Cloud security posture management on Azure has quietly been rebuilt over the past year. Microsoft Defender for Cloud became generally available inside the Microsoft Defender portal in May 2026, a risk-based Cloud secure score replaced simple control counting there, recommendations from Defender for Cloud and Microsoft Security Exposure Management were merged into one catalog, and from October 27, 2026, Foundational CSPM is no longer switched on by default for new Azure subscriptions. Each change is sensible on its own. Together, they mean that many organizations’ posture processes, dashboards and even assumptions about baseline coverage are now out of date.
This article explains what changed, why it matters for teams that operate Azure environments, and how to run security posture as a continuous operational discipline rather than a quarterly scramble before an audit.
What Changed in 2025–2026
The release notes for Defender for Cloud and Exposure Management describe a steady consolidation. The headline changes for operations teams are:
- Unified portal. On May 5, 2026, Defender for Cloud’s integration into the Microsoft Defender portal reached general availability, unifying cloud posture management and threat protection across Azure, AWS and Google Cloud with a shared dashboard and cloud asset inventory.
- Risk-based Cloud secure score. Also generally available in May 2026, available in the Defender portal, with daily snapshots. Microsoft recalculated historical values, so long-running trend lines may shift slightly.
- One recommendations catalog. In November 2025, Exposure Management integrated Defender for Cloud CSPM and Defender Vulnerability Management into a unified catalog organized by devices, cloud, identity, SaaS apps and data, with risk-based prioritization for cloud resources.
- Broader multicloud coverage. In June 2026, expanded coverage for AWS and Google Cloud reached general availability, adding roughly 90 resource types and more than 200 recommendations that affect the Cloud secure score.
- Code-to-cloud context. GitHub Advanced Security integration became generally available in May 2026, enriching code alerts with runtime risk factors such as internet exposure, for customers with the Defender CSPM plan.
- Foundational CSPM becomes opt-in for new subscriptions. From October 27, 2026, new Azure subscriptions start with Foundational CSPM disabled. It remains free, existing subscriptions keep their settings, and AWS and Google Cloud connectors still enable it by default. Microsoft now recommends the Defender portal as the place to manage Defender plans, posture policies and recommendations.
There is more in the pipeline: posture policies and recommendation exemptions for Azure in the Defender portal entered preview in late October 2026, and cloud security plan management in the Defender portal entered preview in October 2026.
Why These Changes Matter Operationally
Coverage is no longer automatic
For years, teams could assume every new subscription was at least evaluated against free baseline recommendations. That assumption no longer holds for subscriptions created after October 27, 2026. If your subscription vending process does not explicitly enable Foundational CSPM, new workloads may appear without any posture evaluation at all, and the gap may only surface during an incident or audit.
Scores and trends need re-baselining
A risk-based score weights recommendations by severity, asset context and potential impact rather than treating every control equally. That is a better reflection of real risk, but it means the number you reported to leadership last year is not directly comparable to the number you report now. Microsoft’s own note that historical values were recalculated is a prompt to explain the change before someone asks why the score moved.
Ownership boundaries blur
When cloud posture, endpoint vulnerabilities, identity exposure and SaaS configuration live in one portal and one catalog, the old split between “cloud team handles Defender for Cloud” and “security operations handles Defender XDR” stops working cleanly. Someone has to decide which team owns which recommendation categories and how they hand off.
Prioritization finally becomes practical
The upside is significant. Attack paths that start from external entry points and reach business-critical assets, critical asset classifications and risk-based prioritization mean teams can focus on the small number of issues that create real exposure instead of chasing thousands of low-impact recommendations.
Plan management and billing are moving too
The October 2026 preview of cloud security plan management in the Defender portal introduces a different billing approach for subscriptions migrated to the new experience. Before moving plan management, finance and security should jointly model how the change affects cost allocation and chargeback, especially where security spend is split across business units. Treat it as a planned migration with a pilot management group, not a toggle someone flips on a Friday afternoon.
