployment; Security Reader may suffice for viewing findings—follow least privilege).

---

Agentless vs agent-based vulnerability assessment

Defender for Cloud uses a hybrid VA strategy.

Agentless vulnerability scanning

How it works (conceptual):

1. Defender for Cloud takes snapshots of VM disks (OS and data disks within supported limits).
2. Analysis runs out-of-band on the snapshot—no agent inside the guest and no direct performance hit on the running workload comparable to heavy in-guest scanners.
3. Metadata is extracted; the temporary snapshot copy is deleted after processing.
4. MDVM engines analyze the image content for vulnerabilities, software inventory, and related signals.
5. Results surface as recommendations/findings in Defender for Cloud / Exposure Management.

Plan prerequisites (exam-critical):

• Agentless machine scanning requires Defender CSPM and/or Defender for Servers Plan 2.
• Enabling agentless on either plan path typically activates the capability for both where licensed.
• Malware scanning as part of agentless capabilities is associated with Servers Plan 2 (not merely free foundational CSPM).

Supported shapes (high level): Azure VMs (with disk size/count limits documented by Microsoft), AWS EC2, and GCP compute instances connected to Defender for Cloud. Encryption with platform-managed or customer-managed keys is supported in documented scenarios; some marketplace/third-party AMI edge cases may be unsupported.

Why agentless matters: Rapid coverage for fleets where installing agents is slow, politically blocked, or temporarily impossible (golden images, locked-down OT-adjacent systems, burst scale sets). It is also valuable for discovering machines that “should” have agents but do not.

Agent-based vulnerability scanning

How it works: The Microsoft Defender for Endpoint sensor on the machine provides continuous VA telemetry. This is available with Defender for Servers Plan 1 or Plan 2 when MDE integration is enabled.

Strengths of agent-based scanning:

• Often fresher continuous signals while the device is online
• Deeper endpoint context aligned with EDR
• Fits managed desktop/server estates already standardized on MDE

When both methods are present

Microsoft’s hybrid guidance:

Exam trap: Agentless is not available as a full substitute feature on every plan. “We enabled Foundational CSPM only” is usually insufficient for agentless VA expectations that require Defender CSPM or Servers P2.

BYOL scanners

Organizations may still use bring-your-own-license vulnerability scanners such as Qualys or Rapid7 instead of (or historically alongside) integrated MDVM. Integrated MDVM is the Microsoft-native path SC-500 emphasizes; know BYOL exists so you can interpret older designs, but prefer MDVM integration answers unless the scenario specifies partner VA.

---

Working vulnerability findings into posture operations

Vulnerability results should not live in a separate spreadsheet silo:

1. Triage by severity, internet exposure, asset criticality, and attack path involvement.
2. Remediate with patch management (Azure Update Manager, WSUS/ConfigMgr, multicloud patch tools) or compensating controls.
3. Verify findings clear after patch cycles—agent-based freshness helps confirm quickly.
4. Link to Secure Score / recommendations where VA findings are represented as actionable recommendations.
5. Govern owners for overdue critical CVEs on production internet-facing hosts (Defender CSPM governance).

Scenario: An Azure VM scale set runs an outdated OpenSSL package. Agentless scanning (Servers P2) flags the CVE across instances that lacked MDE during a deployment glitch. You fix the image pipeline, redeploy, and enable MDE so ongoing agent-based VA keeps pace with future drift.

---

Microsoft Defender External Attack Surface Management (EASM)

What EASM is

Microsoft Defender External Attack Surface Management (Defender EASM) discovers and maps an organization’s digital attack surface from the outside—the assets an attacker can find without internal credentials. It uses Microsoft crawling technology to expand from known infrastructure (domains, IP spaces, brands, subsidiaries) into related assets and monitors them over time.

Typical EASM outcomes:

• Always-on inventory of internet-facing digital assets
• Discovery of unknown or shadow IT hosts, apps, and endpoints
• Prioritized attacker-visible weaknesses
• Visibility that extends to third-party / dependent surfaces in broader EASM programs

The attack surface is every reachable entry point. Larger uncontrolled surfaces are harder to defend—EASM quantifies that reality.

EASM integration with Defender for Cloud CSPM

Defender for Cloud performs outside-in external attack surface management through integration with Defender EASM. Key exam facts:

• The integration is included with the Defender CSPM plan by default.
• It does not require a separate Defender EASM license solely for the integrated CSPM capabilities Microsoft documents for this integration.
• It does not require special one-off configuration beyond enabling/using Defender CSPM as designed (standalone full EASM workspaces remain a broader product story when organizations deploy EASM as its own Azure resource for deeper programs).

Inside-out vs outside-in:

Together they validate whether “we think this is private” matches “the internet can still reach it.”

Capabilities unlocked in Defender CSPM by EASM data

Microsoft documents that Defender CSPM uses EASM-collected data to support:

1. Discovery of internet-facing cloud resources via outside-in scanning
2. Attack path analysis that can start from internet-exposed IPs and walk inward to critical assets
3. Cloud security explorer queries correlating internet-exposed IPs with other graph entities (identities, vulnerabilities, data sensitivity)

This is how EASM feeds posture work:

• Surface unprotected or unexpectedly public assets
• Validate internet exposure analysis recommendations
• Prioritize remediation when a CVE sits on a host that is truly attacker-reachable
• Find resources missing tags/owners because they were never in the “official” subscription inventory story

Scenario: Inventory shows a curated set of App Service endpoints. EASM-derived exposure reveals an old staging site on a forgotten DNS name still resolving to a public IP. Attack path analysis connects that IP to a backend store with weak auth. You shut down the staging endpoint, fix DNS, and open a governance item for residual vault secrets found on related compute.

---

Combining MDVM and EASM in a posture program

A practical SC-500-aligned workflow:

1. Enable Defender CSPM for advanced posture + EASM-integrated exposure insights.
2. Enable Defender for Servers (choose P1/P2 based on agentless/JIT/FIM needs).
3. Configure MDVM (agentless and/or MDE agent-based) for Azure VMs and Arc/multicloud machines.
4. Review internet-facing assets and attack paths that start at exposed IPs.
5. Prioritize CVEs and misconfigurations on exposed critical assets first.
6. Remediate, re-scan, and track Secure Score / recommendation closure.
7. Feed residual detections into SOC tooling (Sentinel) where operational monitoring requires correlation—without confusing CSPM discovery with SIEM analytics engineering (next chapter).

---

Exam traps checklist

Configure MDVM with a clear agentless vs agent-based plan strategy, use EASM-informed exposure to find what attackers see first, and let those insights drive prioritized remediation across Azure VMs and the wider multicloud estate.