azure-security-benchmark

---
name: azure-security-benchmark
description: "Guidance for the Microsoft Cloud Security Benchmark (MCSB) — Microsoft's canonical set of cloud security best-practice controls mapped to industry frameworks and monitored in Microsoft Defender for Cloud. Covers control domains, applying the benchmark, and compliance tracking. WHEN: Microsoft Cloud Security Benchmark, MCSB, Azure Security Benchmark, security baseline controls, CIS NIST mapping, Defender for Cloud regulatory compliance, cloud security best practices, security controls framework."
license: MIT
metadata:
  author: Microsoft
  version: "0.1.0"
---

# Microsoft Cloud Security Benchmark (MCSB)

The Microsoft Cloud Security Benchmark (MCSB, successor to the Azure Security Benchmark) is
Microsoft's canonical, prescriptive set of cloud security best practices, with controls mapped
to CIS, NIST SP 800-53, PCI DSS, and ISO 27001, and monitored natively in Microsoft Defender
for Cloud. MCSB is the **default initiative** in Defender for Cloud - you are already being
scored against it.

## When to use
Use this skill when the user wants a recognised, framework-mapped cloud security baseline,
needs to translate compliance obligations into concrete Azure controls, or is trying to
prioritise where to start with Defender for Cloud recommendations.

**Do not use this skill** for:
- Tactical Defender for Cloud remediation work (use `defender-for-cloud-hardening`)
- Azure Policy authoring details (use `azure-policy`)
- Workload-specific threat modelling (use `threat-modelling`)

## Pick the right MCSB control domain first

MCSB has 12 control domains. Do not try to fix them in parallel - pick by **risk + dependency**:

| Priority | Domain | Why this order | Typical first action |
|---|---|---|---|
| **P0** | Identity Management + Privileged Access | Identity is the new perimeter; admin compromise = game over | Enforce MFA, remove standing Global Admin via PIM |
| **P0** | Logging & Threat Detection | Cannot respond without visibility | Enable diagnostic settings on subscriptions + Sentinel/Defender |
| **P1** | Network Security | Reduces blast radius of compromised identities | Default-deny NSGs, private endpoints for PaaS |
| **P1** | Data Protection | Encryption, key management, classification | Customer-managed keys for crown-jewel data, sensitivity labels |
| **P1** | Asset Management | Cannot protect what you cannot see | Tag policy + resource inventory |
| **P2** | Posture & Vulnerability Management | Continuous improvement loop | Onboard Defender for Servers, weekly Secure Score review |
| **P2** | Endpoint Security + Backup & Recovery | Resilience baseline | Defender for Endpoint + Azure Backup with immutable vault |
| **P2** | Incident Response | Process maturity | Runbook + tabletop with Defender XDR / Sentinel |
| **P3** | DevOps Security | Shift-left controls | GitHub Advanced Security or Azure DevOps with Defender for DevOps |
| **P3** | Governance & Strategy | Sustains the others | Azure Policy + management group structure |

> **Rule of thumb:** an MCSB Secure Score of **65-75%** is a realistic working target for a
> mature tenant; **>85%** typically means you are auditing recommendations that do not apply
> to your workloads. Validate before chasing 100%.

