Agent Foskett Academy • Microsoft Defender for Cloud • Module 2 • Lesson 15

Lesson 15 — Cloud Security Explorer

Cloud risk is rarely caused by one isolated setting.

This lesson explains how Microsoft Defender for Cloud Security Explorer queries cloud assets and security relationships to investigate exposure, trace risky combinations and identify the resources that matter most.

The dangerous question is not only “What is vulnerable?” It is “What can reach it, use it or move through it?”

Start Lesson Back to Defender for Cloud Academy

Agent Foskett Cloud Security Explorer lesson

What you will learn

This lesson explains how to explore cloud assets, relationships and exposure paths.

Asset queries

Security relationships

Exposure analysis

Risky combinations

Cloud Security Explorer investigation flow

Start with an investigation question ↓ Choose a resource type or security condition ↓ Add filters ↓ Add relationship conditions ↓ Run the query ↓ Review matching assets ↓ Inspect identities, permissions and connectivity ↓ Identify risky combinations ↓ Open the affected resource ↓ Review recommendations and attack paths ↓ Confirm business context ↓ Prioritise remediation ↓ Save or repeat the query

Common query building blocks

Query element	What it examines	Example investigation
Resource type	Virtual machines, storage, databases, identities and other cloud assets.	Find internet-exposed virtual machines.
Security condition	Vulnerabilities, recommendations, misconfiguration and posture findings.	Find resources with critical vulnerabilities.
Network relationship	Public exposure, connectivity and reachable resources.	Find vulnerable assets reachable from the internet.
Identity relationship	Users, service principals, managed identities and permissions.	Find identities with high privilege over exposed resources.
Data relationship	Connections between compute, storage, databases and secrets.	Find exposed applications connected to sensitive data stores.
Cloud scope	Azure subscriptions, AWS accounts and GCP projects.	Compare exposure across multiple cloud environments.
Tags and ownership	Business unit, application, environment and owner metadata.	Find production assets without an assigned owner.
Recommendation state	Open, exempted, unhealthy or unresolved findings.	Find critical recommendations on internet-facing resources.

Useful investigation questions

Which internet-facing resources have critical vulnerabilities?
Which storage accounts are publicly accessible and contain sensitive data?
Which identities have excessive permissions over production resources?
Which virtual machines are exposed and missing endpoint protection?
Which applications can reach critical databases?
Which resources have high-risk recommendations and no owner?
Which cloud assets are connected to privileged identities?
Which exempted recommendations still affect externally exposed resources?
Which resources combine public exposure, weak identity controls and known vulnerabilities?
Which multicloud assets create the greatest potential blast radius?

Agent Foskett investigation: “The database was private… but the application was not.”

A database was not directly exposed to the internet ↓ The team considered it low risk ↓ Cloud Security Explorer was used to inspect relationships ↓ The database was connected to a public web application ↓ The application used a managed identity ↓ The identity had broad permissions ↓ The application server had critical vulnerabilities ↓ A compromised application could reach the database ↓ The database itself was private ↓ But the path to it was exposed ↓ Agent Foskett reviewed the full relationship chain ↓ Public application ↓ Vulnerable compute resource ↓ Overprivileged managed identity ↓ Sensitive database access ↓ The application was patched ↓ Identity permissions were reduced ↓ Network controls were tightened ↓ The risky combination was broken

The database was private. The route to the database was not.

Key takeaways

Cloud Security Explorer investigates relationships rather than isolated findings.
Queries can combine resource type, exposure, vulnerabilities, permissions and ownership.
Public exposure becomes more serious when combined with exploitable weaknesses.
Identity relationships can reveal hidden access paths.
Private resources may still be reachable through exposed applications or overprivileged identities.
Cloud Security Explorer supports Azure, AWS and GCP visibility where connected.
Saved investigation patterns can support repeatable posture reviews.
Business context remains essential when interpreting query results.
Findings should be validated before remediation decisions are made.
The most important risk is often the combination of several smaller weaknesses.

Learning objectives

After completing this lesson, you should be able to build Cloud Security Explorer queries, analyse relationships and identify risky resource combinations.

What is Cloud Security Explorer?

Cloud Security Explorer is a query-based investigation capability for analysing cloud assets and security relationships.

Why relationships matter

Attackers move through permissions, connectivity and dependencies rather than treating resources as isolated objects.

Query builder

The query builder allows investigators to combine resource conditions and relationships without writing code.

Resource conditions

Resource conditions filter assets by type, state, configuration, recommendation or exposure.

Relationship conditions

Relationship conditions connect resources to identities, networks, data stores and other assets.

Azure resources

Explorer can investigate supported Azure resources across subscriptions and management scopes.

AWS resources

Connected AWS accounts can contribute supported asset and posture relationships.

