Microsoft Defender Cloud Security Posture Management (Defender CSPM) provides agentless, multicloud protection for Azure, AWS, and GCP. This post outlines a fast-start checklist to help you enable and operationalize Defender CSPM effectively.
When it comes to securing your multicloud environment, Microsoft Defender Cloud Security Posture Management offers a powerful suite of agentless capabilities. This blog post walks through a fast-start checklist to help you enable and operationalize DCSPM effectively, covering Policy Configuration, RBAC, enablement, and snapshot expectations.
In this article, we’ll go step-by-step through the key actions needed to enable Microsoft Defender CSPM and start gaining visibility, context, and protection across your multicloud workloads:
1. Enable Defender CSPM Plan
To get started:
- In Azure Portal → Defender for Cloud → Environment settings → Select subscription.
- Toggle Defender CSPM plan → On → Save.
➡️ Must be enabled at the subscription level. Not supported at resource or resource group level.
➡️ Subscription Owner role is required to fully activate advanced components like agentless scanning. Contributors or Security Admins may toggle plan but lack full access.
Clarification Note: While the DCSPM plan itself can only be toggled at the subscription level, organizations can use Azure Policy to enforce CSPM enablement at management group scope. This ensures all existing and future subscriptions in that management group will have the plan enabled automatically.
2. Enable Key CSPM Components
When the Defender CSPM plan is enabled at subscription level, you unlock a set of advanced posture capabilities that do not require agents. These features strengthen visibility, risk assessment, and prioritization across your multicloud environment. The examples below highlight some of the core capabilities available, but Defender CSPM includes additional features and continuous enhancements beyond this list.
What it does: Creates temporary, isolated disk snapshots of Azure VMs, AWS EC2, and GCP compute instances to identify vulnerabilities, exposed secrets, and missing EDR coverage. No performance impact.
Example: An enterprise scans thousands of unmanaged servers without deploying agents, detecting unpatched software and secrets in clear text.
What it does: Provides agentless discovery of Kubernetes clusters (AKS, EKS, GKE) and connected container registries. Surfaces misconfigurations and posture risks through CSPM.
Important note: Vulnerability scanning of running containers is part of the Defender for Containers (CWPP plan), not DCSPM. DCSPM complements by identifying misconfigurations, risky exposures, and attack paths.
Example: A DevOps team enables DCSPM and sees misconfigured public endpoints on AKS clusters. To extend protection, they also enable Defender for Containers for runtime vulnerability scanning.
What it does: Detects sensitive data (PII, financial records, health data, etc.) across storage, databases, and other services using Microsoft Purview classification and smart sampling.
Example: A healthcare provider discovers unencrypted patient files in an Azure storage account, flagged as “Sensitive” via Purview labels.
What it does: Identifies excessive permissions and risky identity configurations across multicloud environments. Provides least privilege recommendations.
Example: A user account with Contributor roles on multiple subscriptions is flagged as overly permissive, reducing risk of lateral movement in case of compromise.
What it does: Security Graph maps relationships between assets, permissions, misconfigurations, and threats. Cloud Security Explorer provides query-based search on this graph.
Example: A security analyst queries for all internet-facing VMs with exploitable CVEs connected to privileged accounts, identifying a potential attack path.
What it does: Automatically surfaces potential attack paths to critical assets and ranks them by business risk. Suggests concrete remediation steps to break the chain.
Example: A financial institution detects a path from a public storage container → high-privilege identity → sensitive SQL database, and immediately closes the misconfigured endpoint.
7. Business Risk Prioritization (AI-Powered)
What it does: Uses contextual signals (exposure, sensitive data, exploitability) to prioritize security recommendations by business impact.
Example: Instead of fixing all medium-severity CVEs, the system highlights one critical VM that stores sensitive payment data and is internet-exposed, driving focus on the highest-impact fix.
Note: Defender CSPM includes additional capabilities not listed here. For the complete list, please visit this article.
3. Policy Configuration
A. Built-in Policy for DCSPM
Microsoft provides a built-in policy called “Microsoft Defender CSPM should be enabled” which can be assigned at the subscription or management group level. The policy currently uses the AuditIfNotExists effect to identify subscriptions where the Defender CSPM plan is not yet enabled.
This allows organizations to monitor compliance and ensure consistent coverage across their environment.
Purpose: enforce that the Defender CSPM plan is consistently enabled across subscriptions without relying on manual configuration.
Clarification Note: Azure Policy does not enable DCSPM “once for the whole management group.” Instead, it ensures that each subscription under that management group has the DCSPM plan activated individually.
