cloud-app-security-posture

name	cloud-app-security-posture
description	Guidance for cloud and SaaS security posture management - combining Defender for Cloud CSPM (IaaS/PaaS) and Defender for Cloud Apps SSPM (SaaS) to assess and harden posture across cloud and SaaS apps. Covers Secure Score, MCSB, attack-path analysis, SSPM recommendations, and governance. WHEN: cloud security posture, SaaS security posture management, SSPM, CSPM, secure cloud apps, posture recommendations, harden SaaS configuration, app security posture, multicloud and SaaS hardening, harden Microsoft 365 SaaS settings, find misconfigured Salesforce or ServiceNow settings, SaaS app misconfiguration. DO NOT USE for IaaS/PaaS workload threat protection plans (use defender-for-cloud-hardening) or for SaaS threat detection only (use defender-for-cloud-apps).
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0"}

Cloud & App Security Posture

Security posture management spans two complementary layers: CSPM for cloud infrastructure (IaaS/PaaS) via Microsoft Defender for Cloud, and SSPM for SaaS applications via Microsoft Defender for Cloud Apps. Together they continuously reduce misconfiguration risk across the cloud and SaaS estate.

When to use

Assessing and continuously hardening configuration posture across both cloud infrastructure and SaaS applications - especially when remediation has stalled or when you cannot answer "what should we fix next?".

Do not use this skill for:

• IaaS/PaaS workload threat protection plans (use defender-for-cloud-hardening)
• SaaS threat detection or shadow-IT discovery only (use defender-for-cloud-apps)
• DSPM for AI (use purview-dspm-ai)

Pick the right posture lens

You need to harden...	Use this	Surface
Azure subscriptions, AWS accounts, GCP projects	Defender for Cloud CSPM	Defender for Cloud → Recommendations
Internet-exposed VMs / data with toxic combinations	Defender CSPM (paid) + attack-path	Defender for Cloud → Attack path analysis
Microsoft 365, Salesforce, ServiceNow, GitHub config	Defender for Cloud Apps SSPM	Defender XDR → Cloud apps → Posture
Container / Kubernetes posture	Defender CSPM container plan	Defender for Cloud → Cloud security graph
Code / IaC misconfiguration	DevOps security in Defender for Cloud	Defender for Cloud → DevOps
Identity hygiene gaps in the cloud	Identity recommendations (CIEM)	Defender for Cloud + Entra Permissions Mgmt

Rule of thumb: Foundation CSPM is free with the Defender for Cloud plan and gives you Secure Score + MCSB recommendations. The paid Defender CSPM plan adds attack-path analysis, the cloud security graph, agentless scanning, and DevOps - enable it for any environment where you need to prioritise by exploitability, not by count.

Approach

1. Enable foundation CSPM everywhere - Turn on Defender for Cloud across all Azure subscriptions, connect AWS accounts and GCP projects, and confirm Microsoft Cloud Security Benchmark (MCSB) recommendations and Secure Score are populating. Verify: Defender for Cloud → Inventory shows all subscriptions/accounts; Secure Score is non-zero per scope.
2. Turn on Defender CSPM (paid) for high-value scopes - Enable the paid plan on subscriptions/accounts holding internet-exposed workloads or sensitive data to unlock attack-path analysis and the cloud security graph. Foundation CSPM alone tells you what is misconfigured; Defender CSPM tells you which misconfigurations form an exploitable chain. Verify: Attack path analysis page lists at least one path; you can trace a path from internet to sensitive data.
3. Enable SSPM in Defender for Cloud Apps - Connect each SaaS app (Microsoft 365, Salesforce, ServiceNow, GitHub, Okta, etc.) via API connector. SSPM recommendations cover admin controls, MFA settings, sharing exposure, and inactive privileged users per app. Verify: Defender XDR → Cloud apps → Posture shows recommendations per connected app, not just discovery.
4. Prioritise by exposure and impact - Rank remediations by: internet exposure, sensitive data, privileged identity, and attack-path criticality. Use the cloud security graph to group recommendations that break the same path. Verify: top 10 remediation list is not the top 10 by recommendation count but the top 10 by risk-weighted impact.
5. Assign owners and SLAs - Recommendations without an owner do not get fixed. Route by workload (subscription tag, resource group, SaaS app owner) into your ticketing system with a remediation SLA based on severity. Verify: ticket count per workload owner is visible; aging report shows median time to close per severity.
6. Enforce and automate where safe - Use Azure Policy to prevent regression of fixed configurations (deny new resources without encryption, block public IP creation in tagged scopes). Use Defender for Cloud workflow automation to route recommendations to Logic Apps for auto-remediation where reversible. Verify: at least one Azure Policy denies a previously-common misconfiguration; auto- remediation logs show successful fixes for one recommendation class.
7. Monitor drift continuously - Re-baseline as the estate changes (new subscriptions, new SaaS apps, new accounts). Posture is not a one-time project; it is an operating model. Verify: Secure Score trend over 90 days is flat or improving, not erratic.

Guardrails

• Posture management is preventive; pair with threat detection (Defender for Cloud workload plans, Defender for Cloud Apps threat policies). Posture without detection misses live attacks; detection without posture lets the same hole be exploited repeatedly.
• Don't chase score for its own sake - fix exploitable, high-impact issues first. A 95% Secure Score with an open attack path to crown-jewel data is worse than a 70% score with no paths.
• Coordinate remediation with app/workload owners to avoid breakage. Disabling public access on a storage account that a partner depends on is an outage, not a fix.
• Free CSPM is the floor, not the ceiling. Foundation CSPM lacks attack-path and graph features - in high-risk scopes, the paid Defender CSPM plan is the right baseline.
• Each connected SaaS app costs governance attention - connect the ones you actually manage, not every connector that exists.
• Treat posture findings as code - fix the root template (Bicep, Terraform, IaC), not just the deployed resource, so the fix survives the next deployment.

Common anti-patterns

• "Enable everything and let analysts triage the noise." Without scope, ownership, and prioritisation, posture becomes a 10,000-item backlog and nothing moves.
• Chasing Secure Score number while ignoring attack paths. A clean score plus an exploitable path is worse than a messy score with no exploitable path.
• SSPM as a checkbox - connecting SaaS apps but never reviewing the recommendations. The value is the recurring review cadence.
• No Azure Policy backstop. Fixed recommendations regress because nothing prevents the next deployment from re-introducing the same misconfiguration.
• Treating SSPM and CSPM as separate worlds. Many exploit chains cross the boundary (compromised SaaS admin → cloud workload). Review both lenses together for high-risk users.

Example prompts

• Harden our Microsoft 365 SaaS settings and review posture recommendations.
• Find misconfigured Salesforce or ServiceNow settings with SSPM.
• How do I improve SaaS security posture across multiple cloud apps?
• Use attack-path analysis to prioritise CSPM remediations.
• Review and remediate the top 10 cross-cloud posture issues.

Microsoft Learn

• Defender for Cloud CSPM: https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management
• SaaS security posture (SSPM): https://learn.microsoft.com/defender-cloud-apps/security-saas
• Attack path analysis: https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path
• Cloud security graph: https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path
• Secure Score: https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls
• Microsoft Cloud Security Benchmark: https://learn.microsoft.com/security/benchmark/azure/