Secure Azure with Defender for Cloud

Detect and fix cloud misconfigurations using Microsoft Defender for Cloud CSPM.

Introduction

30 Second Summary

Most cloud security breaches don't start with sophisticated hacking. They start with a misconfigured resource left exposed to the internet.

In this project, you will set up Microsoft Defender for Cloud to detect and fix real security misconfigurations across your Azure environment. You'll deploy intentionally insecure resources, watch Defender for Cloud flag them, then remediate each issue and measure your improvement.

What You'll Build

You will activate the Defender CSPM plan on your Azure subscription and use its investigation tools to detect, prioritize, and fix security misconfigurations in intentionally insecure resources.

By the end of this project, you'll have:

A Defender CSPM deployment with agentless scanning actively monitoring your subscription.
Remediated security findings from an intentionally misconfigured VM and storage account, with a measurable Secure Score improvement.
Hands-on experience with attack path analysis and Cloud Security Explorer to investigate and prioritize security risks.
Configured governance rules and assessed compliance against the CIS Azure Foundations Benchmark to take your CSPM skills even further.

Are there any prerequisites?

You need an Azure account with the Subscription Owner role. Owner access is required to enable agentless scanning, which powers attack path analysis and Cloud Security Explorer.

Before We Start

Before We Start...

Enable Defender for Cloud and Activate the CSPM Plan

Before you can detect security misconfigurations in your Azure environment, you need a tool that continuously monitors your resources and flags risks.

Microsoft Defender for Cloud is Azure's built-in security monitoring service. In this step, you will enable it and activate the Defender CSPM plan to unlock advanced features like attack path analysis and Cloud Security Explorer.

In this step, get ready to:

Enable Microsoft Defender for Cloud on your subscription.
Activate the Defender CSPM plan with agentless scanning and all available components.
Record your baseline Secure Score.

Enable Defender for Cloud

Every Azure subscription can use Defender for Cloud's free Foundational CSPM tier, which includes basic security recommendations and a Secure Score. Opening Defender for Cloud for the first time automatically enables this free tier on your subscription.

Sign in to the Azure portal.
Click the search bar at the top of the page.
Type Microsoft Defender for Cloud and select it from the results.

What is Foundational CSPM?

Foundational CSPM is the free tier of Defender for Cloud. It includes asset inventory, Secure Score, security recommendations, and compliance assessment against the Microsoft Cloud Security Benchmark (MCSB). It activates automatically the first time you open Defender for Cloud.

Now navigate to the settings page where you can manage Defender plans for your subscription.

In the left menu, scroll down to the Management section.
Click Environment settings.
Expand the hierarchy until you see your Azure subscription listed.
Click on your subscription name to open the Defender plans page.

Don't see your subscription?

Make sure you are signed in with an account that has the Subscription Owner role. Non-owners can view Defender for Cloud, but agentless scanning will not activate without Owner permissions.

Help me find my subscription in Defender for Cloud Environment settings.

Activate the Defender CSPM plan

The Defender plans page lists every Defender for Cloud plan available for your subscription. You need to turn on the Defender CSPM plan, which adds agentless scanning, attack path analysis, and Cloud Security Explorer on top of the free Foundational CSPM features.

Find the Defender CSPM row in the list of plans.
Toggle the Defender CSPM plan to On.
Click Settings next to the Defender CSPM row to configure its components.

The settings panel shows all the components included in the Defender CSPM plan. Enable every one of them.

Turn on Agentless scanning for machines.
Turn on Agentless discovery for Kubernetes.
Turn on Sensitive data discovery.
Turn on Cloud infrastructure entitlement management (CIEM).
Turn on any other component toggles that appear in the list.
Click Continue.
Click Save at the top of the page.

You should see a confirmation notification that your settings were saved successfully.

What do these components do?

Agentless scanning for machines scans your VMs for vulnerabilities and software inventory without installing anything on them.
Agentless discovery for Kubernetes discovers and maps your Kubernetes clusters and workloads.
Sensitive data discovery identifies storage resources that contain sensitive information like passwords or personal data.
CIEM analyzes permissions across your cloud identities to find overprivileged accounts.

Pro tip: free trial

Activating Defender CSPM starts a 30-day free trial. After the trial, the plan costs $5.11 per billable resource per month. You will disable the plan at the end of this project to avoid any charges.

