%3CLINGO-SUB%20id%3D%22lingo-sub-1749193%22%20slang%3D%22en-US%22%3EQuerying%20your%20Secure%20Score%20Across%20Multiple%20Subscriptions%20in%20Azure%20Security%20Center%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1749193%22%20slang%3D%22en-US%22%3E%3CP%3EAlthough%20the%20capability%20to%20query%20the%20Secure%20Score%20using%20API%20was%20already%20available%20and%20we%20already%20published%20some%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Security-Center%2Ftree%2Fmaster%2FSecure%2520Score%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eautomations%3C%2FA%3E%20to%20leverage%20this%20capability%2C%20now%20you%20can%20also%20query%20your%20Secure%20Score%20using%20Azure%20Resource%20Graph%20(ARG).%20In%20addition%2C%20you%20will%20be%20able%20to%20calculate%20the%20score%20for%20the%20security%20controls%20and%20accurately%20calculate%20the%20aggregated%20score%20across%20multiple%20subscriptions.%20The%20following%20tables%20were%20added%20to%20allow%20you%20to%20query%20not%20only%20the%20secure%20score%2C%20but%20also%20the%20security%20controls%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig1.JPG%22%20style%3D%22width%3A%20413px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224399iBA7E955E1BD8CA56%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig1.JPG%22%20alt%3D%22Fig1.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EHere%20an%20example%20of%20how%20to%20query%20your%20current%20secure%20score%20(percentage)%3A%3C%2FP%3E%0A%3CP%3ESecurityResources%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B'microsoft.security%2Fsecurescores'%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3Bcurrent%26nbsp%3B%3D%26nbsp%3Bproperties.score.current%2C%26nbsp%3Bmax%26nbsp%3B%3D%26nbsp%3Btodouble(properties.score.max)%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bproject%26nbsp%3BsubscriptionId%2C%26nbsp%3Bcurrent%2C%26nbsp%3Bmax%2C%26nbsp%3Bpercentage%26nbsp%3B%3D%26nbsp%3B((current%26nbsp%3B%2F%26nbsp%3Bmax)*100)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20query%20will%20return%20an%20output%20that%20looks%20like%20this%20one%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig2.JPG%22%20style%3D%22width%3A%20587px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224400iF1E5510C96A2B29D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig2.JPG%22%20alt%3D%22Fig2.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThis%20corresponds%20to%20what%20you%20see%20in%20the%20UI%20for%20your%20subscription.%20In%20this%20case%2C%20ASC%20dashboard%20show%20the%20following%20Secure%20Score%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig3.JPG%22%20style%3D%22width%3A%20749px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224401i072E1355C40E3D28%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig3.JPG%22%20alt%3D%22Fig3.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThis%20other%20example%20below%20will%20list%20all%20security%20controls%2C%20the%20amount%20of%20unhealthy%20resources%2C%20their%20current%20score%20and%20their%20max%20score%3A%3C%2FP%3E%0A%3CP%3ESecurityResources%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B'microsoft.security%2Fsecurescores%2Fsecurescorecontrols'%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3BSecureControl%26nbsp%3B%3D%26nbsp%3Bproperties.displayName%2C%26nbsp%3Bunhealthy%26nbsp%3B%3D%26nbsp%3Bproperties.unhealthyResourceCount%2C%26nbsp%3Bcurrentscore%26nbsp%3B%3D%26nbsp%3Bproperties.score.current%2C%26nbsp%3Bmaxscore%26nbsp%3B%3D%26nbsp%3Bproperties.score.max%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bproject%26nbsp%3BSecureControl%26nbsp%3B%2C%26nbsp%3Bunhealthy%2C%26nbsp%3Bcurrentscore%2C%26nbsp%3Bmaxscore%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20output%20should%20look%20like%20the%20example%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig4.JPG%22%20style%3D%22width%3A%20756px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224402iC7C26F7993BF1558%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig4.JPG%22%20alt%3D%22Fig4.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ECalculating%20the%20Secure%20Score%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EFor%20a%20single%20subscription%20the%20type%20of%20resource%20we%20are%20calling%20is%20the%20%3CEM%3Emicrosoft.security%2Fsecurescores%3C%2FEM%3E%20where%20we%20get%20the%20maximum%20score%20(%E2%88%91%20maximum%20scores%20of%20each%20security%20control)%20and%20the%20current%20score%20(%E2%88%91%20current%20scores%20of%20each%20security%20control).%26nbsp%3B%20To%20obtain%20the%20secure%20score%20of%20a%20single%20subscription%2C%20the%20following%20formula%20is%20used%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig5.JPG%22%20style%3D%22width%3A%20757px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224403iE21F1151FD83E42C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig5.JPG%22%20alt%3D%22Fig5.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ETo%20obtain%20the%20aggregated%20secure%20score%20for%26nbsp%3B%3CEM%3Emultiple%20subscriptions%3C%2FEM%3E%20you%20should%20use%20the%20formula%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig6.JPG%22%20style%3D%22width%3A%20769px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224404i44DA654C4545EA15%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig6.JPG%22%20alt%3D%22Fig6.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EAs%20you%20can%20see%20in%20the%20formula%2C%20the%20aggregated%20score%20for%20multiple%20subscriptions%20is%20not%20the%20average%2C%20it%20uses%20the%20%3CEM%3Eweight%3C%2FEM%3E%26nbsp%3Bfield%20that%20is%20provided%20in%20the%20query%20(ARG%20or%20API).