6.5 Regulatory Compliance and Multicloud Posture
Key Takeaways
- Defender for Cloud can provide regulatory compliance insights based on continuous assessments of hybrid and multicloud resources.
- Compliance views depend on assigned standards and controls; not every control can be automatically assessed.
- Microsoft Cloud Security Benchmark is enabled by default for Azure when Defender for Cloud is enabled.
- Defender for Cloud supports posture visibility across connected Azure, AWS, and GCP environments.
Monitor Compliance Posture Across Clouds
Defender for Cloud includes regulatory compliance views that are based on continuous assessment of cloud resources. Microsoft documentation describes regulatory compliance in Defender for Cloud as providing insights into compliance with standards that matter to the organization. The important SC-900 phrase is compliance posture, not legal certification. Defender for Cloud helps monitor and track controls, findings, and progress based on assigned standards.
The dashboard experience can show compliance status for assigned frameworks, compliance score for each assigned standard, visual progress, frameworks requiring attention, and recommendation filtering by compliance framework. It can also show framework-specific recommendations and remediation progress. This is another example of the same assessment engine feeding both security posture and compliance views.
| Compliance term | Meaning in Defender for Cloud |
|---|---|
| Assigned standard | A benchmark or regulatory standard applied to a scope |
| Control | A requirement or expected security condition in a standard |
| Compliance posture | Current assessment state against assigned standards |
| Framework-specific recommendation | A remediation item tied to a compliance framework or control |
| Greyed-out control | A control Defender for Cloud cannot automatically assess |
| Dashboard | A view for monitoring progress and attention areas |
Microsoft Cloud Security Benchmark, or MCSB, is a key built-in benchmark. Microsoft documentation states that for Azure, MCSB is enabled by default when Defender for Cloud is enabled. For AWS and GCP, default standards can include MCSB and cloud-provider standards. You do not need to memorize every standard for SC-900, but you should know that Defender for Cloud can assess against standards across connected clouds.
Multicloud is part of the Defender for Cloud story. Defender for Cloud can connect Azure subscriptions, AWS accounts, and GCP projects. CSPM features for AWS and GCP assess multicloud workloads against industry standards and report on security posture. Cloud secure score can also show posture by environment, such as Azure, AWS, and GCP, in supported dashboard views.
There are limits to automated assessment. Microsoft documentation notes that if a compliance control cannot be automatically assessed, Defender for Cloud cannot decide whether a resource complies with that control. In that case, the control can appear greyed out. This is a useful caution for exam wording: Defender for Cloud provides compliance monitoring and insights, but it is not a promise that all requirements are automatically proven.
Distinguish Defender for Cloud compliance views from Microsoft Purview Compliance Manager. Defender for Cloud focuses on cloud resource posture and standards assessment. Compliance Manager belongs in the compliance solutions domain and works with assessments, improvement actions, and compliance score. Both can use compliance language, so the resource scope in the question matters.
If the scenario says cloud resources, Azure subscriptions, AWS accounts, GCP projects, security recommendations, or MCSB, Defender for Cloud is the likely answer. If it says data classification, sensitivity labels, retention, eDiscovery, audit, or Compliance Manager, Microsoft Purview is more likely.
- Defender for Cloud compliance views are built from cloud resource assessment.
- Assigned standards determine what appears in compliance monitoring.
- MCSB is a key benchmark in Defender for Cloud scenarios.
- Multicloud posture includes connected Azure, AWS, and GCP environments.
Which Microsoft service is the best fit for monitoring regulatory compliance posture for connected Azure, AWS, and GCP cloud resources?
What does it mean if a compliance control cannot be automatically assessed by Defender for Cloud?
Which clue most strongly points to Defender for Cloud rather than Microsoft Purview Compliance Manager?