Defender Secure Score Monitor

Purpose

Track and improve your Microsoft Defender for Cloud Secure Score through focused monitoring, trend analysis, and actionable remediation guidance.

Procedure

Step 1: Current Secure Score

az rest --method get --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Security/secureScores/ascScore?api-version=2020-01-01"

az rest --method get --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Security/secureScores/ascScore/secureScoreControls?api-version=2020-01-01"

Report current score (X/Y points, Z%), top 5 controls with most room for improvement.

Step 2: Unhealthy assessments

az rest --method get --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Security/assessments?api-version=2021-06-01" \
  --query "value[?properties.status.code=='Unhealthy'].{displayName:properties.displayName, severity:properties.metadata.severity}"

Group by severity: 🔴 High, 🟡 Medium, 🟢 Low.

Step 3: Quick wins

Identify recommendations that affect the most resources, have the highest point value, and can be fixed with a single command or policy (HTTPS-only, secure transfer, enable Defender plans, restrict public access).

Step 4: Defender plan coverage

az security pricing list --query "[].{plan:name, tier:pricingTier, subPlan:subPlan}" -o table

Check: Servers (P2), App Service, SQL, Storage, Containers, Key Vault, Resource Manager, DNS. Flag disabled plans with estimated score impact.

Step 5: Attack surface indicators

1. Public management ports (SSH/RDP open to internet)
2. Storage accounts with public blob access
3. SQL servers with public endpoint
4. Key Vaults accessible from public network

Step 6: Credential hygiene

Check Key Vault secrets and certificates expiring within 30 days, and app registrations with expiring credentials.

Scoring

Sample output

References

• Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
• Security Recommendations: https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference
• Defender Plans: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction