Agent Foskett Academy • Microsoft Defender for Cloud • Module 1 • Lesson 9

Lesson 9 — Resource Inventory

Resource Inventory provides a unified security view of the cloud and hybrid assets known to Microsoft Defender for Cloud. It brings together Azure resources, Azure Arc-enabled servers and supported AWS and Google Cloud resources so security teams can search, filter, classify and investigate the environment from one place.

Inventory is more than a list of resource names. It helps analysts understand ownership, cloud provider, subscription or account, resource type, location, security posture, recommendations, Defender plan coverage and exposure.

This lesson explains inventory scope, filtering, tags, resource health, recommendations, multicloud visibility, Azure Resource Graph queries, ownership, data freshness, orphaned resources and the operational checks needed to ensure the organisation knows what it owns and whether each resource is protected.

You cannot secure a resource that nobody knows exists, owns or monitors.

Start Lesson Back to Defender for Cloud Academy

What you will learn

This lesson shows how Resource Inventory turns cloud assets into searchable security context.

Unified asset visibility

Filters, tags and ownership

Posture and coverage context

Resource Graph investigation

Resource Inventory architecture

Azure subscriptions and resources + Azure Arc-enabled servers + Connected AWS accounts + Connected Google Cloud projects ↓ Defender for Cloud discovers supported resources ↓ Inventory enriches assets with cloud, type, location and security context ↓ Analysts filter, search and group resources ↓ Recommendations and Defender coverage are reviewed ↓ Owners investigate and remediate exposure

Resource investigation flow

Start with a security question ↓ Choose inventory scope ↓ Filter by cloud, subscription, account or project ↓ Filter by resource type and location ↓ Review tags, owner and environment ↓ Check recommendations and Defender plan coverage ↓ Open the affected resource ↓ Validate current configuration and telemetry ↓ Assign remediation and track closure

Inventory fields and security value

Field	Security value	Example question
Cloud and account	Identifies where the resource is hosted and governed.	Which AWS account owns this exposed workload?
Resource type	Separates servers, storage, databases and containers.	How many internet-facing storage resources exist?
Tags	Provides owner, environment and criticality context.	Which critical resources have no owner tag?
Recommendations	Shows active posture weaknesses.	Which resources have high-severity recommendations?
Defender coverage	Shows whether workload protection is enabled.	Which production servers are outside Defender coverage?

Agent Foskett investigation: “The resource had no owner…”

A public IP appeared in an exposure review ↓ It was attached to a production virtual machine ↓ The resource name looked temporary ↓ No application team recognised it ↓ The owner tag was empty ↓ The environment tag said Test ↓ But the machine was processing live customer data ↓ Agent Foskett opened Resource Inventory ↓ The VM had three high-severity recommendations ↓ Defender for Servers was not enabled ↓ The resource group belonged to an old project ↓ Ownership was assigned ↓ Public access was restricted ↓ Defender protection was enabled ↓ Mandatory owner and lifecycle tags were introduced

The resource was visible without enough context for anyone to take responsibility.

Key takeaways

Resource Inventory provides a unified view of supported Azure, hybrid and multicloud assets.
Filters help analysts narrow large estates to the resources that matter.
Tags turn technical assets into business context.
Owner, environment and criticality should be mandatory metadata.
Recommendations show active posture weaknesses.
Defender coverage must be checked per resource.
Stale, duplicate and orphaned resources distort reporting.
Resource Graph supports repeatable estate-wide queries.

Learning objectives

Use Resource Inventory to find, classify and investigate cloud resources.

What is Resource Inventory?

A Defender for Cloud view that combines resource metadata with security context.

Why inventory matters

Unknown, unmanaged or incorrectly classified assets create security gaps.

Supported cloud scope

Inventory can include Azure, Azure Arc, AWS and Google Cloud resources.

Scope selection

Choose the correct management group, subscription, account or project before interpreting results.

Resource discovery

Resources are discovered through Azure Resource Manager and connected cloud integrations.

Search by resource name

Use names with resource IDs, tags and scope because naming standards may be unreliable.

Filter by cloud

Separate Azure, AWS and Google Cloud resources for provider-specific review.

Filter by subscription or account

Isolate business units, environments and delegated teams.

Filter by resource type

Focus on servers, storage, databases, clusters or other workload types.

Filter by location

Support residency, regional governance and exposure analysis.

Filter by recommendations

Narrow the estate to resources with active posture weaknesses.

Recommendation severity

Combine severity with exploitability, exposure and business criticality.

Defender plan coverage

Confirm the relevant workload protection plan is enabled at the correct scope.

Unprotected resources

Visibility does not mean advanced threat protection is active.

Tags as security context

Tags connect resources to owner, application, environment and criticality.

Mandatory ownership tags

Every production resource should have an accountable owner or team.

Environment tags

Production, development, test and DR classifications help judge urgency.

Criticality tags

Criticality should reflect business impact, not resource size.

Data classification tags

Mark resources that store regulated or confidential information where appropriate.

Tag quality

Incorrect tags can create more false confidence than missing tags.

Naming standards

Consistent names help, but security decisions should not rely on names alone.

Resource identifiers

Resource IDs uniquely identify assets across subscriptions and clouds.

Resource details

Open a resource to review provider, type, location, recommendations and coverage.

Healthy resources

No visible recommendations does not automatically mean no risk.

Assessment freshness

Check the recency of inventory and recommendation data.

Connector health

Broken AWS or Google Cloud connector permissions can reduce visibility.

Azure Arc health

Disconnected Arc machines may remain visible while current telemetry stops.

Subscription coverage

New subscriptions can fall outside policy and Defender plan scope.

Orphaned resources

Assets without an owner or lifecycle process often retain exposure and cost.

Stale resources

Long-inactive assets should be reviewed for abandonment or continuing need.

Duplicate resources

Repeated registrations and rebuilds can distort counts and coverage.

Shadow cloud resources

Resources created outside approved processes may lack tags, logging and protection.

Internet exposure

Combine inventory with exposure data to find public services and open ports.

Identity context

Managed identities and privileged roles can increase attacker value.

Data context

Storage, databases and key vaults require sensitivity and access-path review.

Resource Graph

Use Azure Resource Graph for fast, repeatable queries across large estates.

Find missing owner tags

Resources | where isempty(tags["Owner"]) | project name, type, resourceGroup, subscriptionId, location | order by type asc

Find virtual machines

Resources | where type =~ "microsoft.compute/virtualmachines" | project name, resourceGroup, location, subscriptionId, tags | order by name asc

Inventory dashboards

Track total resources, unowned assets, recommendations, protection gaps and connector health.

Ownership workflow

Record resource ID, activity, exposure, cost centre and dependencies when ownership is unclear.

Lifecycle management

Inventory should support creation, operation, review and decommissioning.

Inventory and incidents

Use inventory context to identify owner, environment, location and workload type during incidents.

Inventory and compliance

Prove which resources are in scope, how they are classified and which controls apply.

Inventory validation checklist

Expected cloud environments connected
Arc servers reporting
Mandatory tags populated
Owners current
Recommendations fresh
Defender coverage verified
Duplicates reviewed
Orphaned resources assigned

Common inventory mistakes

Reviewing only Azure
Assuming every account is connected
Trusting names instead of IDs
Accepting incorrect tags
Equating visibility with protection
Failing to assign owners

What Agent Foskett checked

Resource ID and cloud provider
Subscription, account or project
Owner and environment tags
Creation and recent activity
Public exposure
Defender coverage
Recommendations and freshness
Application dependencies

Operational lesson

Asset visibility becomes security only when inventory is complete, current and connected to ownership and remediation.

Best practices

Connect every approved cloud environment.
Require owner, environment and criticality tags.
Review unowned resources regularly.
Validate connector and Arc health.
Track protection gaps.
Use Resource Graph for repeatable checks.
Review stale and duplicate assets.

Related Agent Foskett resources

Continue building Microsoft Defender for Cloud inventory, posture and multicloud investigation skills.

Microsoft Defender for Cloud Academy Lesson 8 — Multicloud Protection Lesson 7 — Azure Arc Integration Microsoft Sentinel Academy Agent Foskett Academy Microsoft Security Services

Continue learning

Continue Module 1 by learning how Security Recommendations identify and prioritise weaknesses across cloud resources.

⬅ Previous lesson

Lesson 8 — Multicloud ProtectionConnect AWS and Google Cloud environments for unified posture and workload visibility.

🏠 Academy home

Microsoft Defender for Cloud AcademyReview the complete roadmap across posture, workloads, compliance and investigation.

📚 Next lesson

Lesson 10 — Security RecommendationsUnderstand recommendation severity, affected resources, remediation and prioritisation.

What is Microsoft Defender for Cloud Resource Inventory?

Resource Inventory provides a unified view of supported Azure, AWS, Google Cloud and hybrid resources with security posture, ownership, recommendation and Defender coverage context.

Resource Inventory Lesson

This Agent Foskett lesson explains Defender for Cloud Resource Inventory, filters, tags, ownership, recommendations, protection coverage, stale resources and Azure Resource Graph investigation.