vinayaklatthe Cloud & App Security Posture
Security posture management spans two complementary layers: CSPM for cloud infrastructure (IaaS/PaaS) via Microsoft Defender for Cloud, and SSPM for SaaS applications via Microsoft Defender for Cloud Apps. Together they continuously reduce misconfiguration risk across the cloud and SaaS estate.
When to use
Assessing and continuously hardening configuration posture across both cloud infrastructure and SaaS applications - especially when remediation has stalled or when you cannot answer "what should we fix next?".
Do not use this skill for:
- IaaS/PaaS workload threat protection plans (use
defender-for-cloud-hardening) - SaaS threat detection or shadow-IT discovery only (use
defender-for-cloud-apps) - DSPM for AI (use
purview-dspm-ai)
Pick the right posture lens
| You need to harden... | Use this | Surface |
|---|---|---|
| Azure subscriptions, AWS accounts, GCP projects | Defender for Cloud CSPM | Defender for Cloud → Recommendations |
| Internet-exposed VMs / data with toxic combinations | Defender CSPM (paid) + attack-path | Defender for Cloud → Attack path analysis |
| Microsoft 365, Salesforce, ServiceNow, GitHub config | Defender for Cloud Apps SSPM | Defender XDR → Cloud apps → Posture |
| Container / Kubernetes posture | Defender CSPM container plan | Defender for Cloud → Cloud security graph |
| Code / IaC misconfiguration | DevOps security in Defender for Cloud | Defender for Cloud → DevOps |
| Identity hygiene gaps in the cloud | Identity recommendations (CIEM) | Defender for Cloud + Entra Permissions Mgmt |
Rule of thumb: Foundation CSPM is free with the Defender for Cloud plan and gives you Secure Score + MCSB recommendations. The paid Defender CSPM plan adds attack-path analysis, the cloud security graph, agentless scanning, and DevOps - enable it for any environment where you need to prioritise by exploitability, not by count.
Approach
- Enable foundation CSPM everywhere - Turn on Defender for Cloud across all Azure subscriptions, connect AWS accounts and GCP projects, and confirm Microsoft Cloud Security Benchmark (MCSB) recommendations and Secure Score are populating. Verify: Defender for Cloud → Inventory shows all subscriptions/accounts; Secure Score is non-zero per scope.
- Turn on Defender CSPM (paid) for high-value scopes - Enable the paid plan on subscriptions/accounts holding internet-exposed workloads or sensitive data to unlock attack-path analysis and the cloud security graph. Foundation CSPM alone tells you what is misconfigured; Defender CSPM tells you which misconfigurations form an exploitable chain. Verify: Attack path analysis page lists at least one path; you can trace a path from internet to sensitive data.
- Enable SSPM in Defender for Cloud Apps - Connect each SaaS app (Microsoft 365, Salesforce, ServiceNow, GitHub, Okta, etc.) via API connector. SSPM recommendations cover admin controls, MFA settings, sharing exposure, and inactive privileged users per app. Verify: Defender XDR → Cloud apps → Posture shows recommendations per connected app, not just discovery.
- Prioritise by exposure and impact - Rank remediations by: internet exposure, sensitive data, privileged identity, and attack-path criticality. Use the cloud security graph to group recommendations that break the same path. Verify: top 10 remediation list is not the top 10 by recommendation count but the top 10 by risk-weighted impact.
- Assign owners and SLAs - Recommendations without an owner do not get fixed. Route by workload (subscription tag, resource group, SaaS app owner) into your ticketing system with a remediation SLA based on severity. Verify: ticket count per workload owner is visible; aging report shows median time to close per severity.
- Enforce and automate where safe - Use Azure Policy to prevent regression of fixed configurations (deny new resources without encryption, block public IP creation in tagged scopes). Use Defender for Cloud workflow automation to route recommendations to Logic Apps for auto-remediation where reversible. Verify: at least one Azure Policy denies a previously-common misconfiguration; auto- remediation logs show successful fixes for one recommendation class.
- Monitor drift continuously - Re-baseline as the estate changes (new subscriptions, new SaaS apps, new accounts). Posture is not a one-time project; it is an operating model. Verify: Secure Score trend over 90 days is flat or improving, not erratic.
Guardrails
- Posture management is preventive; pair with threat detection (Defender for Cloud workload plans, Defender for Cloud Apps threat policies). Posture without detection misses live attacks; detection without posture lets the same hole be exploited repeatedly.
- Don't chase score for its own sake - fix exploitable, high-impact issues first. A 95% Secure Score with an open attack path to crown-jewel data is worse than a 70% score with no paths.
- Coordinate remediation with app/workload owners to avoid breakage. Disabling public access on a storage account that a partner depends on is an outage, not a fix.
- Free CSPM is the floor, not the ceiling. Foundation CSPM lacks attack-path and graph features - in high-risk scopes, the paid Defender CSPM plan is the right baseline.
- Each connected SaaS app costs governance attention - connect the ones you actually manage, not every connector that exists.
- Treat posture findings as code - fix the root template (Bicep, Terraform, IaC), not just the deployed resource, so the fix survives the next deployment.
Common anti-patterns
- "Enable everything and let analysts triage the noise." Without scope, ownership, and prioritisation, posture becomes a 10,000-item backlog and nothing moves.
- Chasing Secure Score number while ignoring attack paths. A clean score plus an exploitable path is worse than a messy score with no exploitable path.
- SSPM as a checkbox - connecting SaaS apps but never reviewing the recommendations. The value is the recurring review cadence.
- No Azure Policy backstop. Fixed recommendations regress because nothing prevents the next deployment from re-introducing the same misconfiguration.
- Treating SSPM and CSPM as separate worlds. Many exploit chains cross the boundary (compromised SaaS admin → cloud workload). Review both lenses together for high-risk users.
Example prompts
Harden our Microsoft 365 SaaS settings and review posture recommendations.Find misconfigured Salesforce or ServiceNow settings with SSPM.How do I improve SaaS security posture across multiple cloud apps?Use attack-path analysis to prioritise CSPM remediations.Review and remediate the top 10 cross-cloud posture issues.
Microsoft Learn
- Defender for Cloud CSPM: https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management
- SaaS security posture (SSPM): https://learn.microsoft.com/defender-cloud-apps/security-saas
- Attack path analysis: https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path
- Cloud security graph: https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path
- Secure Score: https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls
- Microsoft Cloud Security Benchmark: https://learn.microsoft.com/security/benchmark/azure/