How to Raise Your Defender for Cloud Secure Score in 30 Days

Retrospective: this article looks back at events from November 2021, written in 2026 with the benefit of hindsight.

Defender for Cloud's secure score measures how many security recommendations you've implemented. Here is a 30-day plan to raise it meaningfully — focusing on risk, not just points.

Week 1: Understand the score

Open Defender for Cloud → Environment settings and confirm all subscriptions (and AWS/GCP connectors) are included.
Review the secure score by security control. Each control groups related recommendations, and you earn its points only when all resources are healthy.
Export recommendations and group by owner (subscription or resource group).

Week 2: Quick, high-impact controls

Prioritize controls with high points and low effort:

Enable MFA for accounts with Azure permissions (now largely enforced by Microsoft's mandatory MFA).
Secure management ports (close RDP/SSH, use Bastion or JIT).
Restrict unauthorized network access (NSGs on subnets and VMs).
Enable encryption at rest where not default.
Apply system updates.

Week 3: Identity and data

Reduce subscription Owner assignments and remove external accounts with Owner permissions.
Disable public network access for storage, SQL and Key Vault where possible.
Enable soft delete and purge protection for Key Vault.

Week 4: Lock in progress

Assign Azure Policy initiatives (the Microsoft cloud security benchmark is assigned by default) with Deny effects for the controls you fixed, so new resources stay compliant.
Use governance rules in Defender for Cloud to assign owners and due dates automatically.
Set exemptions (with justification and expiry) for recommendations that don't apply.

Report

Share the before/after secure score and the top remaining risks with leadership.