Why might some data take up to 24 hours?

Agentless scanning and CIEM data collection can take up to 24 hours to complete. Basic security recommendations and Secure Score appear within minutes, but features like attack path analysis depend on the full scan finishing first.

Verify your Secure Score

Your Secure Score is a percentage that represents how well your Azure environment follows security best practices. A higher score means fewer identified risks. You need to record this score now as your baseline so you can measure improvement later.

Click Microsoft Defender for Cloud in the left menu breadcrumb or search bar to navigate back to the main Defender for Cloud page.
Select Overview from the left menu.
Look at the Secure Score displayed near the top of the page.
Write down this score. This is your baseline that you will compare against after remediating security issues later in the project.

Now explore what makes up your score.

Click on the Secure Score number to open the detailed breakdown.
Review the list of security controls. Each control groups related recommendations together (for example, "Restrict unauthorized network access" or "Enable encryption at rest").
Notice how each control shows a score contribution. Controls with unhealthy resources reduce your total Secure Score.

How does Secure Score work?

Secure Score is calculated from security controls, which are groups of related recommendations. Each control is worth a certain number of points. You earn the full points for a control only when all of its recommendations are resolved for all affected resources.

The score updates continuously as Defender for Cloud evaluates your resources against the Microsoft Cloud Security Benchmark.

Your Defender CSPM plan is active and you have a baseline Secure Score recorded. Next up, you will deploy some intentionally insecure resources to generate real security findings for Defender for Cloud to detect.

Deploy Intentionally Misconfigured Resources

Your Defender for Cloud is now active with the Defender CSPM plan monitoring your subscription. You have a baseline Secure Score noted from Step 1.

In this step, you will use Azure Cloud Shell to deploy a virtual machine with overly permissive network rules and a storage account with public blob access. These intentional misconfigurations mirror real-world security gaps that Defender for Cloud is built to detect.

In this step, get ready to:

Create a resource group, virtual network, and VM with overly permissive network rules.
Deploy a storage account with public blob access enabled.
Verify all resources are created in the Azure portal.

Create a resource group and an insecure VM

You will run a series of Azure CLI commands to build an intentionally insecure network setup. The goal is to create a VM that is exposed to the entire internet through open management ports.

Open Azure Cloud Shell by clicking the terminal icon (>_) in the top navigation bar of the Azure portal.
Select Bash if prompted to choose a shell type.

First time opening Cloud Shell?

If this is your first time using Cloud Shell, Azure will prompt you to create a storage account to persist your shell files. Follow the on-screen prompts to complete the setup. This is a one-time step.

Create a resource group and virtual network by running these commands:

# Create a resource group for our insecure lab
az group create --name cspm-lab-rg --location eastus

# Create a virtual network and subnet
az network vnet create \
  --resource-group cspm-lab-rg \
  --name cspm-lab-vnet \
  --subnet-name default \
  --subnet-prefixes 10.0.0.0/24

What do these commands do?

az group create creates a resource group called cspm-lab-rg in the eastus region. A resource group is a container that holds all the related Azure resources for this lab.
az network vnet create creates a virtual network with a subnet. This is the network your VM will live in.

You should see JSON output confirming the resource group and virtual network were created successfully.

Seeing a subscription error?

Make sure you are signed into the Azure portal with the account that has Subscription Owner role.
Run az account show in Cloud Shell to confirm you are using the correct subscription.
If the wrong subscription is selected, run az account set --subscription "Your Subscription Name" to switch.

Help me troubleshoot my Azure subscription error in Cloud Shell.

Now it is time to create the intentional security misconfiguration. You will set up a Network Security Group (NSG) with rules that allow SSH and RDP traffic from any IP address on the internet.

Create a network security group with overly permissive inbound rules by running these commands:

# Create an NSG with overly permissive rules
az network nsg create \
  --resource-group cspm-lab-rg \
  --name cspm-lab-nsg

# Allow SSH from anywhere (insecure)
az network nsg rule create \
  --resource-group cspm-lab-rg \
  --nsg-name cspm-lab-nsg \
  --name AllowSSHFromAnywhere \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes '*' \
  --destination-port-ranges 22

# Allow RDP from anywhere (insecure)
az network nsg rule create \
  --resource-group cspm-lab-rg \
  --nsg-name cspm-lab-nsg \
  --name AllowRDPFromAnywhere \
  --priority 110 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes '*' \
  --destination-port-ranges 3389

Why are these rules insecure?

