Defender for Cloud secure score: triage and exemptions

Classic: Azure portal > Microsoft Defender for Cloud > Recommendations > Switch to classic view. Learn also lists the Overview page, the dedicated Secure score page and the top of the Recommendations page.

Cloud secure score: in the Defender portal, use Exposure Management > Secure score > View Cloud initiative, Exposure Management > Initiatives, or Cloud Infrastructure > Overview.

Management groups where you lack permission show the score as Restricted. That is a permissions issue, not a low score.

Note the overall score, the score per control and the date. Remember that controls are recalculated every eight hours, so compare like with like. For AWS and GCP, check View updates on the Secure Score card before you read anything into a change.

Learn says that without Defender CSPM the risk columns are blurred and risk levels are not available. Recommendations themselves are included with Defender for Cloud. Decide per environment whether risk prioritization is worth the plan cost.

In the Azure portal, go to Defender for Cloud > Recommendations. Learn lists filters for Exposed asset, Asset risk factors, Environment, Workload and Recommendation maturity, plus views for All recommendations, Misconfigurations, Vulnerabilities and Exposed Secrets. Risk level appears as the sort order and in the risk columns, not as a named filter on this page.

In the Defender portal, go to Exposure Management > Recommendations > Cloud. The summary cards show Cloud secure score, Score history (last seven days) and Recommendations by risk level.

Learn gives these risk levels: Critical, High, Medium, Low and Not evaluated. It says they come from each resource’s configuration, network connections and security posture. By default recommendations are prioritised by risk level. Learn also says to prioritise the security controls in the default MCSB standard, because those affect the Secure Score.

Group by title for estate-wide triage. Group by resource when one owner needs everything for their asset. A recommendation’s Graph tab shows the context used for risk prioritization, including attack paths.

For the classic score, use the control maximums above. The MFA control is the largest on the list.

Open a recommendation and use Take action. Learn says a Fix button appears only on some recommendations, and that it can remediate multiple resources. Use View remediation logic before you apply it. If there is no Fix button, follow the manual remediation steps. Status can take several minutes to update after remediation.

Learn does not state prerequisites or a specific role for Fix, and does not document an undo path. Test on a non-production subscription first.

Finish the control. Learn says the score improves only when all recommendations in it are remediated.

Learn says Deny prevents deployment of non-compliant resources, and Enforce uses the DeployIfNotExist effect to auto-remediate at creation. Both apply only to Azure recommendations and a subset of them. Deny can therefore block deployments and Enforce can deploy remediation, so test both outside production first.

• Enforce: Recommendations, select the recommendation, Enforce, Save. Learn says it takes effect immediately, but recommendations update on their freshness interval, up to 12 hours.
• Deny: Environment settings > Security policies > MCSB > Manage recommendations > Manage effect and parameters > Deny.

Learn describes Security admin as able to update security policies, but the page does not name a specific role for the Enforce button. Confirm what your admins need. For the policy side, see the Azure Policy baseline on audit-first rollout.

Learn says you need Owner or Security Admin on the scope. Creating a rule also needs permission to edit policies in Azure Policy. The required actions include Microsoft.Authorization/policyExemptions/write, /delete, /read and Microsoft.Authorization/policyAssignments/exempt/action. If any are missing, the Exempt button might be hidden.

1. Go to Azure portal > Defender for Cloud > Recommendations and select a recommendation.
2. Select Exempt.
3. Choose the scope and enter a name.
4. Set an expiration date. It is optional, so set one anyway.
5. Select a category: Resolved through third-party service (mitigated) or Risk accepted (waiver).
6. Add a description that says who approved it and why, then select Create.

Limits and prerequisites from Learn:

• Up to 5,000 resource exemptions per subscription.
• MCSB must be assigned on the subscription.
• Custom recommendations cannot be exempted.
• Preview recommendations might not support exemptions, and some MCSB recommendations do not support them at all.
• An exemption can take up to 24 hours to take effect. Exempted recommendations are hidden by default because the default status filter excludes Not applicable.

Learn recommends creating exemptions in the Defender for Cloud portal rather than through the Azure Policy API. The portal applies the exemption across all initiatives that contain the recommendation. An API-created exemption has to be made per initiative.

Learn also says disable rules are being deprecated in favour of exemptions.

Governance rules need the Defender CSPM plan, plus Contributor, Security Admin or Owner on the Azure subscriptions or AWS/GCP connectors. Go to Defender for Cloud > Management > Environment settings > Governance rules > Create governance rule.

• Priority runs from 1 (highest) to 1000.
• Rules can match by severity, risk level, recommendation category or specific recommendations.
• The owner is set by resource tag or email address.
• Due dates are 7, 14, 30 or 90 days after the rule triggers the recommendation.
• Exclusions can only be defined through the API.

Learn says owners get weekly emails listing on-time and overdue tasks, and the owner’s manager is emailed about overdue items if found in Microsoft Entra ID. A grace period for MCSB recommendations stops them affecting Secure Score until they reach the Overdue state. That delays the score impact. It does not remove the recommendation.

Learn says that as of January 2026 exemptions are managed centrally: Defender for Cloud > Environment settings > Exemptions, or Azure Policy > Exemptions. Reading them needs Microsoft.Authorization/policyExemptions/read at the right scope.

To list exempted resources, use Recommendations > Recommendation status > Exempted > Apply. On Inventory, use Add filter > Contains exemptions > Yes. For audit and cleanup across a subscription, Learn gives an Azure Resource Graph query on the policyresources table for type microsoft.authorization/policyexemptions. Take the full query from the Learn page.

Keep one exemption per resource and recommendation. Learn warns that duplicates can cause conflicting status.

Learn lists these ways to query the classic score: Azure Resource Graph (the SecurityResources table, types microsoft.security/securescores and microsoft.security/securescores/securescorecontrols), the Secure Scores and Secure Score Controls REST APIs, the Secure Score Over Time workbook, and Power BI. Take exact query syntax from the Learn page.