Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Enable Data Security Posture Management - Microsoft Defender for Cloud | Microsoft Learn

29 September 2026Doc update+26 / −23 lines

In brief

The article reorganizes prerequisites and clarifies that enabling Defender CSPM or Defender for Storage automatically enables sensitive data discovery. It also documents sensitivity settings, the up-to-24-hour wait for initial results, and updated AWS S3 and RDS discovery steps.

What Defender admins need to know

Administrators can use the revised guidance to verify prerequisites and set expectations for initial discovery results.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Enable data security posture managementData Security Posture Management - Microsoft Defender for Cloud | Microsoft Learn

This article explains how toYou can enable data security posture management in Microsoft Defender for Cloud. Data security posture management helps you discover and classify sensitive data, identify risks, and prioritize remediation. Before you begin, review the prerequisites in this article.

Before you start

Review the following prerequisites before you enable data security posture management:

  • Before you enable data security posture management, review support and prerequisites.
  • When you enable Microsoft Defender CSPMCloud Security Posture Management or Defender for Storage plans, the sensitive data discovery extension is automatically enabled. You can disable this setting if you don't want to use data security posture management, but wemanagement. We recommend that you use the feature to get the most value from Defender for Cloud.
  • Sensitive

    Defender for Cloud identifies sensitive data is identified based on the data sensitivity settings in Defender for Cloud.settings. You can customize the data sensitivity settings to identify the data that your organization considers sensitive.

  • It takes up to 24 hours to see the results of a first discovery after enabling the feature.

    Prerequisites

    Review the following prerequisites before you enable data security posture management:

    Enable in Defender CSPM (Azure)

    Follow these steps to enable data security posture management. Don't forget to review required permissions before you start.

    1. NavigateGo to Microsoft Defender for Cloud > Environment settings.

    2. Select the relevant Azure subscription.

    3. For the Defender CSPM plan, select the On status.

      If Defender CSPM is already on, select Settings in the Monitoring coverage column of the Defender CSPM plan and make sure that the Sensitive data discovery component is set to On status..

    4. OnceAfter sensitive data discovery is turned On in Defender CSPM, it will automatically incorporateincorporates support for additional resource types as the range of supported resource types expands.

    Enable in Defender CSPM (AWS)

    Complete the following checks before you enable data security posture management for Amazon Web Services (AWS):

    • Don't forget to:Review AWS discovery requirements, and required permissions for S3 and RDS scanning.
    • Check that there's no policy that blocks the connection to your Amazon S3 buckets.
    • For Amazon Relational Database Service (RDS) instances, cross-account AWS Key Management Service (KMS) encryption is supported, but additional KMS access policies might prevent access.
    1. In Defender for Cloud, go to Environment settings and select your AWS connector.
    2. Turn on Defender CSPM with Sensitive data discovery.
    3. Proceed withFollow the instructions to download the CloudFormation template and to run it in AWS.

    Automatic discoveryDiscovery of S3 buckets in the AWS account starts automatically.

    For S3 buckets, the Defender for Cloud scanner runs in your AWS account and connects to your S3 buckets.

    For RDS instances, discovery will be triggered oncewhen Sensitive Data Discovery is turned on.on, discovery begins. The scanner will taketakes the latest automated snapshot for an instance, createcreates a manual snapshot withinin the source account, and copycopies it to an isolated Microsoft-owned environment withinin the same region.

    The scanner uses the snapshot is used to create a live instance that is spunit spins up, scannedscans, and then immediately destroyed (togetherdestroys, along with the copied snapshot).snapshot.

    OnlyThe scanning platform reports only scan findings are reported by the scanning platform.findings.

    Diagram explaining the RDS scanning platform.

    Check for S3 blocking policies

    If enabling scanning for S3 buckets and RDS instances didn't work because of a blocked policy, check the following:following conditions:

    • Make sureEnsure that the S3 bucket policy doesn't block the connection. In the AWS S3 bucket, select the Permissions tab > tab, then Bucket policy.policy. Check the policy details to make sureensure the Microsoft Defender for Cloud scanner service running in the Microsoft account in AWS isn't blocked.
    • Make sureEnsure that there's no SCP policy that blocks the connection to the S3 bucket. For example, your SCP policy might block read API calls to the AWS Region where your S3 bucket is hosted.
    • Check that your SCP policy allows these required API calls are allowed by your SCP policy: AssumeRole, GetBucketLocation, GetObject, ListBucket, calls: AssumeRole, GetBucketLocation, GetObject, ListBucket, and GetBucketPublicAccessBlock.
    • Check that your SCP policy allows calls to the us-east-1 AWS Region, which is the default region for API calls.

    Enable data-aware monitoring in Defender for Storage

    Sensitive data threat detection is enabled by default when the sensitive data discovery component is enabled in the Defender for Storage plan. For details,more information, see Sensitive data threat detection in Defender for Storage.

    Note