The --source-address-prefixes '*' setting means "allow traffic from any IP address on the internet." In production, management ports like SSH (port 22) and RDP (port 3389) should only be open to specific trusted IP addresses.

Leaving these ports open to the world is one of the most common cloud misconfigurations. Attackers constantly scan for VMs with open management ports.

You should see JSON output for the NSG and each rule, confirming they were created.

Deploy a VM attached to the insecure NSG by running this command:

# Create a VM with the insecure NSG and a public IP
az vm create \
  --resource-group cspm-lab-rg \
  --name cspm-lab-vm \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --nsg cspm-lab-nsg \
  --vnet-name cspm-lab-vnet \
  --subnet default \
  --public-ip-address cspm-lab-pip

What does this command do?

--image Ubuntu2204 deploys an Ubuntu Server 22.04 LTS virtual machine.
--size Standard_B1s selects the smallest burstable VM size at approximately $0.01/hour.
--nsg cspm-lab-nsg attaches the insecure NSG you just created, exposing the VM's management ports to the internet.
--public-ip-address cspm-lab-pip assigns a public IP, making the VM internet-facing.

The VM takes about 1-2 minutes to deploy. You should see JSON output that includes a publicIpAddress field when it finishes.

VM creation failed?

If you see a quota or capacity error, the region may not have available resources. Try changing the location to a different region (e.g. westus2) in all previous commands.
If you see a naming conflict, another resource with the same name may already exist. Delete the resource group with az group delete --name cspm-lab-rg --yes and start again.

Help me troubleshoot my Azure VM deployment error.

Create a storage account with public blob access

The second misconfiguration is a storage account that allows anyone on the internet to read its blobs. This is a common misconfiguration that leads to data leaks in production environments.

Still in Cloud Shell, create a storage account and a public container by running these commands:

# Create a storage account with public blob access enabled
az storage account create \
  --name [[STORAGE_NAME="cspmlabyourname01"]] \
  --resource-group cspm-lab-rg \
  --location eastus \
  --sku Standard_LRS \
  --allow-blob-public-access true

# Create a container with public access level set to blob
az storage container create \
  --name public-data \
  --account-name [[STORAGE_NAME="cspmlabyourname01"]] \
  --public-access blob

What do these commands do?

--allow-blob-public-access true enables public access at the storage account level. By default, Azure disables this for new storage accounts.
--public-access blob on the container means anyone with the URL can read blobs inside it. No authentication required.

Why does the storage account name need to be unique?

Azure storage account names must be globally unique across all of Azure. They must also be lowercase, between 3-24 characters, and contain only letters and numbers. Pick something memorable like cspmlabjan2026 or cspmlabyourname.

You should see JSON output confirming both the storage account and the container were created.

Storage account creation failed?

If you see a naming error, your chosen name is either already taken or contains invalid characters. Try a different name that is lowercase, 3-24 characters, and letters/numbers only.
Make sure you use the same storage account name in both the az storage account create and az storage container create commands.

Help me fix my Azure storage account creation error.

Verify your resources were created

In the Azure portal, search for Resource groups in the top search bar.
Select cspm-lab-rg from the list.
Confirm you see the following resources listed: cspm-lab-vm (virtual machine), cspm-lab-nsg (network security group), cspm-lab-vnet (virtual network), and your storage account.

How long until Defender for Cloud detects these?

Basic security recommendations for NSG rules and storage account access typically appear within 15-30 minutes. Attack paths may take up to 24 hours to fully populate because they rely on agentless scanning to complete.

You do not need to wait for findings before moving to the next step. Defender for Cloud evaluates resources continuously in the background.

These resources are intentionally insecure

The VM and storage account you just deployed have real security vulnerabilities. They exist only for this lab exercise. You will remediate all of these misconfigurations in Step 5, and the Before You Go section includes full cleanup instructions.

Your insecure resources are deployed and Defender for Cloud is already scanning them. Next, you will explore the security recommendations and Secure Score changes these misconfigurations trigger.