GCP resources

Connected GCP projects can contribute supported asset and posture relationships.

Public exposure

Publicly reachable resources should be examined alongside vulnerabilities and permissions.

Critical vulnerabilities

Critical vulnerabilities become more urgent when the affected resource is reachable or highly privileged.

Identity exposure

Identity relationships can reveal users, service principals and managed identities with dangerous access.

Overprivileged identities

Excessive permissions can turn a small compromise into a much larger incident.

Managed identities

Managed identities should be reviewed for unnecessary access to sensitive resources.

Service principals

Service principals can create hidden access paths when credentials or permissions are poorly controlled.

Storage exposure

Public or broadly accessible storage should be investigated for sensitive content and linked applications.

Database relationships

Databases may be indirectly exposed through connected applications and identities.

Network reachability

Reachability helps determine whether one resource can communicate with another.

Attack paths

Attack paths combine relationships into a route an attacker could potentially exploit.

Recommendations

Explorer queries can use security recommendations as investigation conditions.

Exemptions

Exempted findings should still be reviewed when they participate in a risky exposure chain.

Ownership

Ownership metadata helps route findings to the correct team.

Environment filters

Environment filters can narrow investigations to subscriptions, accounts, projects or regions.

Risk combinations

Several moderate weaknesses can combine into one high-impact exposure.

Blast radius

Blast radius describes how far an attacker could move after compromising a resource or identity.

Lateral movement

Relationships can reveal possible movement between applications, identities and data.

Sensitive resources

Critical databases, secrets, key stores and privileged systems deserve additional context.

Saved queries

Repeatable query patterns help security teams perform consistent posture reviews.

Investigation workflow

Start with a question, build the query, inspect results, validate context and prioritise action.

Result validation

Confirm that each relationship and condition accurately reflects the environment.

False assumptions

Do not assume that private, internal or low-severity resources are automatically low risk.

Prioritisation

Prioritise combinations that include public exposure, privilege, sensitive data and exploitable weaknesses.

Remediation planning

Break the risky path by removing one or more critical relationships or conditions.

Patch management

Patching can remove the exploitable weakness from an otherwise risky chain.

Permission reduction

Least privilege can break identity-based exposure paths.

Network controls

Segmentation and private access can reduce reachability.

Resource isolation

Isolation can contain a high-risk resource while permanent remediation is completed.

Multicloud visibility

Use consistent investigation questions across connected Azure, AWS and GCP environments.

Reporting

Summarise the affected assets, relationships, business impact and remediation priorities.

Collaboration

Security, platform, identity and application teams may all be needed to resolve complex exposure paths.

Continuous review

Rerun important queries because cloud relationships change frequently.

New resources

New deployments can introduce fresh exposure and permission relationships.

Configuration drift

Configuration changes can recreate previously resolved risky combinations.

Query scope

Begin with a focused scope, then expand only when broader investigation is required.

Evidence

Retain query results, affected resource details and remediation decisions.

What Agent Foskett checked

Agent Foskett checked public exposure, vulnerabilities, managed identity permissions and database relationships.

Best practices

Begin with a clear investigation question.
Combine exposure, vulnerability, identity and data conditions.
Use the smallest practical scope.
Validate query results against the actual environment.
Prioritise risky combinations rather than isolated findings.
Review identity permissions and network reachability together.
Save useful investigation patterns.
Rerun queries after major cloud changes.
Document business context and ownership.
Break the exposure path through targeted remediation.

Related Agent Foskett resources

Continue building Microsoft Defender for Cloud posture, investigation and remediation skills.

Microsoft Defender for Cloud Academy Lesson 14 — Governance Rules Recommendation Remediation Microsoft Sentinel Academy Microsoft Defender for Endpoint Academy Agent Foskett Academy Microsoft Security Services

Continue learning

Next, configure Defender plans, monitoring coverage, extensions, connectors and subscription-level security settings.

⬅ Previous lesson

Lesson 14 — Governance RulesAssign owners, define due dates, track remediation and build accountability around cloud security findings.

🏠 Academy home

Microsoft Defender for Cloud AcademyReview the complete roadmap across posture, workloads, compliance and investigation.

📚 Next lesson

Lesson 16 — Environment SettingsConfigure Defender plans, monitoring coverage, extensions, connectors and subscription-level security settings.

What is Microsoft Defender for Cloud Security Explorer?

Microsoft Defender for Cloud Security Explorer is a query-based investigation capability that helps security teams analyse cloud assets, identities, permissions, connectivity and security relationships.

Cloud Security Explorer Lesson

This Agent Foskett lesson explains asset queries, relationship conditions, exposure analysis, identity permissions, network reachability, attack paths, multicloud visibility and risky resource combinations.