This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Manage identity, access, and governance (20–25%)
   --> Implement governance to enforce security and regulatory compliance
      --> Evaluate regulatory compliance by using Microsoft Defender for Cloud

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Organizations operating in the cloud are often required to demonstrate compliance with regulatory, industry, and organizational security requirements. Examples include PCI DSS, ISO 27001, NIST, CIS benchmarks, FedRAMP, and other regulatory frameworks.

Microsoft Defender for Cloud provides a Regulatory compliance capability that helps security teams continuously assess their cloud environments against supported security and compliance standards.

Rather than manually reviewing every Azure resource against a regulatory framework, Defender for Cloud maps security requirements to security controls and assessments. It then identifies resources that do not satisfy those controls and provides recommendations for improving compliance.

For the SC-500 exam, it is important to understand the relationship between:

Standards → Controls → Assessments → Recommendations → Remediation → Compliance posture

Defender for Cloud continuously evaluates supported resources and presents the results through the Regulatory compliance dashboard.

1. What Is Regulatory Compliance in Defender for Cloud?

The Regulatory compliance capability in Microsoft Defender for Cloud allows an organization to evaluate its cloud resources against selected security and regulatory standards.

The dashboard provides visibility into:

• Which compliance standards are enabled
• Which subscriptions or cloud environments the standards apply to
• The controls associated with each standard
• Which assessments are passing or failing
• Which resources are affected
• Recommendations for addressing failed assessments
• Manual assessments that require customer attestation
• Overall compliance progress

Defender for Cloud can assess Azure resources and, when the appropriate multicloud integrations are configured, resources in AWS and Google Cloud Platform (GCP) as well.

Important distinction

Defender for Cloud helps an organization assess and improve its technical compliance posture. It does not automatically certify an organization as legally or regulatory compliant.

For example, if Defender for Cloud reports that all applicable Azure resources satisfy the technical controls associated with a PCI DSS standard, that does not by itself mean the organization has obtained PCI DSS certification.

Compliance frequently includes organizational processes, documentation, policies, personnel procedures, physical controls, and other requirements that cannot necessarily be validated automatically.

2. The Compliance Hierarchy

One of the most important concepts to understand is how Defender for Cloud organizes compliance information.

A useful way to visualize it is:

Compliance Standard
       │
       ├── Control 1
       │      ├── Assessment A
       │      └── Assessment B
       │
       ├── Control 2
       │      ├── Assessment C
       │      └── Assessment D
       │
       └── Control 3
              ├── Assessment E
              └── Assessment F

Standard

A standard represents a security benchmark or regulatory framework against which resources are evaluated.

Examples can include:

• Microsoft Cloud Security Benchmark (MCSB)
• CIS benchmarks
• ISO 27001
• NIST-related standards
• PCI DSS
• FedRAMP

The exact standards available depend on the environment, cloud provider, Defender for Cloud configuration, and applicable plans.

Control

A control represents a particular security requirement within a standard.

For example, a standard might contain controls concerning:

• Identity and access management
• Network security
• Data protection
• Encryption
• Logging
• Vulnerability management

Assessment

An assessment evaluates whether a particular resource or configuration satisfies the requirement represented by a control.

An assessment can identify:

• Passing resources
• Failing resources
• The affected resource type
• Remediation guidance

Recommendation

When an assessment identifies a security problem, Defender for Cloud can generate a security recommendation describing what should be changed.

This relationship is critical for exam questions:

A control is a requirement. An assessment evaluates compliance with that requirement. A recommendation tells you how to address an identified problem.

Defender for Cloud uses assessments against security standards to generate actionable recommendations.

3. Microsoft Cloud Security Benchmark

The Microsoft Cloud Security Benchmark (MCSB) is Microsoft’s cloud security baseline.

It provides security recommendations across areas such as:

• Network security
• Identity management
• Privileged access
• Data protection
• Logging and monitoring
• Incident response
• Vulnerability management
• Endpoint security

The MCSB is an important baseline in Defender for Cloud.