B. Microsoft Cloud Security Benchmark (MCSB)
When Defender for Cloud is enabled, the Microsoft Cloud Security Benchmark is the default initiative applied. It provides a comprehensive set of security controls mapped to industry best practices.
The initiative is delivered as an Azure Policy initiative and drives both recommendations and Secure Score calculations.
C. Regulatory Standards and Custom Recommendations
In addition to MCSB, organizations can assign additional regulatory compliance standards (e.g., ISO 27001, GDPR, PCI DSS).
Defender CSPM also allows you to define custom security standards using: Azure Policy definitions, or KQL-based custom recommendations in Defender for Cloud.
These custom standards integrate directly into the Regulatory Compliance dashboard.
4. Evaluation Process
Once policies/initiatives are assigned, Defender for Cloud continuously assesses resources against them.
Each recommendation includes:
- The security risk and description.
- The list of affected resources.
- Remediation guidance.
- Potential attack paths if relevant.
These results are visible in the Recommendations page, and they may contribute to Secure Score.
5. Implementation Best Practices
- Deployment at scale → Apply policies at the management group level for consistent coverage across multiple subscriptions.
- Enforce consistency → Use “Microsoft Defender CSPM should be enabled” policy with DeployIfNotExists.
- Add benchmarks → Start with MCSB, then layer regulatory standards (PCI, GDPR, etc.) as required by your environment.
- Customize if needed → Use KQL-based recommendations to capture organization-specific posture requirements.
Note: For further guidelines on how to deploy at scale, visit this article.
6. RBAC Permissions Setup
Ensuring the correct Role-Based Access Control (RBAC) assignments is essential for effective deployment and operation of Defender CSPM features.
I. Role Requirements for Enabling DCSPM Components
- The Subscription Owner role is required to enable key DCSPM features, such as agentless scanning, Kubernetes discovery, and other posture components; as these require elevated permissions that lesser roles don't have.
- While a lower-level role like Security Admin or Contributor could toggle the CSPM plan, many components would not activate fully without Owner privileges.
II. Contributor, Reader, and Security Roles for Operations
- To view resource security status in Defender for Cloud, including recommendations, inventory, and Secure Score, a user needs Owner, Contributor, or Reader role on the subscription or resource group.
- To modify a security policy, assign compliance-related settings, or act on recommendations, the user must have either Security Administrator or Owner role in the subscription.
III. Managed Identities and DCSPM Agent Roles
- Defender for Cloud uses service principals (managed identities) to operate features like agentless scanning. These principals require specific permissions depending on the environment. For example:
- Defender CSPM for AWS uses a role named CspmMonitorAws with permissions scoped to resource reading.
- For agentless VM scanning (including snapshot creation), a managed identity like DefenderForCloud-AgentlessScanner is created with snapshot-related permissions.
IV. RBAC Inheritance via Management Groups
- To scale securely, it’s best to assign roles at the management group level. Roles assigned here automatically propagate to parent subscriptions, enabling uniform access control across environments.
This eliminates the need to replicate the same role assignments subscription by subscription.
7. Snapshot & Sensitive Data Discovery Expectation
I. Activation
Sensitive Data Discovery (part of Data Security Posture Management – DSPM) is enabled automatically when the Defender CSPM plan or Defender for Storage plan is turned on. No agent is required; the capability is built into Defender CSPM.
II. Timeframes for Discovery
- Initial results: Up to 24 hours after enabling DSPM for the first time.
- New Azure Storage accounts: Scanned within 24 hours of being created in an enabled subscription.
- AWS S3 / GCP Storage buckets: Discovery and first scan occur within 48 hours or less.
- Databases (Azure SQL, AWS RDS, GCP Cloud SQL): First scan may take up to 24 hours, with weekly rescans thereafter.
III. Regional Processing & Data Privacy
All scans run locally in the resource’s region, no cross-region transfers of customer data. Only metadata is stored by Defender for Cloud (resource ID, bucket names, sensitivity labels, classification results). Actual data content is never stored or moved outside the customer’s region.
Note: For more information about data privacy in Defender for Cloud, visit this article.
IV. Disk Snapshot Usage
For certain environments (e.g., AWS RDS databases), Defender for Cloud uses the latest automated disk snapshot to perform scanning.
Process: a secure, isolated copy is created → scanned in-region → then deleted after completion. This ensures zero performance impact on the production workload.
V. Best Practices
- Set clear expectations with stakeholders: scanning results are not immediate, and timing may vary according to the size of the environment, allow at least ~24h for first results.
