Pull Microsoft Defender for Cloud Posture with PowerShell
Get secure score, active recommendations, and regulatory compliance status across every subscription from one PowerShell workflow.
Defender for Cloud is one of the most powerful free things in Azure, and one of the most ignored. The secure score moves week to week, recommendations stack up, and regulatory compliance dashboards drift quietly out of date.
The Az.Security module exposes everything the portal does. PSForge gives you the Defender for Cloud tasks ready to assemble into a workflow that produces the report your security team actually wants on Monday morning.
What an honest CSPM workflow should produce
- Secure score per subscription with the trend versus last week
- All active recommendations grouped by severity
- Resources flagged by specific high-severity controls
- Regulatory compliance status against the standards you actually care about
- A diff of new recommendations introduced in the last 7 days
Why this becomes a workflow
Anyone can take a screenshot of the secure score. The value is in pulling the data consistently, comparing it to a baseline, and routing the diff to the team that owns each finding.
PSForge lets you assemble the Defender for Cloud tasks into one workflow, generate the PowerShell, and run it on a schedule from Azure Automation or a runbook server.
Example Defender for Cloud reporting workflow
- Connect to Azure with Connect-AzAccount and the right tenant
- Iterate every subscription the identity can read
- Capture secure score and trend data per subscription
- Pull active recommendations grouped by severity and resource type
- List resources affected by high-severity controls
- Pull regulatory compliance status for the assigned standards
- Diff today's recommendations against the previous snapshot
- Send the consolidated CSPM report to the security distribution list
Final thoughts
Defender for Cloud is only as useful as the rhythm you build around it.
PSForge makes it easy to assemble a single PowerShell workflow that turns the portal data into a report your security team can act on every week.