Posture management is no longer about raising a score. It is about continuously closing the specific paths an attacker could use to reach the assets that matter most, and proving you did.
A Posture Operations Model That Works
We recommend structuring Azure posture operations around five capabilities.
- Coverage assurance. Guarantee that every subscription, AWS account and Google Cloud project in scope is onboarded with the intended Defender plans. Enforce this through Azure Policy and your subscription vending pipeline, and reconcile coverage weekly against your inventory of record.
- Critical asset definition. Use Exposure Management’s critical asset classifications, and add your own, so prioritization reflects business impact. A storage account holding customer records and a sandbox storage account should never compete for attention.
- Risk-based triage. Work from attack paths and risk-prioritized recommendations, not raw recommendation lists. Define time-to-remediate targets by risk level.
- Remediation at the source. Fix issues in infrastructure-as-code modules, Azure Policy and pipeline templates so the same misconfiguration does not reappear in the next deployment. Portal fixes should be the exception.
- Exceptions and evidence. Manage exemptions with owners, justifications and expiry dates, and keep a clear audit trail. The preview of posture policies and recommendation exemptions in the Defender portal is worth piloting for this.
A word on prevention versus detection. Azure Policy can audit, modify, deploy missing configuration or deny non-compliant deployments outright. A mature program moves recurring, well-understood findings up that ladder: start with audit to measure impact, use deploy-if-not-exists or modify effects to fix configuration automatically where safe, and reserve deny for settings where an exception would be rare and the risk is high, such as public network access on production data stores. Every finding that becomes a preventive policy is a finding nobody has to triage again.
Operating Cadence and Roles
A predictable rhythm keeps posture work from being crowded out by feature delivery.
Daily
- Review new critical attack paths and high-risk recommendations on critical assets.
- Route findings to owning teams through the ITSM or DevOps backlog with clear context and due dates.
- Check for newly created subscriptions that lack expected Defender plan coverage.
Weekly
- Hold a 30-minute posture review with platform, security and the top two or three application owners by exposure.
- Review remediation progress against targets and escalate blocked items.
- Review expiring exemptions and confirm renewal or closure.
Monthly
- Report risk-based secure score trends with context, top closed attack paths and outstanding critical exposure to leadership. The built-in cloud security reports, generally available since June 2026, are a useful starting point.
- Review new recommendation types from Microsoft’s release notes and decide how to handle them before they surprise teams.
- Tune Azure Policy initiatives and IaC modules based on recurring findings.
Roles should be explicit: a posture lead accountable for the program, platform engineers who own guardrails and modules, application owners accountable for remediation in their workloads, and security operations responsible for correlating posture with active threats.
Migration Checklist for the Defender Portal Era
- Update subscription vending to enable Foundational CSPM, and any paid plans you require, explicitly for every new subscription.
- Inventory existing subscriptions and confirm their current plan state; do not assume consistency.
- Re-baseline secure score reporting on the risk-based Cloud secure score and document why numbers changed.
- Agree on ownership of each recommendation category in the unified catalog across cloud, endpoint, identity, SaaS and data.
- Review role assignments so the right people can see and manage cloud posture in the Defender portal.
- Re-point dashboards, workbooks and automation that relied on older views or APIs, and test them.
- Classify critical assets and validate that attack path results reflect your business priorities.
- Pilot the preview posture policies and exemptions features in a non-production management group.
- If you use GitHub, evaluate the GitHub Advanced Security integration to connect code findings to runtime exposure.
Worked Example: Closing an Internet-to-Data Attack Path
Picture a mid-sized company running a customer portal on Azure Kubernetes Service, with data in Azure SQL Database and Azure Storage. The weekly posture review shows a high-risk attack path: an internet-exposed AKS workload runs a container image with a known exploitable vulnerability, the workload’s managed identity has broad data-plane access to a storage account classified as critical because it holds customer documents, and that storage account allows public network access.
