L15. Managing Security Posture with Defender CSPM, Compliance & External Attack Surface Management

Identifying Security Risks with Defender CSPM

Defender Cloud Security Posture Management (Defender CSPM) is the premium posture-management plan that goes beyond basic Secure Score recommendations:

• Cloud security graph: models resources, their configurations, and their relationships (identities, network paths, data stores) as a connected graph rather than a flat resource list
• Attack path analysis: uses that graph to identify actual exploitable chains, for example, an internet-exposed VM with a vulnerability, that has a managed identity, that has Contributor rights on a subscription containing a database with sensitive data, surfacing the *combination* of individually low-severity issues that together form a real attack path
• Agentless scanning: for VMs, containers, and secrets (as covered in Lesson 3 and Lesson 13), providing coverage without deploying an agent everywhere

Evaluating Compliance Against Security Frameworks

As covered in Lesson 4, Defender for Cloud's regulatory compliance dashboard measures your environment against assigned standards continuously, not just at audit time, with every control traceable back to specific underlying recommendations and resources.

Enabling Workload Protection Plans

Defender for Cloud's protections are organized into per-resource-type workload protection plans that must be individually enabled: Defender for Servers, Storage, SQL/Databases, Key Vault, Containers, DNS, APIs, and others each turn on independently, so coverage should be reviewed resource-type by resource-type rather than assuming "Defender for Cloud is on" means everything is protected.

Multicloud and Hybrid Connectivity

Defender for Cloud connects to AWS and GCP through native cloud connectors, using each provider's own security services (like AWS Security Hub or GCP Security Command Center findings) alongside Azure-native signals, giving one unified posture view across all three clouds instead of three separate consoles. Auto-provisioning can automatically deploy the required agents/extensions to newly discovered resources in connected accounts as they appear, so coverage doesn't lag behind resource sprawl.

Configuring Defender Vulnerability Management

Microsoft Defender Vulnerability Management settings for Azure VMs provide continuous, agent-based (via Defender for Endpoint) discovery of software inventory, missing patches, and misconfigurations, going deeper than the periodic snapshot-based agentless vulnerability findings by continuously tracking a VM's exposed vulnerabilities as its installed software changes over time.

Discovering Unprotected Assets with Defender EASM

Microsoft Defender External Attack Surface Management (EASM) takes an explicitly outside-in view: it discovers internet-facing assets belonging to your organization the way an attacker doing reconnaissance would, including shadow IT never registered with central IT, forgotten subdomains, expired certificates on still-resolving hostnames, and third-party/subsidiary infrastructure connected to your brand. This is a fundamentally different discovery model from CSPM (which analyzes resources already known to be in your Azure/AWS/GCP subscriptions): EASM's entire value is surfacing what you didn't know was there in the first place. Exam tip: A scenario about "combining multiple individually low-risk findings into one exploitable chain" is Defender CSPM attack path analysis; a scenario about "discovering an internet-facing asset nobody in IT knew existed" is Defender EASM, since EASM operates entirely outside the boundary of what's already inventoried in your cloud subscriptions.