Review Security Recommendations and Secure Score

Your insecure lab environment is live. The VM with open management ports and the storage account with public blob access are exactly the kind of misconfigurations that attackers actively scan for.

Now it is time to see Defender for Cloud in action. You will explore the security recommendations it generates and track their impact on your Secure Score.

In this step, get ready to:

Explore security recommendations triggered by your misconfigured resources.
Compare your current Secure Score against your Step 1 baseline.
Examine a recommendation in detail to understand its risk factors and remediation guidance.

Explore security recommendations

Defender for Cloud continuously evaluates your resources against security best practices. When it finds a misconfiguration, it creates a security recommendation with details about the risk and how to fix it.

Navigate to Microsoft Defender for Cloud in the Azure portal.
Select Recommendations from the left menu.
Look for recommendations related to your deployed resources.

What recommendations should I see?

Common recommendations that appear for your misconfigured resources include:

"Management ports should be closed on your virtual machines" (triggered by your open SSH and RDP rules).
"Internet-facing virtual machines should be protected with network security groups" (triggered by your internet-exposed VM).
"Storage account public access should be disallowed" (triggered by your public blob container).

Don't see any recommendations yet?

Defender for Cloud evaluates newly deployed resources continuously, but initial assessments can take 15 to 30 minutes. Refresh the page after waiting and the recommendations should appear.

If recommendations still have not appeared after 30 minutes, confirm your resources were created by checking the cspm-lab-rg resource group in the portal.

Help me troubleshoot why Defender for Cloud recommendations are not appearing for my resources.

Click on any recommendation to open its detail view.

The detail view shows the affected resources, the risk level, suggested remediation steps, and the security control the recommendation belongs to.

Understand your Secure Score impact

Your Secure Score reflects the overall security health of your subscription. Deploying the misconfigured resources in Step 2 likely pulled it down.

Navigate to the Defender for Cloud Overview page using the left menu.
Compare your current Secure Score with the baseline you noted in Step 1.
Click on the Secure Score to open the breakdown by security controls.

Notice how each recommendation is grouped under a security control like "Restrict unauthorized network access." Each control contributes a certain number of points to your total score.

What are security controls?

Security controls group related recommendations under a common theme like network access or data protection. They are defined by the Microsoft Cloud Security Benchmark (MCSB), the default security standard applied to your subscription when Defender for Cloud is enabled.

Each control contributes points based on how many of its recommendations you have resolved. Fixing a recommendation in a control adds those points back to your total Secure Score.

Examine a recommendation in detail

Drilling into a single recommendation reveals its risk factors, affected resources, and step-by-step remediation guidance. You will examine the network security group recommendation for your VM.

Go back to Recommendations in the left menu.
Select the recommendation titled "Management ports should be closed on your virtual machines" or a similar NSG-related recommendation.
Review the Affected resources tab to confirm your cspm-lab-vm appears.
Review the Risk factors section to understand why this finding is flagged.
Note the Remediation steps section provided in the recommendation.

What do risk factors tell you?

Risk factors explain what makes a finding dangerous. For your VM, factors like internet exposure and open management ports mean an attacker could reach it directly from the public internet.

Security teams use this context to prioritize which findings to fix first. A VM exposed to the entire internet is more urgent than one only reachable from an internal network.

You will apply the remediation steps to fix these findings in Step 5.

You now have a clear picture of your security posture and the specific findings pulling your Secure Score down. Next up, you will use attack path analysis and Cloud Security Explorer to see how an attacker could chain these misconfigurations into a real attack.

Investigate with Attack Path Analysis and Cloud Security Explorer

You've seen how Defender for Cloud flags your misconfigured resources as security recommendations and tracks their impact on your Secure Score. But individual recommendations only tell part of the story.

In this step, you'll use two of Defender CSPM's most powerful features to understand how an attacker could chain your misconfigurations into a real attack. You'll also learn to proactively hunt for risks using graph-based queries.

In this step, get ready to:

Explore attack path analysis to see how misconfigurations chain into exploitable attack sequences.
Query your cloud security posture with Cloud Security Explorer.
Build and save custom queries to proactively hunt for security risks.

Explore attack path analysis

Attack path analysis shows how an attacker could chain together multiple misconfigurations to reach a critical asset. Instead of reviewing findings one by one, you see the full sequence from entry point to target.

