Design security solutions for infrastructure · Topic 2 of 6
Hybrid and Multicloud with Azure Arc, EASM and Exposure Management
SC-100 reach: Azure Arc for servers and Kubernetes, Defender External Attack Surface Management, and Security Exposure Management attack paths.
- 5 min
- Azure Arc projects servers, Kubernetes, SQL and VM platforms into Azure for Defender, Policy, Update Manager and Monitor. Outbound HTTPS only.
- Defender EASM discovers internet facing assets from seeds, and reports vulnerabilities and expired certificates.
- Security Exposure Management: attack surface map, attack paths, critical assets, initiatives.
What it is
Most organizations are not 100 percent in one place. They have servers on premises, workloads in AWS or Google Cloud, and internet facing assets nobody remembers creating. Three services extend security across that sprawl:
- Azure Arc extends Azure management and security to resources that live elsewhere.
- Microsoft Defender External Attack Surface Management (Defender EASM) discovers what the internet can see of your organization.
- Microsoft Security Exposure Management brings exposure data together, shows attack paths and sets priorities.
How it works
Azure Arc
Azure Arc projects non Azure resources into Azure Resource Manager so you manage them with the same tools, policies and security as Azure resources.
| Arc enabled resource | Use |
|---|---|
| Servers (Windows and Linux, physical or virtual, any cloud) | Install the Connected Machine agent. Gets an Azure resource ID and a managed identity |
| Kubernetes clusters | Connect any conformant cluster, then add extensions (Defender for Containers, Azure Policy, GitOps with Flux, Azure Monitor) |
| SQL Server | Manage and protect SQL Server instances (Defender for SQL, Entra authentication, best practices assessment) |
| VMware vSphere and System Center VMM | Manage on premises VM fleets from Azure |
What Arc lets you apply to those resources:
- Microsoft Defender for Cloud: Defender for Servers, vulnerability assessment, Defender for Endpoint integration, secure score and recommendations.
- Azure Policy, including Azure Machine Configuration to audit and enforce settings inside machines.
- Azure Update Manager for patching, Azure Monitor and the Azure Monitor Agent for logging, Microsoft Sentinel collection.
- Azure RBAC and tags, and Entra ID based access with managed identities.
Design notes: the Arc agent makes outbound HTTPS connections to Azure only, so no inbound firewall rules are needed, and a proxy or Private Link can be used. Onboard at scale with scripts, a service principal with a narrow onboarding role (Azure Connected Machine Onboarding), or tools such as Configuration Manager. Arc is how you bring on premises and other cloud servers under Defender for Servers, although for AWS and GCP accounts you can also use connectors, which deploy agents automatically.
Microsoft Defender External Attack Surface Management
Attackers see your organization from the outside and often find assets you did not know existed: forgotten test sites, old subdomains, exposed management interfaces, expired certificates. Defender EASM finds them.
- You provide seeds: known domains, IP blocks, hosts or contacts.
- EASM discovers connected infrastructure by continuously scanning the internet and builds an inventory of domains, hosts, IP addresses, certificates, web components and more.
- It reports insights and risks: known vulnerabilities (CVEs), exposed ports and services, expired or weak certificates, outdated software, insecure configurations, and ranks them by priority.
- You investigate and fix, and can integrate findings with Microsoft Sentinel and Defender for Cloud.
Use EASM to answer "what do attackers see?", to find shadow IT, to assess mergers and acquisitions and to monitor the exposure of third parties.
Microsoft Security Exposure Management
Security Exposure Management in the Microsoft Defender portal gives a unified view of exposure across endpoints, identities, cloud and applications, so you can prioritize what an attacker could actually use.
| Capability | Purpose |
|---|---|
| Attack surface map | A graph of assets and relationships across the environment |
| Attack paths | Chains of weaknesses an attacker could follow to reach a critical asset, with the chokepoints where a single fix breaks many paths |
| Critical asset management | Identify and classify the assets whose compromise would hurt most, so they are prioritized |
| Security initiatives | Goals such as ransomware protection or cloud security, each with metrics, a score and prioritized recommendations to track progress |
| Security insights and recommendations | Aggregated findings from Defender products with suggested actions |
| Events and metrics | Changes in exposure over time |
An initiative is a way to set requirements and priorities for a posture management process: pick an area, see the exposure score, work down the recommendations and prove improvement. Combined with attack surface reduction measures (for example, Defender for Endpoint attack surface reduction rules that block risky behaviors, and removing unneeded exposure), it lets you reduce risk with measurable effort.
Putting them together
| Question | Service |
|---|---|
| Manage and secure on premises servers from Azure | Azure Arc |
| What internet facing assets do we have? | Defender EASM |
| What attack path leads to our critical assets? | Security Exposure Management and Defender CSPM attack paths |
| What is misconfigured in AWS and Azure? | Defender for Cloud CSPM |
A worked scenario
After an acquisition, a company has 600 servers across data centers and two other clouds. The architect onboards the servers with Azure Arc, enabling Defender for Servers, Update Manager and the Azure Monitor Agent. They run Defender EASM with the acquired company's domains as seeds, find a forgotten web server with an old vulnerability and an expired certificate, and use an exposure initiative and attack paths to prioritize fixes.
What to remember for the exam
- Azure Arc projects servers, Kubernetes, SQL and VM platforms into Azure for Defender, Policy, Update Manager and Monitor. Outbound HTTPS only.
- Defender EASM discovers internet facing assets from seeds, and reports vulnerabilities and expired certificates.
- Security Exposure Management: attack surface map, attack paths, critical assets, initiatives.
- Attack surface reduction rules are a Defender for Endpoint control.
- For AWS and GCP, use Defender for Cloud connectors, and Arc for servers outside the connected accounts.
"Find forgotten internet facing assets, including those of an acquired company" is Defender EASM.
How the exam asks about this
- "Apply Azure Policy and Defender for Servers to on premises servers." Azure Arc enabled servers.
- "Discover which of our domains and IPs are exposed to the internet." Defender EASM.
- "Prioritize remediation based on paths to critical assets." Attack paths in Exposure Management.
- "Track progress on ransomware protection with metrics." A security initiative.
Common mistakes
Assuming Arc needs inbound ports. It connects outbound.
Using EASM as a vulnerability scanner for internal systems. It looks from the outside.
Leaving critical assets undefined. Prioritization then lacks context.
Over privileged onboarding principals. Use the narrow Connected Machine Onboarding role.
Check yourself
Which agent connects a non Azure server to Azure Arc?
The Azure Connected Machine agent.
What does Defender EASM use as its starting input?
Seeds such as domains, IP blocks and hosts.
What does an attack path show?
A chain of weaknesses an attacker could use to reach a critical asset.
Topic 2 of 6 in Design security solutions for infrastructure
Test yourself on Design security solutions for infrastructure
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.