uwa·JOHN MEYER
NOTES & CODE
Search⌘ K
← Blogs

Assign owners to Defender for Cloud findings

Use Resource Graph to join unhealthy assessments to resource owners and keep remediation and exceptions in a trackable backlog.

John MeyerUpdated

A Defender for Cloud finding needs a resource owner, a next action, and a way to track the decision. Resource Graph can supply the assessment and resource metadata for that list.

The query below targets Azure resource assessments. It is a reference example, not a recorded tenant test.

Query assessments and resource tags

Run this in Azure Resource Graph Explorer with read access to the subscriptions in scope. Replace tags.owner with your organization’s tag name.

securityresources
| where type =~ 'microsoft.security/assessments'
| where tostring(properties.status.code) == 'Unhealthy'
| extend
    assessmentId = id,
    finding = tostring(properties.displayName),
    severity = tostring(properties.metadata.severity),
    assessedResourceId = tostring(properties.resourceDetails.Id),
    statusChanged = todatetime(properties.status.statusChangeDate),
    policyDefinitionId = tostring(properties.metadata.policyDefinitionId)
| extend resourceKey = tolower(assessedResourceId)
| join kind=leftouter (
    resources
    | project
        resourceKey = tolower(id),
        resourceName = name,
        resourceGroup,
        owner = tostring(tags.owner)
) on resourceKey
| extend owner = iff(isempty(owner), 'Unassigned', owner)
| extend severityOrder = case(
    severity =~ 'High', 3,
    severity =~ 'Medium', 2,
    severity =~ 'Low', 1,
    0
)
| project
    assessmentId, finding, severity, severityOrder,
    resourceName, resourceGroup, assessedResourceId,
    owner, statusChanged, policyDefinitionId
| order by severityOrder desc, statusChanged asc

The join normalizes resource IDs to lowercase. It is a left join so assessments without a matching resource remain visible. Blank resource fields need review; subscription-level and multicloud assessments may use different resource details.

statusChanged is the recorded status-change time. firstEvaluationDate is the first evaluation time and should not be labeled as the start of an unhealthy period.

Build the work list

Use assessmentId as a stable reference in a ticket or export. Keep these fields alongside it:

  • Owner and resource ID.
  • Remediation step or investigation question.
  • Due date and ticket link.
  • Decision, reviewer, and review date.

“Unassigned” belongs in the backlog too. Route those rows to whoever manages resource ownership.

Severity is a starting order. During triage, add service importance, reachable network paths, and available compensating controls. A resource’s publicNetworkAccess setting alone does not establish internet reachability; firewall rules, authentication, and service-specific behavior still matter.

For automated exports, handle Resource Graph pagination. A first page of results is not a complete inventory.

Record exceptions

For findings backed by Azure Policy, resolve the applicable assignment before creating an exemption. A policy definition ID does not identify the assignment. For an initiative, select the intended definition reference IDs so the exemption covers only the relevant controls.

Use Waiver for temporarily accepted noncompliance. Use Mitigated when another method meets the policy’s intent. Record the approver, ticket, justification, and expiration date.

Some findings do not have a suitable Policy exemption path. Track those decisions in the backlog and check the recommendation’s supported exemption options.

Check the export

Pick a few rows and compare them with the portal: resource, severity, owner, and assessment state. Include an untagged resource and an assessment without a resource join. Save the query revision and export time.

After a fix, check for a new assessment result before closing the ticket. Evaluation and Resource Graph updates are not immediate.

References