Navigate to Microsoft Defender for Cloud in the Azure portal.
Select Attack path analysis from the left menu.

If attack paths have populated, you see a list of identified paths. Each path represents a real sequence an attacker could follow to breach your environment.

Select an attack path from the list to view the Attack Path Map, a graph-based visualization.
Look for entry points in the graph. Your internet-exposed VM with open management ports is a likely entry point.
Look for target assets. These are the critical resources an attacker could reach, such as your storage account.
Click on individual nodes in the graph to see their Insights, Risk factors, and Recommendations.

What does the Attack Path Map show?

The Attack Path Map is a graph where each node represents a resource or identity, and each edge represents a relationship an attacker could exploit. Entry points are typically internet-exposed resources. Intermediate nodes show how the attacker pivots through your environment. Target assets are the high-value resources the attacker wants to reach.

Pro tip: attack paths need time

Attack paths rely on agentless scanning, which can take up to 24 hours to fully populate after resources are deployed. If you do not see any attack paths yet, proceed to Cloud Security Explorer below and come back later to check.

Query with Cloud Security Explorer

Cloud Security Explorer lets you run graph-based queries against your entire cloud security posture. You can use predefined templates or build your own queries to search for specific risk patterns.

Navigate back to Microsoft Defender for Cloud in the Azure portal.
Select Cloud Security Explorer from the left menu.
Look at the predefined query templates. Find one related to "Internet exposed" resources or "VMs with high severity vulnerabilities."
Click on a matching template to run it.

What if no templates match?

You can build a custom query instead. Select Virtual Machines as the resource type, add a condition for Internet exposed, and click Search.

Your cspm-lab-vm should appear in the results as an internet-exposed resource.

Click Save query to save this query for future use.
Name it something descriptive like Internet-exposed VMs in my environment.

Why save queries?

Saved queries let you re-run the same search later without rebuilding it from scratch. Security teams use saved queries to monitor recurring risk patterns across their environment over time.

Not seeing your VM in the results?

Make sure your query uses Virtual Machines as the resource type. If you selected a different resource type, the VM will not appear.

Agentless scanning may still be processing your resources. Wait 15-30 minutes and try the query again.

help me troubleshoot why my VM is not appearing in Cloud Security Explorer results

Build a custom Cloud Security Explorer query

You just queried for internet-exposed VMs. Now you'll build a second query to find storage accounts with public access enabled. This is the kind of proactive risk hunting that security teams do beyond automated recommendations.

Click New query in Cloud Security Explorer.
Select Storage Accounts as the resource type.
Add a condition for Allows public blob access or a similar condition related to public access.
Click Search to run the query.

Your storage account should appear in the results, confirming the public access misconfiguration you deployed in Step 2.

Why build custom queries?

Automated recommendations catch common misconfigurations. Custom queries let you search for organization-specific risk patterns that standard rules might not cover. For example, you might query for all storage accounts in a particular region, or all VMs with a specific tag that lack encryption.

Storage account not appearing in results?

Double check that you selected Storage Accounts as the resource type, not a different resource category.

Verify your storage account was created successfully by navigating to Resource groups and checking that your storage account exists in cspm-lab-rg.

help me find my publicly accessible storage account in Cloud Security Explorer

You now know how to investigate security risks from two angles. Attack path analysis shows you how misconfigurations connect into exploitable chains. Cloud Security Explorer lets you proactively hunt for specific risk patterns. Next up, you'll fix these issues and watch your Secure Score climb.

Remediate Security Issues and Improve Your Secure Score

In Step 4, you used attack path analysis and Cloud Security Explorer to investigate how your misconfigurations create real security risks. You know exactly which resources are exposed and how an attacker could reach them.

Now it's time to fix those issues. You'll lock down the NSG rules on your VM, disable public access on your storage account, and verify that your Secure Score improves.

In this step, get ready to:

Fix overly permissive NSG rules on your VM.
Disable public blob access on your storage account.
Verify your Secure Score improved after remediation.

Fix the NSG rules on your VM

The NSG on your VM currently allows SSH and RDP traffic from any IP address on the internet. This is one of the most common cloud misconfigurations and exactly what Defender for Cloud flagged in its recommendations.