%20The%20weight%20takes%20in%20account%20the%20size%20of%20the%20subscription%20(%23%20of%20resources%20)%20and%20hence%20allows%20to%20calculate%20a%20weighted%20score%20which%20is%20more%20accurate%20than%20a%20regular%20average%20between%20different%20subscriptions%20with%20different%20sizes.%20For%20more%20information%20refer%20to%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsecurity-center%2Fsecure-score-security-controls%23how-your-secure-score-is-calculated%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Esecure%20score%20documentation%20page%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20see%20how%20this%20looks%20like%2C%20let%E2%80%99s%20use%20the%20query%20below%20as%20an%20example%3A%3C%2FP%3E%0A%3CP%3Esecurityresources%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.security%2Fsecurescores%22%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3BsubscriptionScore%26nbsp%3B%3D%26nbsp%3Btodouble(properties.score.current)%2Ftodouble(properties.score.max)%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3BsubScoreXsubWeight%26nbsp%3B%3D%26nbsp%3Btodouble(subscriptionScore)*todouble(properties.weight)%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bsummarize%26nbsp%3BupperValue%26nbsp%3B%3D%26nbsp%3Bsum(subScoreXsubWeight)%2C%26nbsp%3BunderValue%26nbsp%3B%3D%26nbsp%3Bsum(todouble(properties.weight))%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3BoverallScore%26nbsp%3B%3D%26nbsp%3Bround(100*((upperValue)%2F(underValue)))%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bproject%26nbsp%3BoverallScore%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20%3CEM%3EsubscriptionScore%3C%2FEM%3E%20is%20obtained%20dividing%20its%20current%20score%20by%20its%20maximum%20score.%20Then%2C%20the%20value%20%3CEM%3EsubScoreXsubWeight%3C%2FEM%3E%20holds%20the%20subscription%20%3CEM%3Esecure%20score%3C%2FEM%3E%20times%20the%20subscription%20%3CEM%3Eweight%3C%2FEM%3E.%20Finally%2C%20the%20overall%20score%20is%20the%20sum%20of%20%3CEM%3EsubScoreXsubWeight%3C%2FEM%3E%20divided%20by%20the%20sum%20of%20the%20subscriptions%E2%80%99%20%3CEM%3Eweights%3C%2FEM%3E.%20The%20result%20is%20shown%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig7.JPG%22%20style%3D%22width%3A%20339px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224405i6816FAE55D7DF45A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Fig7.JPG%22%20alt%3D%22Fig7.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOne%20of%20the%20advantages%20of%20querying%20the%20secure%20score%20via%20ARG%20is%20that%20you%20can%20quickly%20use%20these%20queries%20to%20create%20custom%20dashboard%20with%20Azure%20Workbooks.%20If%20you%20are%20querying%20the%20secure%20score%20using%20API%2C%20you%20can%20send%20a%20GET%20Request%20as%20shown%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGET%20%3CA%20href%3D%22https%3A%2F%2Fmanagement.azure.com%2Fsubscriptions%2F20ff7fc3-e762-44dd-bd96-b71116dcdc23%2Fproviders%2FMicrosoft.Security%2FsecureScores%2FascScore%3Fapi-version%3D2020-01-01-preview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmanagement.azure.com%2Fsubscriptions%2F20ff7fc3-e762-44dd-bd96-b71116dcdc23%2Fproviders%2FMicrosoft.Security%2FsecureScores%2FascScore%3Fapi-version%3D2020-01-01-preview%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20the%20JSON%20result%20you%20will%20see%20the%20%3CEM%3Eweight%3C%2FEM%3E%20field%2C%20which%20is%20used%20to%20calculate%20the%20secure%20score%20is%20also%20available%20as%20shown%20the%20sample%20below%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Fig8.JPG%22%20style%3D%22width%3A%20602px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F224406i09FEAB883BD17E98%2Fimage-dimensions%2F602x282%3Fv%3D1.0%22%20width%3D%22602%22%20height%3D%22282%22%20title%3D%22Fig8.JPG%22%20alt%3D%22Fig8.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EFor%20more%20information%20about%20the%20Secure%20Score%20API%2C%20read%20the%20following%20articles%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Fsecuritycenter%2Fsecurescores%2Fget%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3ESecure%20Scores%20-%20Get%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Fsecuritycenter%2Fsecurescorecontrols%2Flistbysecurescore%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3ESecure%20Score%20Controls%20-%20List%20By%20Secure%20Score%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EMake%20sure%20to%20utilize%20this%20feature%20and%20provide%20your%20feedback%20in%20the%20comments%20below%2C%20or%20if%20you%20want%20to%20formally%20suggest%20improvements%2C%20provide%20your%20feedback%20at%20%3CA%20href%3D%22https%3A%2F%2Faka.ms%2Fascuservoice%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Faka.ms%2Fascuservoice%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EThanks%20to%20all%20Reviewers%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EMiri%20Landau%2C%20Senior%20PM%20%E2%80%93%20Azure%20Security%20Center%20Engineering%20Team%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EMeital%20Taran-%20Gutman%2C%20Principal%20PM%20%E2%80%93%20Azure%20Security%20Center%20Engineering%20Team%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EFernanda%20Vela%20Huerta%2C%20PM%20%E2%80%93%20CxE%20Azure%20Security%20Center%20Team%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Although the capability to query the Secure Score using API was already available and we already published some automations to leverage this capability, now you can also query your Secure Score using Azure Resource Graph (ARG). In addition, you will be able to calculate the score for the security controls and accurately calculate the aggregated score across multiple subscriptions. The following tables were added to allow you to query not only the secure score, but also the security controls:

 

Fig1.JPG

Here an example of how to query your current secure score (percentage):

SecurityResources 

| where type == 'microsoft.security/securescores' 

| extend current = properties.score.current, max = todouble(properties.score.max)

| project subscriptionId, current, max, percentage = ((current / max)*100)

 

This query will return an output that looks like this one:

Fig2.JPG

This corresponds to what you see in the UI for your subscription. In this case, ASC dashboard show the following Secure Score:

 

Fig3.JPG

This other example below will list all security controls, the amount of unhealthy resources, their current score and their max score:

SecurityResources 

| where type == 'microsoft.security/securescores/securescorecontrols' 

| extend SecureControl = properties.displayName, unhealthy = properties.unhealthyResourceCount, currentscore = properties.score.current, maxscore = properties.score.max

| project SecureControl , unhealthy, currentscore, maxscore

 

The output should look like the example below:

 

Fig4.JPG

 

Calculating the Secure Score

For a single subscription the type of resource we are calling is the microsoft.security/securescores where we get the maximum score (∑ maximum scores of each security control) and the current score (∑ current scores of each security control).  To obtain the secure score of a single subscription, the following formula is used:

 

Fig5.JPG

To obtain the aggregated secure score for multiple subscriptions you should use the formula below:

 

Fig6.JPG

As you can see in the formula, the aggregated score for multiple subscriptions is not the average, it uses the weight field that is provided in the query (ARG or API). The weight takes in account the size of the subscription (# of resources ) and hence allows to calculate a weighted score which is more accurate than a regular average between different subscriptions with different sizes. For more information refer to the secure score documentation page.

 

To see how this looks like, let’s use the query below as an example:

securityresources

| where type == "microsoft.security/securescores"

| extend subscriptionScore = todouble(properties.score.current)/todouble(properties.score.max)

| extend subScoreXsubWeight = todouble(subscriptionScore)*todouble(properties.weight)

| summarize upperValue = sum(subScoreXsubWeight), underValue = sum(todouble(properties.weight))

| extend overallScore = round(100*((upperValue)/(underValue)))

| project overallScore

 

The subscriptionScore is obtained dividing its current score by its maximum score. Then, the value subScoreXsubWeight holds the subscription secure score times the subscription weight. Finally, the overall score is the sum of subScoreXsubWeight divided by the sum of the subscriptions’ weights. The result is shown below:

 

Fig7.JPG

 

One of the advantages of querying the secure score via ARG is that you can quickly use these queries to create custom dashboard with Azure Workbooks. If you are querying the secure score using API, you can send a GET Request as shown below:

 

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft....

 

In the JSON result you will see the weight field, which is used to calculate the secure score is also available as shown the sample below:

Fig8.JPG

For more information about the Secure Score API, read the following articles:

Make sure to utilize this feature and provide your feedback in the comments below, or if you want to formally suggest improvements, provide your feedback at https://aka.ms/ascuservoice

 

Thanks to all Reviewers

Miri Landau, Senior PM – Azure Security Center Engineering Team

Meital Taran- Gutman, Principal PM – Azure Security Center Engineering Team

Fernanda Vela Huerta, PM – CxE Azure Security Center Team