For Azure environments, the Microsoft Cloud Security Benchmark is enabled by default as a foundational security benchmark. Other compliance standards can be added when appropriate Defender for Cloud capabilities are enabled.

Exam tip

Don’t confuse the MCSB with a specific regulatory certification.

The MCSB is a Microsoft security benchmark/baseline. Regulatory standards such as PCI DSS and ISO 27001 represent external frameworks or compliance requirements.

4. Regulatory Compliance Dashboard

The Regulatory compliance dashboard is the primary interface for reviewing compliance posture.

From the dashboard, security administrators can:

1. Select a compliance standard.
2. Review its controls.
3. Expand controls to see associated assessments.
4. Identify passing and failing assessments.
5. View affected resources.
6. Review remediation recommendations.
7. Review manual assessments.
8. Track compliance over time.

The dashboard is therefore useful for both technical security teams and compliance/audit stakeholders.

5. Understanding Compliance Scores

Defender for Cloud uses assessment results to help organizations understand their compliance posture.

A failed assessment generally means that one or more resources do not satisfy the security requirement represented by that assessment.

For example:

ISO 27001
   │
   └── Access Control
          │
          └── Assessment:
              Privileged accounts must use MFA
                    │
                    ├── 95 resources compliant
                    └── 5 resources noncompliant

The five noncompliant resources become candidates for investigation and remediation.

As security issues are corrected and assessments subsequently pass, the organization’s compliance posture improves.

Important timing consideration

Assessment results are not necessarily updated instantly after every configuration change. Microsoft documentation currently indicates that many Defender for Cloud assessments run approximately every 12 hours. Therefore, correcting a resource does not necessarily cause the dashboard to immediately reflect the change.

Exam scenario

If an administrator fixes a failing configuration but immediately checks the Regulatory compliance dashboard and still sees the resource as noncompliant, the correct explanation may simply be that the assessment has not run again yet.

6. Assigning Regulatory Compliance Standards

Organizations can choose which regulatory standards they want to track.

The general process is:

1. Open Microsoft Defender for Cloud.
2. Open Regulatory compliance.
3. Select Manage compliance policies.
4. Select the appropriate scope.
5. Open Security policies.
6. Locate the desired standard.
7. Turn the standard On.
8. Configure any required parameters.

The standard is then applied to the selected scope and Defender for Cloud begins assessing applicable resources.

7. Choosing the Correct Scope

Compliance standards can be assigned at appropriate management scopes.

For Azure, this can include scopes such as:

• Subscription
• Management group

For multicloud environments, Defender for Cloud also supports applicable AWS and GCP scopes.

Best practice

When possible, assign a compliance standard at the highest appropriate scope.

For example, if an organization wants the same standard applied consistently across many subscriptions within a management group, assigning it at the management-group level can simplify centralized governance.

The resulting compliance information can then be aggregated across the applicable resources.

8. Compliance Standards Use Azure Policy

A particularly important SC-500 concept is the relationship between Defender for Cloud regulatory compliance standards and Azure Policy.

For Azure environments, regulatory compliance standards use Azure Policy initiatives to represent the controls and assessment logic used to evaluate resources.

This means Azure Policy provides much of the underlying evaluation mechanism.

Conceptually:

Regulatory Standard
        ↓
Azure Policy Initiative
        ↓
Policy Definitions
        ↓
Resource Evaluation
        ↓
Compliance Assessment
        ↓
Defender for Cloud Dashboard

This is why Azure Policy and Defender for Cloud frequently appear together in security and governance exam questions.

Key distinction

Azure Policy is primarily the governance and compliance enforcement/evaluation mechanism.

Defender for Cloud provides a broader security posture and compliance-management experience, including:

• Security recommendations
• Compliance dashboards
• Regulatory standards
• Security posture information
• Remediation guidance
• Reporting

9. Automated vs. Manual Assessments

Not every regulatory requirement can be evaluated automatically.

Defender for Cloud therefore supports both automated assessments and manual assessments.

Automated assessments

An automated assessment can evaluate technical characteristics of resources.

For example:

Are storage resources configured according to the required security configuration?

The assessment can inspect the relevant resource configuration and determine whether it passes or fails.