You'll remove those wide-open rules and replace them with a rule that only allows SSH from your specific IP address.

Open Azure Cloud Shell by clicking the terminal icon (>_) in the top navigation bar of the Azure portal.
Find your current public IP address by running this command:

curl ifconfig.me

Copy the IP address from the output. You'll paste it into a command shortly.

Remove the two overly permissive NSG rules by running these commands:

# Delete the rule that allows SSH from any source
az network nsg rule delete \
  --resource-group cspm-lab-rg \
  --nsg-name cspm-lab-nsg \
  --name AllowSSHFromAnywhere

# Delete the rule that allows RDP from any source
az network nsg rule delete \
  --resource-group cspm-lab-rg \
  --nsg-name cspm-lab-nsg \
  --name AllowRDPFromAnywhere

What do these commands do?

The first command deletes AllowSSHFromAnywhere, which was letting anyone on the internet connect to port 22 (SSH) on your VM.
The second command deletes AllowRDPFromAnywhere, which was letting anyone connect to port 3389 (RDP).
With both rules deleted, no inbound management traffic can reach your VM. This is exactly what Defender for Cloud's recommendations asked you to fix.

Add a new SSH rule that only allows connections from your specific IP address by running this command:

# Allow SSH only from your specific IP address
az network nsg rule create \
  --resource-group cspm-lab-rg \
  --nsg-name cspm-lab-nsg \
  --name AllowSSHFromMyIP \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes '[[YOUR_IP="your public IP from the curl command"]]/32' \
  --destination-port-ranges 22

What does this command do?

This creates a new NSG rule called AllowSSHFromMyIP that only permits SSH traffic from your specific IP address.
The /32 suffix means only that single IP address is allowed. Compare this to the previous * wildcard, which allowed the entire internet.

You should see JSON output confirming the new rule was created, including "provisioningState": "Succeeded" in the response.

Seeing an error when creating the rule?

Make sure you replaced the IP placeholder with the actual IP address you copied from curl ifconfig.me. The value should look like '203.0.113.42/32' with no spaces.
Check that your Cloud Shell session hasn't timed out. If it has, click the terminal icon again to reopen it.
Confirm the resource group name is cspm-lab-rg and the NSG name is cspm-lab-nsg. These must match exactly what you created in Step 2.
Help me fix my NSG rule creation command.

Disable public access on the storage account

Your storage account currently allows public blob access, meaning anyone with the URL can read the data inside. This is the second misconfiguration Defender for Cloud flagged.

Disable public blob access on your storage account by running this command:

# Disable public blob access on the storage account
az storage account update \
  --name [[STORAGE_ACCOUNT="your storage account name from Step 2"]] \
  --resource-group cspm-lab-rg \
  --allow-blob-public-access false

What does this command do?

The --allow-blob-public-access false flag disables all public access to blobs in this storage account.
After this change, even the public-data container you created with public access will no longer be readable without authentication.

You should see JSON output with "allowBlobPublicAccess": false in the response, confirming the change took effect.

Storage account not found?

Double check that the --name value matches the exact storage account name you created in Step 2. Storage account names are lowercase letters and numbers only.
If you forgot your storage account name, navigate to Resource groups in the Azure portal, select cspm-lab-rg, and find the storage account listed there.
Help me update my storage account to disable public access.

Verify your Secure Score improved

Defender for Cloud continuously re-evaluates your resources. Now that you've fixed both misconfigurations, your Secure Score should start climbing.

Navigate to Microsoft Defender for Cloud in the Azure portal.
Select Overview from the left menu.
Check your Secure Score at the top of the page. Compare it to the baseline you noted in Step 1.

How long does the score take to update?

Defender for Cloud re-evaluates remediated resources within 15 to 30 minutes. If your score hasn't changed yet, wait a few minutes and refresh the page.

Some recommendations resolve faster than others. NSG rule changes are typically detected within minutes, while storage account changes may take slightly longer.

Select Recommendations from the left menu.
Look for the recommendations that were previously flagged, such as "Management ports should be closed on your virtual machines" and "Storage account public access should be disallowed."
Click on each recommendation and check the Affected resources tab. Your resources should now appear as healthy or resolved.

The improvement between your baseline score and your current score is the direct result of your remediation work. This is the core CSPM workflow: detect, investigate, remediate, measure.