## Approach

1. **Confirm MCSB is the active baseline** — In Defender for Cloud → Regulatory compliance,
   MCSB is enabled by default but a tenant may have disabled it. Re-enable if missing.
   *Verify: Regulatory compliance dashboard shows "Microsoft cloud security benchmark" as an
   active standard with current pass/fail percentages.*
2. **Baseline your Secure Score** — Note current score per subscription and per control domain.
   This is the number you will move; without a baseline you cannot prove progress to leadership.
   *Verify: screenshot or export of Secure Score per subscription before remediation starts.*
3. **Map MCSB to the frameworks you are obligated to** — Do not treat CIS, NIST, ISO, PCI as
   separate workstreams. Use MCSB as the **canonical implementation** and the per-framework
   mappings to evidence compliance. Reduces 4 audits worth of work to 1.
   *Verify: Regulatory compliance dashboard shows your obligated frameworks alongside MCSB
   with overlap visible.*
4. **Triage by the priority table above** — Work P0 domains across all subscriptions first.
   Within each domain, sort recommendations by **Secure Score impact** (descending) and
   **affected resources** (descending). Top 5 per domain = quarter's work for most teams.
5. **Use service baselines for the implementation detail** — MCSB controls are abstract
   ("Enable encryption in transit"). The per-service **security baselines** translate to
   concrete Azure config (e.g. App Service: TLS 1.2 minimum, HTTPS-only on). Always read the
   service baseline before designing the fix.
   *Verify: a deployed resource passes its service baseline check in Defender for Cloud.*
6. **Enforce with Azure Policy** — Recommendations alone do not prevent regression. Promote
   each remediated control to a policy in **Audit** mode for 2 weeks, then **Deny** or
   **DeployIfNotExists**. This is what stops the next deployment breaking your score.
   *Verify: a test deployment that violates the policy is blocked (Deny) or auto-remediated
   (DeployIfNotExists).*
7. **Govern the programme** — Assign a domain owner per MCSB control domain. Monthly
   Secure Score review at security council. Quarterly framework-mapping reconciliation when
   compliance audits approach.

## Guardrails
- **MCSB is a baseline, not a workload threat model.** A 100% Secure Score does not mean
  your application is secure - it means your platform configuration meets defaults. Pair
  with `threat-modelling` for workload-specific risk.
- **Secure Score is directional, not gospel.** Some recommendations do not apply to all
  workloads (e.g. "Enable Microsoft Defender for SQL" is irrelevant for a tenant with no
  SQL). Use the "Not applicable" workflow rather than ignoring.
- **Recommendations affect cost.** Enabling Defender plans, Customer-Managed Keys, and
  immutable backup vaults add real Azure spend. Cost-model before mass-enabling.
- **Do not rely on Quick Fix for production.** Defender for Cloud's auto-remediate Quick Fix
  is great for dev/test; in production review the underlying Bicep/ARM change first.
- **Map first, remediate second.** Walking into a remediation sprint without the
  framework-mapping work means duplicating effort the next time an auditor walks in.
- **Service baselines lag the platform.** Treat baselines as a strong default, but check the
  service's own "Security best practices" doc for newer guidance.

## Common anti-patterns
- **"Chase 100% Secure Score."** Diminishing returns past ~75-85%; teams burn out auditing
  recommendations that do not apply.
- **"Treat MCSB and CIS as separate projects."** Doubles effort; MCSB *is* the implementation
  layer, CIS is one of many output mappings.
- **"Enable all Defender plans without budgeting."** Bill surprise next month, then a
  scramble to disable - which destroys your score and the programme credibility.
- **"Recommendations without policies."** Fix today, new deployment regresses tomorrow.
  Policy is what makes the fix stick.
- **"Ignore Not Applicable."** Score gets dragged down by recommendations that should be
  formally excluded, masking the real gaps.

## Example prompts
- `Map my Azure controls to the Microsoft Cloud Security Benchmark (MCSB).`
- `How does MCSB align to CIS and NIST controls?`
- `Use the Defender for Cloud regulatory compliance dashboard against MCSB.`
- `Which MCSB control domains should I prioritise first?`
- `What is a realistic Secure Score target for my tenant?`
- `Enforce MCSB controls with Azure Policy.`

## Microsoft Learn
- MCSB overview: https://learn.microsoft.com/security/benchmark/azure/overview
- Introduction & controls: https://learn.microsoft.com/security/benchmark/azure/introduction
- Service security baselines: https://learn.microsoft.com/security/benchmark/azure/security-baselines-overview
- Regulatory compliance dashboard: https://learn.microsoft.com/azure/defender-for-cloud/regulatory-compliance-dashboard
- Secure Score in Defender for Cloud: https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls
- Quick Fix remediation: https://learn.microsoft.com/azure/defender-for-cloud/implement-security-recommendations