If it fails, Defender for Cloud can identify the affected resources and provide remediation information.

Manual assessments

Some compliance requirements depend on organizational processes or evidence that cannot be determined solely from Azure resource configuration.

For example, an organization may need to demonstrate that:

• Employees receive security training.
• A documented incident-response process exists.
• A particular organizational procedure is performed.
• An administrative process has been reviewed.

These requirements may appear as manual assessments.

An authorized person can provide an attestation and attach supporting evidence.

The Regulatory compliance dashboard supports manual attestation and evidence for applicable assessments.

Exam tip

If a question describes a compliance requirement that cannot be determined from resource configuration, think:

Manual assessment / attestation

rather than trying to solve the problem with an Azure Policy that cannot actually evaluate the requirement.

10. Investigating Failed Assessments

When a compliance control is failing, the recommended workflow is generally:

Regulatory compliance
        ↓
Select standard
        ↓
Select control
        ↓
Review assessment
        ↓
Identify affected resources
        ↓
Review recommendation
        ↓
Remediate
        ↓
Assessment runs again
        ↓
Compliance status updated

The dashboard allows security teams to drill down from the standard to the control, then to the assessment and affected resources.

This is much more useful than simply knowing that an organization has a low compliance score.

The goal is to identify why the organization is failing and which resources need remediation.

11. Remediating Automated Assessments

For automated assessments, Defender for Cloud typically provides remediation guidance associated with the failed recommendation.

A common workflow is:

1. Open the Regulatory compliance dashboard.
2. Select the relevant standard.
3. Select the failing control.
4. Select the failed assessment.
5. Review the affected resources.
6. Review the recommendation.
7. Follow the remediation guidance.
8. Correct the resource configuration.
9. Wait for the assessment to run again.
10. Verify the updated compliance status.

Depending on the recommendation, remediation may be performed manually or through supported automated mechanisms.

12. Manual Attestation and Evidence

Manual assessments require a different workflow.

An authorized user can:

1. Open the relevant regulatory compliance standard.
2. Select the control.
3. Locate the manual assessment.
4. Select the applicable subscription.
5. Select Attest.
6. Provide the required information.
7. Attach supporting evidence.
8. Save the attestation.

This allows the organization to document compliance for requirements that cannot be validated automatically.

Important exam distinction

Automated assessment

Defender for Cloud evaluates the resource.

Manual assessment

A person provides an attestation and supporting evidence.

13. Compliance Reports

Defender for Cloud can generate compliance reports that summarize the organization’s status against a selected standard.

These reports can be useful for:

• Security leadership
• Compliance teams
• Internal auditors
• External auditors
• Governance teams
• Risk management teams

A compliance report can provide a snapshot of the organization’s status based on Defender for Cloud assessment data.

Defender for Cloud also provides access to applicable audit/certification reports for Microsoft services.

Important distinction

There are two different concepts:

Your organization’s compliance status

versus

Microsoft’s own service certifications and attestations.

Do not confuse an Azure service’s certification with your organization’s compliance posture.

14. Continuous Export of Compliance Data

Organizations may need to integrate compliance information with other systems.

Defender for Cloud supports mechanisms for continuously exporting compliance status so that compliance information can be consumed outside the Defender for Cloud portal.

This can be useful when organizations need centralized reporting or integration with broader security and governance processes.

15. Automating Responses to Compliance Changes

Defender for Cloud can integrate compliance events with Azure Logic Apps through workflow automation.

For example:

Compliance assessment changes
            ↓
Defender for Cloud workflow automation
            ↓
Azure Logic App
            ↓
Notification / ticket / remediation workflow

A company might configure a workflow that sends an email or initiates an operational process whenever a compliance assessment changes state.

Defender for Cloud workflow automation can trigger Logic Apps based on changes involving regulatory compliance assessments.

Example

An organization requires notification whenever a critical compliance assessment fails.

The solution could be:

Defender for Cloud → Workflow automation → Logic App → Notification

16. Compliance Across Multicloud Environments

Defender for Cloud can provide compliance visibility beyond Azure when AWS and GCP environments are connected.

