Retrieve Microsoft Defender for Cloud secure score and control-level compliance via the REST API
domain: learn.microsoft.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Authenticate with Microsoft Entra ID OAuth2 and acquire a token scoped to the Azure Resource Manager (management.azure.com) API.
Call GET /subscriptions/{subscriptionId}/providers/Microsoft.Security/secureScores to list all initiative scores, or fetch a single one (e.g. ascScore) by name.
Call the Secure Score Controls list-by-secure-score endpoint to break the score down into individual controls with current versus max points.
Cross-reference control IDs with the Secure Score Control Definitions endpoint to get human-readable descriptions and recommendation counts per control.
Poll on a schedule and store results over time to build a compliance trend report, since the API reflects only the currently computed score, not history.
Known gotchas
Secure score is computed per subscription; an organization-wide score requires calling the API across every subscription and aggregating manually.
Score values update on a delay after remediation actions, so expect a lag before an API call reflects a just-fixed recommendation.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?