Ensure Microsoft Defender EASM is Enabled

1. Sign in to the Microsoft Azure Portal.

2. Navigate to the Defender EASM workspaces blade available at https://portal.azure.com/#browse/Microsoft.Easm%2Fworkspaces to list the Microsoft Defender EASM workspaces created within your Azure account.

3. Choose the Azure subscription that you want to examine from the Subscription equals all filter box and choose Apply. If no Defender EASM workspace resources are listed, Microsoft Defender EASM is not enabled for the selected Azure subscription.

4. Click on the name (link) of a Defender EASM workspace to examine.

5. In the left navigation panel, under Manage, select Discovery and verify that at least one Seed (a domain, host, CIDR block, or WHOIS record) is configured, then select Inventory and verify that discovered assets are listed. If no Seeds are configured and the Inventory is empty, the workspace is not properly configured to monitor your organization's attack surface.

6. Repeat steps no. 4 and 5 for each Defender EASM workspace listed for the selected Azure subscription.

7. Repeat steps no. 3 – 6 for each Azure subscription available within your Microsoft Azure account.

Azure CLI does not provide a dedicated command set for Microsoft Defender EASM. The following commands use the generic resource command group, based on the Microsoft.Easm/workspaces resource type, to confirm whether a Defender EASM workspace has been deployed; they cannot verify whether Seeds and Inventory review have been configured appropriately for your organization, which must be checked from the Azure Portal (see Using Azure Console).

1. Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

   az account list
   --query '[*].id'
   

2. The command output should return the requested subscription identifiers (IDs):

   [
       "abcdabcd-1234-abcd-1234-abcdabcdabcd",
       "abcd1234-abcd-1234-abcd-abcd1234abcd"
   ]
   

3. Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

   az account set
   --subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
   

4. Run resource list command (Windows/macOS/Linux) with custom output filters to list the Microsoft Defender EASM workspaces created within the selected Azure subscription:

   az resource list
   --resource-type "Microsoft.Easm/workspaces"
   --query '[].{name:name, resourceGroup:resourceGroup}'
   

5. The command output should return the requested Defender EASM workspace names and resource groups:

   [
       {
           "name": "cc-easm-workspace",
           "resourceGroup": "cc-easm-resource-group"
       }
   ]
   

   If the resource list command output returns an empty array ([]), Microsoft Defender EASM is not enabled for the selected Azure subscription, as there are no Defender EASM workspaces created.

6. Run resource show command (Windows/macOS/Linux) using the name and resource group of the Defender EASM workspace that you want to examine, to retrieve its provisioning status:

   az resource show
   --resource-type "Microsoft.Easm/workspaces"
   --name cc-easm-workspace
   --resource-group cc-easm-resource-group
   --api-version 2023-04-01-preview
   --query 'properties'
   

7. The command output should return the provisioning state and data-plane endpoint of the selected Defender EASM workspace:

   {
     "provisioningState": "Succeeded",
     "dataPlaneEndpoint": "https://cc-easm-workspace.easm.defender.microsoft.com/"
   }
   

   If the provisioningState property value returns "Succeeded", as shown in the example above, the Defender EASM workspace has been successfully deployed for the selected Azure subscription. Sign in to the Azure Portal to verify that Seeds have been provided and that the Inventory is being reviewed appropriately for the workspace (see Audit section part I); the resource show command output does not indicate whether these organization-specific configuration steps have been completed.

8. Repeat steps no. 6 and 7 for each Defender EASM workspace available in the selected Azure subscription.

9. Repeat steps no. 3 – 8 for each Azure subscription available in your Microsoft Azure cloud account.

1. Sign in to the Microsoft Azure Portal.

2. Navigate to Resource groups blade available at https://portal.azure.com/#view/HubsExtension/BrowseResourceGroups and choose Create to create a new resource group for the Defender EASM workspace (skip this step if you plan to use an existing resource group).

3. Select or enter the following property values, then choose Review + create and Create:

   1. For Subscription, select the Azure subscription that you want to configure.
   2. For Resource group, provide a unique name for the new resource group, for example cc-easm-resource-group.
   3. For Region, select an Azure region to store the resource group's metadata.

4. Navigate to the Azure Portal home page available at https://portal.azure.com/, type Microsoft Defender EASM into the search box at the top of the page, and select Microsoft Defender EASM from the results.

5. Choose Create to start the Defender EASM workspace setup.

6. Under Project details, select the Subscription that you want to configure and the Resource group created at step no. 3 (or create a new one).

7. Under Instance details, provide a unique Name for the workspace, for example cc-easm-workspace, and select a supported Region (see the References section for the current list of supported regions).

8. Choose Review + create, review the configuration, then choose Create.

9. Once the deployment completes, choose Go to resource to open the new Defender EASM workspace.

10. In the left navigation panel, under Manage, select Discovery, then choose Create and select one of the following options to define the scope of your attack surface:

    1. Custom attack surface, to manually build a discovery group from your own Seeds.
    2. Select an organization - custom attack surface, to base a discovery group on a Microsoft-suggested organization profile that you can then customize with your own Seeds.

11. Add at least one Seed (an FQDN, IP CIDR block, or WHOIS record) that represents your organization's known online infrastructure, then start the discovery process to populate the Inventory.

12. Repeat steps no. 4 – 11 for each Azure subscription that requires a Microsoft Defender EASM workspace.

1. Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

   az account list
   --query '[*].id'
   

2. The command output should return the requested subscription identifiers (IDs):

   [
       "abcdabcd-1234-abcd-1234-abcdabcdabcd",
       "abcd1234-abcd-1234-abcd-abcd1234abcd"
   ]
   

3. Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to configure as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

   az account set
   --subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
   

4. Run group create command (Windows/macOS/Linux) to create a new resource group for the Defender EASM workspace (skip this step if you plan to use an existing resource group):

   az group create
   --name cc-easm-resource-group
   --location eastus
   

5. The command output should return the metadata of the newly created resource group:

   {
     "id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-easm-resource-group",
     "location": "eastus",
     "name": "cc-easm-resource-group",
     "properties": {
       "provisioningState": "Succeeded"
     }
   }
   

6. Run resource create command (Windows/macOS/Linux) to deploy a new Microsoft Defender EASM workspace within the selected resource group:

   az resource create
   --resource-type "Microsoft.Easm/workspaces"
   --name cc-easm-workspace
   --resource-group cc-easm-resource-group
   --location eastus
   --api-version 2023-04-01-preview
   --properties "{}"
   

7. The command output should return the metadata of the newly created Defender EASM workspace:

   {
     "id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-easm-resource-group/providers/Microsoft.Easm/workspaces/cc-easm-workspace",
     "name": "cc-easm-workspace",
     "type": "Microsoft.Easm/workspaces",
     "location": "eastus",
     "properties": {
       "provisioningState": "Succeeded"
     }
   }
   

   Azure CLI does not provide a dedicated command to add Seeds to a Defender EASM workspace. Sign in to the Azure Portal to complete this configuration step (see Remediation section part I, steps no. 10 – 11).

8. Repeat steps no. 6 and 7 for each Defender EASM workspace that you want to deploy in the selected resource group.

9. Repeat steps no. 3 – 8 for each Azure subscription that requires a Microsoft Defender EASM workspace.