Manage and Monitor Security Posture · Topic 1 of 3
Managing Security Posture with Defender for Cloud
SC-500 posture management: Defender CSPM, secure score, compliance frameworks, workload protection plans, AWS and GCP connectors, vulnerability management and EASM.
- 4 min
- Defender for Cloud = CSPM (posture) plus CWP (workload protection).
- Foundational CSPM is free; Defender CSPM adds attack paths, cloud security explorer, agentless scanning and regulatory standards beyond the benchmark.
- Regulatory compliance dashboard tracks assigned standards.
What it is
Microsoft Defender for Cloud is a cloud-native application protection platform. It does two jobs: cloud security posture management (CSPM), which finds and helps fix weaknesses, and cloud workload protection (CWP), which detects threats against running workloads. It covers Azure, hybrid servers and other clouds such as AWS and GCP.
How it works
Posture management
| Offering | What it includes |
|---|---|
| Foundational CSPM (free) | Security recommendations, secure score, asset inventory, the Microsoft cloud security benchmark |
| Defender CSPM (paid plan) | Adds agentless scanning, attack path analysis, the cloud security explorer graph queries, data security posture (sensitive data discovery), AI security posture, regulatory compliance standards beyond the benchmark, custom recommendations, governance rules and EASM insights |
- Secure score summarizes posture; fixing recommendations raises it.
- Attack path analysis shows chains of weaknesses an attacker could use to reach critical assets, so you fix the most dangerous first.
- Cloud security explorer lets you query the security graph, for example "VMs exposed to the internet with high-severity vulnerabilities".
Compliance against frameworks
The Microsoft cloud security benchmark is assigned by default. Assigning other regulatory standards (such as ISO 27001 or PCI DSS) to subscriptions or connectors needs Defender CSPM; track results in the regulatory compliance dashboard. Each control maps to recommendations, so fixing recommendations improves compliance. Controls that can't be assessed automatically show as greyed out.
Workload protection plans
| Plan | Protects |
|---|---|
| Defender for Servers | Windows and Linux machines in Azure, on premises and in other clouds |
| Defender for Containers | Kubernetes clusters, registries and images |
| Defender for Storage | Storage accounts |
| Defender for Databases | Azure SQL, SQL on machines, open-source relational databases, Cosmos DB |
| Defender for App Service, Key Vault, Resource Manager, APIs | The named services |
| Defender for AI services | AI workloads |
Enable plans per subscription (and per connector for other clouds); some plans allow per-resource settings. Plans can be enabled at scale with Azure Policy or the REST API.
Hybrid and multicloud
- AWS and GCP connectors onboard accounts and projects so Defender for Cloud can assess them and apply plans.
- On-premises servers are connected with Azure Arc.
Vulnerability management and attack surface
- Microsoft Defender Vulnerability Management provides vulnerability assessment for machines protected by Defender for Servers. It is enabled by default on machines with the Defender for Endpoint extension, agentless scanning (Plan 2 or Defender CSPM) adds findings without an agent, and its premium features come with Plan 2.
- Microsoft Defender External Attack Surface Management (EASM) discovers your internet-facing assets, such as domains, IP addresses and web apps, including ones you did not know about, and finds their vulnerabilities.
A worked example: a company runs workloads in Azure and AWS. It connects the AWS accounts, enables Defender CSPM to get attack path analysis across both clouds, assigns the ISO 27001 standard, and turns on Defender for Servers so machines in both clouds get vulnerability assessment and EDR.
"Show how an attacker could reach a sensitive database through several weaknesses" points to attack path analysis in Defender CSPM, not to secure score.
How the exam asks about this
- "Assess AWS resources in Defender for Cloud." Create an AWS connector.
- "Find unknown internet-facing assets the company owns." Defender EASM.
- "Query for VMs exposed to the internet that have critical vulnerabilities." Cloud security explorer in Defender CSPM.
What to remember for the exam
- Defender for Cloud = CSPM (posture) plus CWP (workload protection).
- Foundational CSPM is free; Defender CSPM adds attack paths, cloud security explorer, agentless scanning and regulatory standards beyond the benchmark.
- Regulatory compliance dashboard tracks assigned standards.
- Workload protection plans cover servers, containers, storage, databases, App Service, Key Vault, Resource Manager, APIs and AI.
- AWS and GCP connectors; Azure Arc for on-premises servers.
- Defender Vulnerability Management for machines; EASM for internet-facing assets.
A high secure score does not mean no threats. Posture and threat detection are different jobs; you still need workload protection plans.
Common mistakes
Expecting attack paths on the free tier. They need Defender CSPM.
Forgetting connectors for other clouds. AWS and GCP need connectors.
Confusing EASM with vulnerability scanning of known VMs. EASM discovers internet-facing assets.
Check yourself
What does attack path analysis show?
Chains of weaknesses an attacker could exploit to reach critical assets, so you can fix the riskiest first.
How do you bring AWS accounts into Defender for Cloud?
Create an AWS connector in Defender for Cloud.
What does Defender EASM discover?
The organization's internet-facing assets, including unknown ones, and their exposures.
Topic 1 of 3 in Manage and Monitor Security Posture
Test yourself on Manage and Monitor Security Posture
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.