4.2 Defender for Cloud Compliance & Security Standards

4.2 Defender for Cloud Compliance & Security Standards

Quick Answer: Use Microsoft Defender for Cloud’s regulatory compliance experience to evaluate subscriptions (and connected AWS/GCP accounts) against security standards—especially the Microsoft cloud security benchmark (MCSB) plus frameworks such as CIS, NIST, and industry standards. Fix recommendations that map to failed controls; that work also improves Secure Score. Enable extra standards when a paid Defender plan is active; attest manual controls with evidence when automation cannot prove compliance alone.

SC-500 asks you to evaluate regulatory compliance with Defender for Cloud and to implement security controls including security standards and recommendations. This section is the compliance and standards lens; deeper CSPM/Secure Score mechanics also appear later in the posture chapters—here you need enough to design and operate standards-based enforcement and reporting.

Where compliance sits in Defender for Cloud

Defender for Cloud continuously runs security assessments (recommendations) against resources. Those assessments are the common engine behind:

1. Recommendations lists and unhealthy resource counts.
2. Secure Score (weighted progress toward recommended best practices).
3. Regulatory compliance (mapping assessments to framework controls).

When a recommendation fails, a mapped control in MCSB or CIS may show as noncompliant. When you remediate the recommendation, both Secure Score and the compliance control can improve after the next assessment cycle.

Regulatory compliance dashboard

In the Defender for Cloud portal, open Regulatory compliance. You will typically:

1. Select a standard (for example MCSB or Azure CIS).
2. See subscriptions/accounts where the standard applies.
3. Expand controls to view associated assessments.
4. Open Control details for overview, Your Actions, and Microsoft Actions (shared responsibility clarity).
5. Drill into failing automated assessments to remediate resources.
6. Complete manual attestation where required and attach evidence.

Automated vs manual assessments

Scenario: For a CIS control requiring a documented incident-response plan, automation may not see a Word doc in SharePoint. The dashboard expects manual attestation and evidence links. For “disk encryption should be enabled on VMs,” the assessment is automated—encrypt disks, then watch the control improve.

Security standards you will see on the exam

Exact catalog names evolve; the exam cares about the workflow: enable standard → review failed controls → remediate recommendations → re-evaluate → report.

Enabling standards

• MCSB is on by default when Defender for Cloud is enabled for a subscription/account.
• Additional non-default standards generally require that at least one paid Defender plan is enabled on the environment.
• Multicloud connectors (AWS/GCP) bring those accounts into the same compliance storytelling when connected.

Permissions note (practical): Reading policy compliance data needs more than casual curiosity. Subscription Reader can access policy compliance data in many setups, while Security Reader alone may not see all policy compliance data. Roles such as combinations involving Security Admin and policy-related rights are often needed to manage standards. On the exam, if someone “cannot see compliance data,” think missing permissions on policy compliance, not a broken MCSB.

Recommendations and remediation

Recommendations are the actionable unit:

1. Open a failing assessment from a control or from the recommendations page.
2. Review unhealthy resources and the remediation steps.
3. Use Quick Fix / Fix when offered (often a DeployIfNotExists-style remediation under the hood), or remediate manually in the resource blade.
4. Optionally exempt a resource with justification when risk is accepted (exemptions should be time-bound and reviewed).
5. Wait for the assessment cycle—Microsoft documentation notes roughly ~12 hours for many compliance impacts to refresh after changes.

Relationship to Secure Score (high level)

Secure Score aggregates the impact of recommendations into a single posture number. You do not need the full scoring formula for SC-500 governance items, but you must know:

• Fixing recommendations that are unhealthy generally raises Secure Score.
• The same fixes often improve regulatory control status when those recommendations map into an enabled standard.
• Secure Score is a prioritization and progress tool; regulatory compliance is the framework mapping tool. They share assessment DNA but answer different stakeholder questions (CISO dashboard vs auditor control matrix).

Reporting and continuous export

Defender for Cloud supports:

• Download report (PDF/summary status for a standard) for stakeholders.
• Audit reports for Microsoft’s own certifications (ISO, SOC, PCI packages) to show platform compliance vs your customer configuration compliance—do not confuse Azure’s SOC report with your subscription’s CIS score.
• Continuous export of regulatory compliance data to Log Analytics or Event Hubs for SIEM, long-term trending, or Microsoft Sentinel analytics.
• Workflow automation (Logic Apps) when assessment state changes—for example, email Security Ops when a PCI control fails.

Integration with Microsoft Purview Compliance Manager can surface Defender for Cloud compliance data alongside broader organizational compliance work—useful context, less likely as a deep configuration question.

Shared responsibility in control details

Opening Microsoft Actions vs Your Actions reinforces cloud shared responsibility: Microsoft hardens the cloud fabric; you harden configuration, identity, encryption choices, network exposure, and operational processes. SC-500 is almost entirely about Your Actions.

Exam traps

• Expecting compliance % to update instantly after remediation.
• Confusing Microsoft audit certificates with your resource compliance against CIS/MCSB.
• Thinking enabling a standard alone remediates resources—it only measures and guides; you still fix recommendations.
• Believing Secure Score and regulatory compliance are unrelated products—they share assessments.
• Enabling dozens of standards without a paid plan or without operational capacity to act on noise.

Practical playbook for SC-500 scenarios

1. Confirm Defender for Cloud is enabled on in-scope subscriptions.
2. Verify MCSB is present; add CIS/NIST/PCI standards required by the business (with plan prerequisites).
3. Sort controls by failed automated assessments with high unhealthy resource counts.
4. Remediate “quick wins” that also move Secure Score (exposed management ports, missing encryption, public storage, weak Key Vault network rules).
5. Attest manual controls with evidence stored in a controlled repository.
6. Export compliance weekly to Log Analytics for leadership reporting.
7. Feed chronic failures into Azure Policy Deny initiatives so new resources cannot recreate the gap.

That last step closes the loop with section 4.1: Defender tells you what is wrong; Policy keeps it from coming back.