This can help organizations establish a centralized view of security and compliance posture across:

• Azure
• AWS
• GCP

Supported standards vary by cloud provider.

For example, Defender for Cloud provides cloud-specific benchmarks and supports various regulatory standards across supported environments.

Exam consideration

If the question asks for a centralized security posture and compliance view across Azure, AWS, and GCP, Microsoft Defender for Cloud is a strong candidate.

17. Why Some Controls May Be Grayed Out

A compliance standard can contain controls that Defender for Cloud cannot automatically evaluate.

A control may appear unavailable or grayed out when there is no applicable Defender for Cloud assessment associated with it.

Possible reasons include:

• The control is procedural.
• The control requires organizational evidence.
• No automated assessment currently exists.
• The control isn’t applicable to the resources being evaluated.

Therefore:

A grayed-out control does not necessarily mean that the organization is noncompliant.

It may mean Defender for Cloud cannot perform an automated assessment for that particular requirement.

18. Custom Standards and Assessments

Organizations sometimes have security requirements that aren’t represented adequately by the built-in standards.

Defender for Cloud supports custom standards and recommendations.

Custom standards can allow an organization to represent its own security requirements and combine relevant recommendations into an organizational standard.

Microsoft’s current Defender for Cloud capabilities also support custom recommendations using KQL when the appropriate CSPM capabilities are enabled.

Important current-state consideration

Older documentation describes creating custom Defender for Cloud recommendations and standards through Azure Policy definitions and initiatives. Microsoft now identifies that approach as a legacy feature and recommends the newer custom recommendation capabilities for new implementations.

For the SC-500 exam, however, you should still understand the fundamental relationship between Azure Policy initiatives, compliance standards, assessments, and Defender for Cloud.

19. Defender for Cloud vs. Azure Policy

These services work together but serve different purposes.

Remember

A useful way to think about them is:

Azure Policy governs resource configuration. Defender for Cloud evaluates and communicates security posture and compliance across your cloud environment.

20. Defender for Cloud vs. Microsoft Purview Compliance Manager

These services can also complement one another.

Microsoft Defender for Cloud focuses heavily on the security posture and technical configuration of cloud resources.

Microsoft Purview Compliance Manager provides broader compliance-management capabilities, including assessments and improvement actions across supported Microsoft compliance scenarios.

Defender for Cloud compliance information can integrate with Purview Compliance Manager for supported standards and environments.

Exam strategy

When a question focuses on:

• Azure resource configuration
• Security recommendations
• Cloud security posture
• Technical security controls
• Azure/AWS/GCP resources

think Defender for Cloud.

When the question focuses more broadly on:

• Organizational compliance management
• Microsoft 365 compliance
• Compliance improvement actions
• Regulatory assessment management

consider Microsoft Purview Compliance Manager.

21. Common SC-500 Exam Scenarios

Scenario 1: Identify failing compliance controls

An administrator needs to determine which controls in an ISO standard are failing.

Solution: Use the Regulatory compliance dashboard in Defender for Cloud.

Scenario 2: Determine which resources are causing a failed control

A compliance control is failing, and the security team needs to identify the affected resources.

Solution: Expand the control and assessment in the Regulatory compliance dashboard.

Scenario 3: Correct an automated compliance failure

A VM fails an assessment because its configuration doesn’t satisfy a security requirement.

Solution: Review the associated Defender for Cloud recommendation and remediate the affected resource.

Scenario 4: Document a procedural requirement

A compliance requirement requires evidence of an organizational process that Defender for Cloud cannot automatically verify.

Solution: Use a manual assessment and attestation, including supporting evidence.

Scenario 5: Notify administrators when compliance changes

The organization wants to send an email whenever a compliance assessment changes state.

Solution: Use Defender for Cloud workflow automation with an Azure Logic App.

Scenario 6: Apply a standard to multiple subscriptions

An organization wants to manage a compliance standard consistently across multiple subscriptions.

Solution: Assign the standard at the appropriate management-group scope when applicable.

