Defender for Cloud: A Flat Secure Score and Missing Agent Data
Litware has 180 subscriptions under six management groups. Defender for Cloud has Defender CSPM enabled on two management groups and Defender for Servers Plan 2 on the production management group only; dev/test subscriptions have only the free foundational CSPM tier. An audit reports that secure score has been flat at 42% for three months even though teams closed roughly 200 recommendations; 70% of production VMs show No data or Not applicable for file integrity monitoring; 12 VMs in the just-in-time VM access blade show Unsupported; and the CISO wants one defensible number for board reporting that reflects the whole estate.
1. Why is the secure score flat despite 200 closed recommendations, and how do you confirm the cause rather than guess?
Read the worked answer
Several mechanisms can hold the number flat, and they are distinguishable:
- Scope mismatch. Secure score is computed per subscription and aggregated upward. If the 200 fixes landed in the two management groups with CSPM while the visible score is the tenant aggregate across 180 subscriptions, the movement is diluted. Re-read the score at the same scope you remediated.
- Preview recommendations do not count toward the score. A large share of what teams close may be preview assessments.
- Not applicable and excluded resources leave the denominator. Remediating a resource that was never counted moves nothing.
- Weighting. Controls carry different weights; closing many low-weight items produces a small delta.
- Assessment refresh lag and missing data. Recommendations that depend on agent or scan data stay unhealthy until fresh data arrives, so the fix is not yet visible.
Confirmation, not guesswork: open the score's control breakdown and compare the last 30 days of score change per control; enable continuous export to a Log Analytics workspace and query the score history; cross-check the count of preview versus GA recommendations you closed; and compare the denominators before and after. That tells you which of the five effects is dominant in a single pass.
2. Explain the file integrity monitoring and just-in-time findings, and state what you would verify first for each.
Read the worked answer
File integrity monitoring (70% No data / Not applicable):
- Dev/test subscriptions on the free foundational tier never receive FIM - that population alone explains a large part of the 70% and cannot be fixed by configuration. Decide explicitly whether to upgrade them or to exclude them from the reported metric.
- FIM requires the Azure Monitor Agent with a data collection rule and a Log Analytics workspace; the legacy Log Analytics agent is retired, so estates still relying on it report No data.
- Verify: per-subscription Defender for Servers plan tier, then whether AMA is present on each VM (auto-provisioning may be off), then whether the workspace and DCR are wired for the FIM solution.
Just-in-time VM access (12 Unsupported):
- JIT works by writing allow rules into an NSG. A VM whose NIC and subnet have no NSG has nothing to write to and reports Unsupported. Plan tier is the other common cause - JIT is a Defender for Servers Plan 2 capability.
- Verify: the subscription's plan, then whether each flagged VM has an NSG associated at the NIC or subnet level, then whether the VM is in a running state.
In both cases the finding is about coverage, not about the workloads, so fix the reporting scope first or you will chase configuration ghosts.
3. What single metric would you put in front of the board, and what would you pair it with so it cannot be gamed?
Read the worked answer
Primary number: the Defender for Cloud secure score aggregated at the tenant root management group, reported as a 90-day trend rather than a point value, with the change contribution broken out by control. A trend answers the board's real question - is risk going down - and a point value invites arguments about the denominator.
Pair it with coverage, which is the anti-gaming control:
- Percentage of subscriptions with the intended Defender plans enabled (today 2 of 6 management groups have CSPM, 1 of 6 has Servers Plan 2 - the score describes a fragment of the estate).
- Percentage of in-scope resources actually assessed (versus Not applicable / No data).
- Count of active exemptions and risk acceptances, trended. Score rises if you exempt your way out of findings; publishing the exemption count makes that visible.
- Mean time to remediate high-severity recommendations, which measures behaviour rather than posture.
Prerequisite action: before quoting any estate-wide figure, decide whether dev/test is in scope. If it is not, say so and report it separately - a number that silently averages a free-tier population with a fully protected one is neither defensible nor actionable.