Rather than treating these as three unrelated recommendations, the team works the path. The application owner rebuilds the image from a patched base and adds image scanning gates to the pipeline. The platform team narrows the workload identity’s role assignment to the single container it needs. The storage account is switched to private endpoint access, and an Azure Policy assignment is added to deny public network access for storage in production management groups. Within days, the attack path disappears from the view, and because the fixes were made in code and policy, new deployments inherit them.
In the monthly report, the team presents this as one closed critical path with three permanent guardrail improvements, which is far more meaningful to leadership than a two-point secure score increase.
The same pattern scales. Each week, pick the highest-risk paths to critical assets, assign every link in each path to an owner, and require at least one fix that prevents recurrence. Over a quarter, the number of new paths falls because the guardrails accumulate, and the posture team spends less time chasing and more time improving.
Metrics, Pitfalls and Multicloud Considerations
Metrics that matter
- Coverage: percentage of subscriptions, AWS accounts and Google Cloud projects onboarded with the intended plans.
- Exposure: number of open critical attack paths that reach critical assets, and their age.
- Speed: median time to remediate high-risk recommendations on critical assets, by owning team.
- Recurrence: share of findings that reappear after remediation, a direct indicator of whether fixes are made at the source.
- Prevention: number of recurring findings converted into preventive Azure Policy or IaC guardrails each quarter.
- Exceptions: active exemptions, their average age and the share past expiry.
Pitfalls we see repeatedly
- Chasing the score. Teams fix many easy, low-impact recommendations to move the number while critical paths stay open. Report closed attack paths alongside the score.
- Fixing in the portal. Manual fixes drift back with the next deployment. Insist that remediation lands in code or policy.
- No owner for shared resources. Hub networks, shared Key Vaults and platform identities often have no clear application owner, so their findings languish. Assign them to the platform team explicitly.
- Assuming new subscriptions are covered. After October 27, 2026, they are not unless you enable it. Make coverage part of the vending definition of done.
- Ignoring preview changes until they land. Recommendation scope changes, such as the move of Kubernetes posture recommendations to controller-level scope in October 2026, can shift scores and queues. Read release notes monthly.
Multicloud reality
Many Azure customers also run AWS or Google Cloud workloads. With expanded multicloud coverage now affecting the Cloud secure score, one posture program can cover all three, which simplifies reporting. Be deliberate, though, about whether Defender for Cloud or a cloud-native service is the system of record for each environment, and avoid running two scanners that produce conflicting queues for the same team. Pick one triage queue per team, even if the signals come from several tools.
Where AI Fits in Posture Operations
AI is entering posture work from two directions. Vendors are adding AI-assisted summaries, remediation guidance and investigation capabilities across security and operations tools, and operations agents such as Azure SRE Agent can already reason over Azure resources. At the same time, AI workloads themselves create new posture requirements: Defender for Cloud added AI model security for Azure Machine Learning in preview in March 2026, and Exposure Management introduced classifications for AI agents in mid-2026.
Practical guidance for 2026–2027:
- Use AI assistance to draft remediation steps and IaC changes, but keep human review and pipeline testing for every change.
- Treat AI workloads, model registries and agent identities as critical assets with dedicated posture coverage.
- Expect auditors to ask how automated remediation is approved and logged, and design for that from the start.
Conclusion
The move of Defender for Cloud into the Defender portal, the arrival of risk-based scoring and the change to opt-in Foundational CSPM are not cosmetic. They change who owns posture, how it is measured and whether new workloads are covered at all. Organizations that update their vending processes, re-baseline their metrics, define critical assets and fix issues at the source will get a clearer view of real risk with less noise. Treat posture as an operational discipline with a cadence, owners and evidence, and the new tooling becomes a genuine advantage instead of another console to watch.
How Hanoi Technology Can Help
Hanoi Technology helps teams run Azure security posture as an ongoing operation, from coverage assurance and policy-as-code to attack path remediation and reporting.