22. Key Concepts to Remember for the Exam

The following concepts are especially important:

Regulatory compliance dashboard

The primary interface for viewing and investigating compliance against enabled standards.

Standard

A framework or benchmark containing security requirements.

Control

A specific requirement within a standard.

Assessment

An evaluation that determines whether a resource satisfies a control.

Recommendation

An actionable security finding that helps remediate a failed assessment.

Automated assessment

A technical assessment performed automatically against applicable resources.

Manual assessment

A compliance requirement requiring human attestation and potentially supporting evidence.

MCSB

Microsoft’s foundational cloud security benchmark.

Azure Policy

Provides policy definitions and initiatives that underpin many Azure compliance evaluations.

Compliance scope

The subscriptions or other supported cloud scopes to which a standard is assigned.

Compliance report

A report summarizing compliance status against a selected standard.

Workflow automation

Can trigger Azure Logic Apps when relevant Defender for Cloud security or compliance events occur.

Assessment timing

Compliance data may not update immediately after remediation because assessments run on a schedule.

23. Exam-Day Mental Model

When you see a question involving regulatory compliance in Defender for Cloud, think through this sequence:

What standard?
      ↓
What control?
      ↓
What assessment?
      ↓
Which resources failed?
      ↓
What recommendation?
      ↓
How is it remediated?
      ↓
Does it require manual attestation?
      ↓
Does the organization need reporting?
      ↓
Does the organization need automation?

And remember these core relationships:

Standard = What requirements are we measuring against?

Control = What specific requirement are we evaluating?

Assessment = Does the environment satisfy the requirement?

Recommendation = What should we do about a failure?

Attestation = How do we document a requirement that can’t be automatically evaluated?

Compliance dashboard = Where do we view and investigate the results?

Practice Exam Questions

Question 1

A security administrator needs to determine which resources are causing a compliance control to fail for an organization’s selected regulatory standard.

Where should the administrator begin?

A. Microsoft Defender for Cloud Regulatory compliance dashboard

B. Microsoft Entra ID Protection

C. Azure Monitor Metrics

D. Microsoft Sentinel Analytics rules

Answer: A

Explanation

The Regulatory compliance dashboard is designed to allow administrators to select a standard, expand its controls, review assessments, and identify affected resources. Defender for Cloud also provides remediation information for failed assessments.

The other options serve different purposes. Entra ID Protection focuses on identity risks, Azure Monitor Metrics focuses on monitoring metrics, and Sentinel analytics rules detect security events and threats.

Question 2

An organization enables a compliance standard in Microsoft Defender for Cloud. A security administrator wants to understand the relationship between the requirements in the standard and the resources being evaluated.

Which component represents a specific requirement within the compliance standard?

A. Control

B. Recommendation

C. Subscription

D. Workflow

Answer: A

Explanation

A control represents a specific security or compliance requirement within a standard.

The hierarchy is:

Standard → Control → Assessment → Resource

A recommendation is generated to help address an identified security issue; it isn’t the requirement itself.

Question 3

A company has a compliance requirement stating that administrators must complete annual security training. Defender for Cloud cannot determine automatically whether all employees completed the training.

What should the security team use to document compliance?

A. Azure Policy deny effect

B. Automated assessment

C. Manual assessment and attestation

D. Azure Firewall policy

Answer: C

Explanation

Requirements that cannot be evaluated automatically from resource configuration can be handled using manual assessments. An authorized user can attest to compliance and provide supporting evidence.

An Azure Policy rule cannot automatically determine whether employees completed an organizational training program.

Question 4

An organization corrects a configuration issue identified by a Defender for Cloud compliance assessment. Immediately afterward, the Regulatory compliance dashboard still shows the resource as noncompliant.

What is the most likely explanation?

A. Regulatory compliance cannot detect configuration changes

B. The relevant assessment has not run again yet

C. Defender for Cloud only evaluates resources once per year

D. The compliance standard must be deleted and reassigned

Answer: B

Explanation

Defender for Cloud assessments run periodically rather than necessarily updating the compliance dashboard immediately after every configuration change. Current Microsoft documentation indicates that many assessments run approximately every 12 hours.