- Continuous monitoring: ideally you should visit Defender for Cloud dashboard daily, since some recommendations will have shorter freshness time (update interval).
- Monitor Regulatory Compliance dashboard: sensitive data findings feed into posture reports and recommendations.
- Combine with access reviews: align sensitive data locations with RBAC/CIEM insights to mitigate insider risk.
Note: For more information about agentless machine scanning and disk snapshot, visit this article.
8. Monitoring, Recommendations & Secure Score
I. Recommendations Freshness and Prioritization
- Defender for Cloud continuously assesses your resources against security standards (MCSB, regulatory, and custom standards), generating security recommendations that include remediation steps, affected resources, associated risk level, risk factors, and even potential attack paths.
- To rank the recommendations, Defender CSPM dynamically prioritizes issues based on risk factors like internet exposure, sensitive data access, and lateral movement potential, adding context-specific business impact.
II. Secure Score Overview
- The Secure Score provides a single, aggregated numeric score to represent your cloud security posture. A higher score indicates fewer unresolved security issues.
- The Microsoft Cloud Security Benchmark (MCSB) controls are utilized to build recommendations that will directly influence the secure score.
- Only GA (non-preview) recommendations are considered for the secure score.
- Updates:
- Each recommendation has a different freshness interval, which means that secure score may get updated in different moments of the day
- Once freshness interval is reached, Secure Score is updated accordingly to reflect the latest resource compliance.
III. Continuous Export & Trend Monitoring
You can set up continuous export of security data (recommendations, alerts, secure score, compliance, attack paths) to external destinations like:
- Azure Log Analytics, Event Hubs, or a SIEM/SOAR solution.
Export modes:
- Streaming – data sent as soon as updates occur.
- Snapshots – weekly captures of current data state.
Note: For more information about Continuous Export, visit this article.
IV. Tracking Secure Score Over Time
Defender for Cloud includes built-in workbooks such as Secure Score Over Time, visualizing score trends, control breakdowns, and how remediation affects the score.
These workbooks require continuous export of data (streaming and snapshots) to function.
Note: Snapshots are exported weekly; there is a delay of at least one week before you can view time-based trends.
Conclusion
Microsoft Defender CSPM is more than a configuration; it’s a strategic enabler for multicloud security posture. By following this fast-start checklist, organizations can:
- Accelerate onboarding with subscription-level enablement and Azure Policy enforcement.
- Unlock agentless capabilities for vulnerability scanning, Kubernetes discovery, and sensitive data protection without operational overhead.
- Strengthen governance through RBAC alignment, regulatory benchmarks, and custom posture controls.
- Prioritize risk intelligently using attack path analysis and AI-driven business impact scoring.
The result? A proactive, scalable approach to cloud security posture management that reduces risk and improves compliance across Azure, AWS, and GCP. Start small, enforce consistency, and leverage Defender CSPM’s advanced features to stay ahead of evolving threats.
Further Reading & Official Microsoft Resources
- Microsoft Defender for Cloud Overview
Learn the fundamentals of Defender for Cloud and its integrated security posture management.
Microsoft Defender for Cloud Overview - Microsoft Defender for Cloud | Microsoft Learn - Enable Microsoft Defender CSPM Plan
Step-by-step guide to activate CSPM capabilities in your subscriptions.
Protect your resources with Defender CSPM - Microsoft Defender for Cloud | Microsoft Learn - Agentless Scanning and Data Collection
Understand how agentless scanning works for VMs, Kubernetes, and storage.
Agentless machine scanning in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn - Attack Path Analysis
Explore how Defender CSPM identifies and breaks attack paths.
Investigate risks with security explorer/attack paths in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn - Secure Score and Security Controls
Learn how Secure Score reflects your cloud security posture.
Secure score in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn - Azure Policy for Defender CSPM
Enforce CSPM enablement and compliance at scale.
Overview of Azure Policy - Azure Policy | Microsoft Learn - Microsoft Cloud Security Benchmark (MCSB)
Industry-aligned security controls for Azure environments.
Overview of the Microsoft cloud security benchmark | Microsoft Learn - Regulatory Compliance in Defender for Cloud
Map posture to standards like ISO, PCI DSS, and GDPR.
Regulatory compliance in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn - Role-Based Access Control (RBAC) in Azure
Assign roles for secure and scalable CSPM operations.
What is Azure role-based access control (Azure RBAC)? | Microsoft Learn - Continuous Export of Security Data
Export posture data for SIEM/SOAR integration and trend analysis.
Export alerts and recommendations with continuous export - Microsoft Defender for Cloud | Microsoft Learn
Microsoft