| name | defender_secure_score_monitor |
| description | Monitor and improve Microsoft Defender for Cloud Secure Score. Tracks score trends, identifies quick wins, checks Defender plan coverage, and highlights critical security recommendations. Use when asked about secure score, security posture, or Defender status. |
Defender Secure Score Monitor
Purpose
Track and improve your Microsoft Defender for Cloud Secure Score through focused monitoring, trend analysis, and actionable remediation guidance.
Procedure
Step 1: Current Secure Score
az rest --method get --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Security/secureScores/ascScore?api-version=2020-01-01"
az rest --method get --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Security/secureScores/ascScore/secureScoreControls?api-version=2020-01-01"
Report current score (X/Y points, Z%), top 5 controls with most room for improvement.
Step 2: Unhealthy assessments
az rest --method get --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Security/assessments?api-version=2021-06-01" \
--query "value[?properties.status.code=='Unhealthy'].{displayName:properties.displayName, severity:properties.metadata.severity}"
Group by severity: 🔴 High, 🟡 Medium, 🟢 Low.
Step 3: Quick wins
Identify recommendations that affect the most resources, have the highest point value, and can be fixed with a single command or policy (HTTPS-only, secure transfer, enable Defender plans, restrict public access).
Step 4: Defender plan coverage
az security pricing list --query "[].{plan:name, tier:pricingTier, subPlan:subPlan}" -o table
Check: Servers (P2), App Service, SQL, Storage, Containers, Key Vault, Resource Manager, DNS. Flag disabled plans with estimated score impact.
Step 5: Attack surface indicators
- Public management ports (SSH/RDP open to internet)
- Storage accounts with public blob access
- SQL servers with public endpoint
- Key Vaults accessible from public network
Step 6: Credential hygiene
Check Key Vault secrets and certificates expiring within 30 days, and app registrations with expiring credentials.
Scoring
| Level | Criteria |
|---|
| 🔴 Critical | Active exposure, immediate risk |
| 🟠 High | Significant gap, low-effort exploit |
| 🟡 Medium | Gap exists, specific conditions needed |
| 🟢 Low | Best practice deviation, minimal risk |
Sample output
| Field | Value |
|---|
| Subscription | contoso-prod-001 |
| Secure Score | 38.50 / 56 (69%) |
| Priority | Action | Points | Effort |
|---|
| 1 | Enable HTTPS-only on 3 App Services | +4 | 5 min |
| 2 | Enable Defender for Storage | +3 | 2 min |
| 3 | Restrict SQL public access | +3 | 30 min |
| Total achievable | | +10 | ~40 min |
References
