Microsoft Defender for Cloud maps your Azure resources to predefined security frameworks such as CIS, ISO/IEC 27001, and NIST SP 800-53. The service continuously evaluates each resource against the controls in the selected framework. When a control is not met, the assessment flags a deficiency, which then triggers either a policy-based or an automated remediation workflow. This mapping and evaluation cycle runs without manual intervention, so the compliance status reflects the current state of your environment.
Compliance scores in Defender for Cloud give you a single numeric value that shows how well your resources satisfy the requirements of a chosen framework. The score is calculated from the number of passed controls divided by the total controls evaluated. A higher score means fewer gaps, and the score changes as resources are added, removed, or remediated. You can use the score to prioritize which deficiencies to fix first—focus on controls that have the greatest impact on the overall score or that address the most critical risks.
When a control deficiency is identified, Defender for Cloud supports two main paths to fix it. The first is policy-based remediation, where you apply Azure Policy definitions that automatically enforce the required configuration on new and existing resources. The second is automated remediation workflows, which can trigger actions such as running a script, deploying a template, or sending a notification. Both approaches reduce the need for manual checks and help maintain continuous compliance. The choice between them depends on whether you want to enforce a setting automatically (policy) or handle each case with a custom process (workflow).
The compliance dashboard in Defender for Cloud aggregates all assessment results into a single view. It shows the overall compliance score, the status of each control, and the resources that are failing. The dashboard also breaks down compliance by framework, so you can see at a glance how your environment aligns with CIS, ISO 27001, NIST SP 800-53, or any other selected standard. This visual summary helps you quickly identify which areas need attention and track progress over time.
Beyond the built-in frameworks, you can create custom compliance assessments to address internal policies, industry-specific regulations, or contractual requirements. A custom assessment is built by defining your own set of controls and mapping them to Azure Policy definitions or custom queries. This flexibility ensures that every unique compliance obligation is covered, even when no predefined framework matches your needs. Custom assessments appear in the same dashboard and scoring system as the built-in ones, so you manage all compliance requirements from a single place.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
The compliance score in Microsoft Defender for Cloud is calculated by dividing the number of passed controls by the total number of evaluated controls. This produces a single numeric value where a higher score reflects fewer compliance gaps. The score automatically updates as resources are added, removed, or remediated.
Policy-based remediation applies Azure Policy definitions to automatically enforce required configurations on new and existing resources, while automated remediation workflows trigger actions such as running scripts, deploying templates, or sending notifications. Organizations choose policy-based remediation to enforce settings automatically and use automated workflows when control deficiencies require custom processes.
Custom compliance assessments allow organizations to address internal policies, contractual requirements, or industry-specific regulations by defining a custom set of controls and mapping them to Azure Policy definitions or custom queries. These custom assessments integrate into the standard Defender for Cloud dashboard and scoring system alongside built-in frameworks.
StudyCerts
StudyCerts