Therefore, after remediation, the administrator may need to wait for the next assessment cycle before the compliance status changes.

Question 5

An organization wants to apply a regulatory compliance standard to all appropriate Azure subscriptions within a management group.

Which approach is generally most appropriate?

A. Assign the standard at the appropriate management-group scope

B. Create a separate Microsoft Sentinel workspace for every subscription

C. Configure the standard only on individual virtual machines

D. Assign the standard through Microsoft Entra Conditional Access

Answer: A

Explanation

Applying a standard at the highest appropriate management scope can simplify centralized governance across nested Azure resources and subscriptions.

Conditional Access manages identity access policies, Sentinel manages security analytics, and individual VM configuration is too narrow for centralized regulatory governance.

Question 6

A compliance team wants to automatically notify a security operations team whenever a Defender for Cloud regulatory compliance assessment changes state.

Which solution should be used?

A. Azure Resource Graph only

B. Defender for Cloud workflow automation with an Azure Logic App

C. Microsoft Entra password protection

D. Azure Bastion

Answer: B

Explanation

Defender for Cloud workflow automation can trigger Azure Logic Apps based on supported security and regulatory compliance events.

A Logic App can then perform actions such as sending notifications, creating operational workflows, or initiating additional remediation processes.

Question 7

A security administrator wants to understand what remediation action should be taken for a resource that failed a regulatory compliance assessment.

Which Defender for Cloud capability provides this information?

A. Microsoft Defender XDR incidents

B. Azure Service Health

C. Security recommendation associated with the failed assessment

D. Microsoft Entra audit logs

Answer: C

Explanation

Defender for Cloud security recommendations provide actionable information about security issues, affected resources, and remediation steps.

The recommendation is the bridge between identifying a failed assessment and determining what should be done to address it.

Question 8

Which statement best describes the relationship between regulatory compliance standards in Defender for Cloud and Azure Policy?

A. Defender for Cloud completely replaces Azure Policy

B. Azure Policy is used only for Microsoft Entra configurations

C. Azure Policy cannot participate in compliance assessments

D. Regulatory compliance standards for Azure use Azure Policy initiatives to represent controls and assessment logic

Answer: D

Explanation

For Azure environments, Defender for Cloud regulatory compliance standards use Azure Policy initiatives. The initiatives contain policy definitions that provide the underlying evaluation logic for applicable controls.

This relationship is important for SC-500 questions involving both Azure Policy and Defender for Cloud.

Question 9

An auditor requests a report showing the organization’s current compliance status against a selected regulatory standard.

Which Defender for Cloud capability should the security team use?

A. Download report from the Regulatory compliance dashboard

B. Azure VM Run Command

C. Microsoft Entra ID Protection workbook

D. Azure Network Watcher

Answer: A

Explanation

Defender for Cloud’s Regulatory compliance dashboard provides the ability to generate compliance reports for selected standards. These reports summarize compliance status based on Defender for Cloud assessment data and can be shared with relevant stakeholders.

The other services do not provide this regulatory compliance reporting capability.

Question 10

A compliance standard contains a control that appears unavailable in the Defender for Cloud dashboard. The control has no associated automated assessment.

What is the most appropriate interpretation?

A. All resources associated with the control are automatically noncompliant

B. Defender for Cloud has automatically disabled the subscription

C. The control may require a manual process or may not currently have an applicable automated assessment

D. The organization must immediately purchase Microsoft Sentinel

Answer: C

Explanation

Some compliance controls cannot be automatically evaluated by Defender for Cloud. They may involve procedural requirements, require manual evidence, or simply lack an applicable automated assessment.

A control without an automated assessment should not automatically be interpreted as a failed technical configuration.

Final Exam Takeaways

For “Evaluate regulatory compliance by using Microsoft Defender for Cloud,” focus on mastering these distinctions:

The biggest exam trap is confusing a standard, control, assessment, and recommendation. If you can consistently distinguish those four, a significant portion of scenario-based questions on this topic becomes much easier.

Go to the SC-500 Exam Prep Hub main page