Defender for Cloud: Security Policies, Standards, and Secure Score

CSPM vs CWP; how Azure Policy definitions, initiatives, security standards, and recommendations connect; the default MCSB standard; how the secure score works; foundational vs Defender CSPM; and the Defender plans for each resource type.

The official skills outline for SC-900 Domain 3 has two separate items about Microsoft Defender for Cloud: "how security policies, standards, and recommendations improve the cloud security posture" and "enhanced security features provided by cloud workload protection." Knowing that Defender for Cloud shows a secure score is not enough; you need to explain how a policy becomes a recommendation and how recommendations turn into the score.

This post first splits Defender for Cloud into its two pillars, CSPM and CWP, and then covers the relationship between security policies, initiatives, standards, and recommendations; the default standard, the Microsoft cloud security benchmark (MCSB); how the secure score is calculated; the difference between free foundational CSPM and paid Defender CSPM; and the Defender plans for each resource type.

---

The Two Pillars of Defender for Cloud: CSPM and CWP

There are two ways to keep a building safe. One is regular inspection that finds broken windows and doors that do not lock, and fixes them in advance. The other is guards who catch the people who actually break in. Defender for Cloud does both.

| Aspect | CSPM (cloud security posture management) | CWP (cloud workload protection) | |------|------|------| | Question | Where are the weak spots before an attack? | Is an attack happening right now? | | What it does | Finds misconfigurations and shows them as recommendations and a secure score | Detects threats and raises alerts through Defender plans for each resource type | | Typical example | "Public access is open on a storage account" | "Suspicious process detected on a VM" |

The scope is not limited to Azure. AWS and GCP accounts connect through connectors, and on-premises servers connect through Azure Arc, so everything is assessed in the same view.

Exam tip: "Find misconfigurations and provide hardening guidance" is CSPM, and "detect attacks on servers, storage, and databases" is CWP.

---

How Policies, Initiatives, Standards, and Recommendations Connect

Think of a building code. It has individual clauses such as "emergency exits must always stay unlocked," a code book that gathers those clauses, and an inspector who compares the code book with the actual building and writes up the findings. Security policies in Defender for Cloud are built on Azure Policy and work with exactly this structure.

| Concept | Meaning | Example | |------|------|------| | Azure Policy definition | A rule about one security condition to enforce | "Storage accounts must allow only secure transfer" | | Security initiative | A collection of policy definitions that share a goal | A set of data protection policies | | Security standard | An initiative aligned with the requirements of a regulation or benchmark | The default standard MCSB, ISO 27001, PCI DSS | | Recommendation | The resources found not to comply with a policy, plus how to fix them | "Install endpoint protection on your VMs" |

Policies and initiatives are assigned to a scope such as a management group, subscription, resource group, or individual resource. Defender for Cloud assesses resources continuously, shows any resource that does not comply with a policy as a recommendation, and the more recommendations you resolve, the higher the secure score goes.

!How security policies flow into recommendations and the secure score

Exam tip: "Several policy definitions grouped toward one goal" is an initiative. Also remember that nobody writes recommendations by hand; they are generated automatically from policy assessment results.

---

Microsoft Cloud Security Benchmark (MCSB)

When you first turn on Defender for Cloud, the Microsoft cloud security benchmark (MCSB) is automatically assigned as the default security initiative. MCSB is a set of cloud-centric security guidelines written by Microsoft and built on the controls of CIS (Center for Internet Security) and NIST (National Institute of Standards and Technology).

Organized into control domains such as network security, identity management, privileged access, data protection, data recovery, incident response, and endpoint security Maps each item to industry frameworks such as CIS, NIST, and PCI DSS Gives implementation guidance not only for Azure but also for AWS and GCP

The regulatory compliance dashboard shows how well you comply with MCSB and any other standards you have applied. Standards such as ISO 27001, SOC 2, NIST SP 800-53, and PCI DSS can be added once you turn on the enhanced security features of a paid Defender plan.

Exam tip: The regulatory compliance dashboard in Defender for Cloud automatically assesses whether cloud resource configurations meet a standard. Its scope differs from Microsoft Purview Compliance Manager, which manages compliance improvement actions across the whole organization.

---

Recommendations and the Secure Score

Each recommendation contains the following information.

A short description of the security issue The steps to remediate it The affected resources Severity (high, medium, or low) and risk factors Attack path context (when available)

The secure score rolls up all assessment results into a single number so you can see your current security posture at a glance; the higher the score, the lower the identified risk. Related recommendations are grouped into security controls, and the score for a resource rises only when you remediate all of that resource's recommendations within a control.

Exam tip: The secure score in Defender for Cloud scores cloud resources, while Microsoft Secure Score in the Defender portal scores Microsoft 365 as a whole. Check first whether the question is about Azure resources or Microsoft 365.

Related post: SC-900 Look-Alike Services: A Side-by-Side Comparison

---

Foundational CSPM vs Defender CSPM

| Aspect | Foundational CSPM | Defender CSPM | |------|------|------| | Cost | Free; enabled automatically when you turn on Defender for Cloud | Paid plan | | Includes | Asset discovery, continuous assessment and recommendations, MCSB compliance, secure score | Everything in foundational CSPM plus the advanced features below | | Attack path analysis | No | Models how an attacker could chain vulnerabilities to reach critical resources | | Cloud security explorer | No | Explores the security state directly with graph queries | | Governance | No | Assigns an owner and a due date to each recommendation | | Data and AI security posture | No | Finds and assesses datastores holding sensitive data and generative AI workloads | | Risk prioritization | By severity | Also considers internet exposure and whether sensitive data is involved |

Exam tip: "Secure score and recommendations at no extra cost" is foundational CSPM. If you see "attack path analysis" or "cloud security explorer," it is Defender CSPM.

---

Cloud Workload Protection: Defender Plans

CWP comes as Defender plans for each resource type. You turn on only the plans you need, and several plans can run at the same time.

| Defender plan | What it protects | |------|------| | Defender for Servers | Windows and Linux machines (includes EDR from Defender for Endpoint and vulnerability scanning) | | Defender for App Service | Attacks targeting apps running on App Service | | Defender for Storage | Harmful activity on Azure Storage accounts | | Defender for Databases | Azure SQL, open-source relational databases, Azure Cosmos DB | | Defender for Containers | Kubernetes environments, container registries, runtime threats | | Defender for Key Vault | Unusual access to Key Vault | | Defender for Resource Manager | Monitoring of resource management operations | | Defender for AI Services | Threats to AI services such as prompt injection attacks | | Defender for APIs | Security posture and real-time threats for business-critical APIs |

Turning on a plan unlocks enhanced security features such as threat protection alerts; vulnerability scanning for VMs, container registries, and SQL; machine learning–based application allow lists; and just-in-time (JIT) VM access, which opens VM management ports only when needed. Defender for Cloud also includes DevOps security, which connects GitHub, Azure DevOps, and GitLab to find security issues in code and infrastructure as code (IaC).

Exam tip: As with "detect unusual access to Azure Storage accounts" pointing to Defender for Storage, the name of the protected resource is the name of the plan.