The no-cost posture tier of Defender for Cloud, which supplies Secure Score, recommendations and the Microsoft cloud security benchmark. Attack paths, AI-SPM and threat protection are not part of it.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Foundational CSPM in context, with comparison tables and the common traps.
Terms in this definition
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Secure score
A single number from Microsoft Defender for Cloud that sums up your security posture. A higher figure means lower risk, and acting on recommendations pushes it up.
- Microsoft cloud security benchmark
Framework of security best practices from Microsoft, previously called Azure Security Benchmark, which Defender for Cloud assigns as its default standard.
- Attack paths
Defender CSPM capability showing how an attacker could chain exploitable weaknesses together to reach critical assets.
- AI security posture management
Part of Defender CSPM, absent from Foundational CSPM, that finds generative AI workloads, compiles an AI bill of materials and highlights AI-specific recommendations and attack paths.
Related terms
- Enhanced security features
Microsoft Defender for Cloud's paid plans, turned on separately for servers, storage, databases and other resource types. They provide workload protection beyond what the free foundational CSPM offers.
- Microsoft Defender for Cloud
Combines security posture management with workload protection: a free foundational CSPM tier, paid Defender plans, Secure Score and recommendations. Its regulatory compliance dashboard shows status only and blocks nothing.