Defender Secure Score Monitor

Defender Secure Score Monitor

Purpose

Track and improve your Microsoft Defender for Cloud Secure Score through focused monitoring, trend analysis, and actionable remediation guidance. Answers "what's our security score and how do we improve it?"

When to use this skill

• User asks "what's our secure score?"
• User asks how to improve security posture
• Weekly security posture check
• Before a security audit or customer questionnaire
• After deploying new resources (to check score impact)

Difference from Compliance/Governance Audit

The Compliance skill does a broad governance audit (policy, RBAC, tagging, locks, naming). This skill is laser-focused on Defender for Cloud Secure Score — the single most important security KPI — and provides targeted actions to improve it.

Assessment procedure

Step 1: Current Secure Score

Get the overall score and per-control breakdown.

az rest --method get --url "https://management.azure.com/subscriptions//providers/Microsoft.Security/secureScores/ascScore?api-version=2020-01-01"

az rest --method get --url "https://management.azure.com/subscriptions//providers/Microsoft.Security/secureScores/ascScore/secureScoreControls?api-version=2020-01-01"

Note: The az security secure-scores list CLI command may fail in some environments. The REST API approach above is more reliable. Replace `` with the target subscription ID.

Report:

• Current Secure Score: X% (X/Y points)
• Trend (if memory available): improved/declined vs. last check
• Top 5 controls with the most room for improvement (highest max - current)

Step 2: Unhealthy assessments (recommendations)

Get the list of active security recommendations.

az rest --method get --url "https://management.azure.com/subscriptions//providers/Microsoft.Security/assessments?api-version=2021-06-01" --query "value[?properties.status.code=='Unhealthy'].{displayName:properties.displayName, severity:properties.metadata.severity, category:properties.metadata.categories[0], resourceId:properties.resourceDetails.id}"

Group by severity:

• 🔴 High: Must fix — significant risk
• 🟡 Medium: Should fix — moderate risk
• 🟢 Low: Nice to have — minimal risk

Step 3: Quick wins (most points for least effort)

Identify recommendations that:

1. Affect the most resources (batch fix possible)
2. Have the highest point value per control
3. Can be fixed with a single CLI command or policy

Examples of quick wins:

• Enable HTTPS-only on App Services
• Enable secure transfer on storage accounts
• Enable Defender plans that are off
• Restrict public network access

Step 4: Defender plan coverage

Check which Defender plans are enabled.

az security pricing list --query "[].{plan:name, tier:pricingTier, subPlan:subPlan}" -o table

Expected plans to be enabled for full coverage:

• Servers (P2 recommended)
• App Service
• SQL (databases)
• Storage
• Containers (with vulnerability assessment)
• Key Vault
• Resource Manager (ARM)
• DNS

Flag disabled plans and estimate score impact of enabling them.

Step 5: Attack surface indicators

Check the most exploitable security gaps.

1. Public management ports (SSH/RDP open to internet):

``bash az graph query -q "resources | where type == 'microsoft.network/networksecuritygroups' | mvexpand rules = properties.securityRules | where rules.properties.access == 'Allow' and rules.properties.direction == 'Inbound' and (rules.properties.destinationPortRange == '22' or rules.properties.destinationPortRange == '3389' or rules.properties.destinationPortRange == '*') and rules.properties.sourceAddressPrefix in ('*', '0.0.0.0/0', 'Internet')" -o table ``

1. Storage accounts with public blob access:

``bash az storage account list --query "[?allowBlobPublicAccess==true].{name:name, rg:resourceGroup}" -o table ``

1. SQL servers with public endpoint:

``bash az sql server list --query "[?properties.publicNetworkAccess=='Enabled'].{name:name, rg:resourceGroup}" -o table ``

1. Key Vaults accessible from public network:

``bash az keyvault list --query "[?properties.publicNetworkAccess=='Enabled'].{name:name, rg:resourceGroup}" -o table ``

Step 6: Credential and certificate hygiene

Check for expiring secrets that could cause outages or security drift.

1. Key Vault secrets expiring within 30 days (per vault):

```bash az keyvault secret list --vault-name --query "[?attributes.expires!=null && attributes.expires --query "[?attributes.expires!=null && attributes.expires The subscription is earning only ZZ% of its maximum Secure Score. There is a N-point gap to close.

Score improvement plan

| Priority | Action | Points | Effort | Resources affected | |----------|--------|--------|--------|-------------------| | 1 | Enable HTTPS-only on 4 App Services | +4 | 5 min | app-web-, app-api- | | 2 | Enable Defender for Storage | +3 | 2 min | subscription-level | | 3 | Restrict SQL public access on 2 servers | +3 | 30 min | sql-prod-, sql-staging- | | 4 | Add NSG to 2 subnets without rules | +2 | 15 min | subnet-data-, subnet-mgmt- | | Total achievable | | +12 | ~1 hour | |

Critical findings (fix now)

Items that represent immediate exploitable risk.

Remediation commands

Pre-formatted az cli commands for each quick win, ready to approve and execute. Use GetAzCliHelp to validate the command syntax before suggesting.

# Enable HTTPS-only on App Service
az webapp update --name  --resource-group  --set httpsOnly=true

# Enable Defender for Storage
az security pricing create --name StorageAccounts --tier Standard

References

• Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
• Security Recommendations: https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference
• Defender Plans: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

Recommended cadence

Schedule this skill as a weekly task via SRE Agent scheduled tasks for continuous score improvement tracking.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ricmmartins
• Source: ricmmartins/azure-sre-agent-skills
• License: MIT

Install and usage instructions live in the source repository linked above.