Score hasn't changed after 30 minutes?

Go back to Recommendations and click on a flagged recommendation. If your resource still shows as unhealthy, the re-evaluation hasn't completed yet. Wait a few more minutes and refresh.
Confirm your NSG changes took effect by navigating to Resource groups > cspm-lab-rg > cspm-lab-nsg > Inbound security rules. You should see only AllowSSHFromMyIP and no rules with a * source.
Confirm your storage account change took effect by selecting your storage account in the portal. Under Settings > Configuration, the Allow Blob public access setting should show Disabled.
My Secure Score isn't updating after remediation. Help me troubleshoot.

Secret mission

Governance Rules and Regulatory Compliance

You have already detected and remediated security misconfigurations. But in a real organization, how do you make sure findings actually get fixed on time? And how do you prove your environment meets an industry security standard? In this secret mission, you will configure governance rules to assign remediation owners and deadlines, then assess your environment against the CIS Microsoft Azure Foundations Benchmark.

Before you go

Clean Up Your Resources

You deployed Azure resources that cost money while running. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Cost warning

The VM costs approximately $0.01/hour (~$7.50/month). The storage account costs are minimal. The Defender CSPM plan costs $5.11 per billable resource per month after your 30-day free trial ends.

If you are not planning to continue using these resources, choose Pause or Delete to avoid unexpected charges.

Resources you used:

Resource group: cspm-lab-rg (contains all lab resources below).
Virtual machine: cspm-lab-vm (Standard_B1s, ~$0.01/hour while running).
Network security group: cspm-lab-nsg.
Virtual network: cspm-lab-vnet.
Public IP address: cspm-lab-pip.
Storage account: cspmlab<your-unique-suffix> with the public-data container.
Defender CSPM plan (subscription-level setting, 30-day free trial).
Cloud Shell storage account (if created during this project).

Keep everything running

No action needed. Choose this if you are still actively building or want to continue exploring Defender for Cloud features.

The VM costs approximately $0.01/hour (~$7.50/month) while running.
The Defender CSPM plan is free for 30 days from activation. After that, it costs $5.11 per billable resource per month.
Storage account costs are minimal (fractions of a cent per month for this lab).

Pause - I'll come back to this later

Deallocate the VM to stop compute charges while keeping all your resources and configurations intact for later.

Open Azure Cloud Shell and run the following command to deallocate your VM:

az vm deallocate --resource-group cspm-lab-rg --name cspm-lab-vm

This stops compute charges for the VM. The disk and other resources remain but cost very little.
Your Defender CSPM free trial continues counting down. You have 30 days from when you activated it.
When you are ready to resume, start the VM again with:

az vm start --resource-group cspm-lab-rg --name cspm-lab-vm

Delete - I don't want to use this again

Remove all project resources and disable the Defender CSPM plan to avoid any future charges.

Open Azure Cloud Shell and delete the entire resource group. This removes all the lab resources at once:

az group delete --name cspm-lab-rg --yes --no-wait

The --no-wait flag returns immediately. The deletion continues in the background.
Disable the Defender CSPM plan to avoid charges after your free trial ends:

Navigate to Microsoft Defender for Cloud in the Azure portal.
Select Environment settings from the left menu, then select your subscription.
Toggle the Defender CSPM plan to Off.
Click Save.

What about the Cloud Shell storage account?

If Azure created a storage account for Cloud Shell during this project, it lives in a separate resource group (typically named cloud-shell-storage-*). You can delete it from the Resource groups page if you do not plan to use Cloud Shell again. The cost is minimal if you keep it.

Mission accomplished

That's a Wrap!

Nice work! You just built a complete cloud security posture management workflow using Microsoft Defender for Cloud, from deploying intentionally insecure resources all the way through detecting, investigating, and remediating real security findings.

You've learned how to:

Activate the Defender CSPM plan with agentless scanning and deploy intentionally misconfigured Azure resources to generate real security findings.
Use attack path analysis and Cloud Security Explorer to investigate how misconfigurations chain together into real attack scenarios.
Remediate security issues like open management ports and public blob access, then measure the resulting Secure Score improvement.
Configure governance rules for remediation accountability and assess compliance against the CIS Azure Foundations Benchmark.

Ready to quiz yourself?