Microsoft Defender for Cloud
Cloud and workloadsExplore Risks to Sensitive Data - Microsoft Defender for Cloud | Microsoft Learn
In brief
The article updates its title, description, navigation steps, query instructions, and examples. It also removes the guidance about Azure Resource Graph findings and filtering by sensitivity labels and sensitive information types.
What Defender admins need to know
Administrators consulting this guidance should use the revised steps and examples. No administrator action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Explore risksRisks to sensitive dataSensitive Data - Microsoft Defender for Cloud | Microsoft Learn
This article explains how toYou can investigate sensitive data risks in attack paths, Cloud Security Explorer, and related alerts in Microsoft Defender for Cloud. You learnLearn how to identify exposed resources that contain sensitive data, prioritize security alerts, and export findings to share with data owners for remediation.
Explore and review sensitive data risks
[](media/data-security-review-risks/attack-paths.png#lightbox)
- Review the data attack paths.
- To view sensitive information detected in data resources, select the resource
name >name, then Insights.Then, expandExpand the Contain sensitive data insight. - For risk mitigation steps, open Active Recommendations.
Other examples of attack paths for sensitive data include:
"Internet exposed Azure Storage container with sensitive data is publicly accessible""Managed database with excessive internet exposure and sensitive data allows basic (local user/password) authentication""VM has high severity vulnerabilities and read permission to a data store with sensitive data""Internet exposed AWS S3 Bucket with sensitive data is publicly accessible""Private AWS S3 bucket that replicates data to the internet is exposed and publicly accessible""RDS snapshot is publicly available to all AWS accounts"
Explore risks with Cloud Security Explorer
Explore data risks and exposure in cloud security graph insights by using a query template,template or by defining a manual query.
In Defender for Cloud, open Cloud Security Explorer.
You can buildBuild your ownquery,query or select one of the sensitive data querytemplates >templates, select Open query, and modify it as needed. Here's an example:
Use query templates
As an alternative toInstead of creating your own query, you can use predefined query templates. Several sensitive data query templates are available. For example:
- Internet exposed storage containers with sensitive data that allow public
access.access - Internet exposed S3 buckets with sensitive data that allow public access
When you open a predefined query, it's populated automatically andautomatically. You can be tweakedchange it as needed. For example, here are the prepopulated fields for "Internet exposed storage containers with sensitive data that allow public access".
Explore sensitive data security alerts
When you enable sensitive data discovery is enabled in the Defender for Storage plan, you can prioritize and focus on alerts that affect resources with sensitive data. For details,more information, see Monitor data security alerts in Defender for Storage.
For platform as a service (PaaS) databases and Amazon S3 buckets, findings are reported to Azure Resource Graph (ARG). You can filter and sort by sensitivity labels and sensitive infoinformation types in the Defender for Cloud Inventory, Alert,Inventory, Alert, and Recommendation blades. panes.
Export findings
It's common for the security administrator, who reviews sensitive data findings in attack paths or the security explorer, to lack direct access to the data stores. Therefore, they need to share the findings with the data owners, who can then conduct further investigation.
To share findings with data owners, use the Export withinoption in the Contains sensitive data insight.
The CSV file produced includes:
- Sample name
– depending. Depending on the resource type, this value can be a database column, file name, or container name. - Sensitivity label
– the. The highest ranking label found on thisresource (sameresource, which is the same value for allrows).rows. - Contained in
– sample. Sample fullpath (filepath: file path or column fullname).name. - Sensitive info types
– discovered. Discovered info types per sample. If more than one info type was detected, a new row is added for each info type. This approach is to allow an easier filtering experience.
Note
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Explore risks to sensitive data - Microsoft Defender for Cloud | Microsoft Learn+title: Explore Risks to Sensitive Data - Microsoft Defender for Cloud | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks breadcrumb_path: /azure/breadcrumb/defender-for-cloud/toc.json feedback_help_link_url: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud@@ -13,7 +13,7 @@ author: ElazarK ms.author: elkrieger manager: orspodek ms.service: defender-for-cloud-description: Learn how to use attack paths and security explorer to find and remediate sensitive data risks.+description: Learn how to use attack paths and security explorer to identify exposed resources, prioritize security alerts, and export findings for remediation. ms.topic: how-to ms.date: 2026-07-03T00:00:00.0000000Z ms.custom: template-how-to-pattern, msecd-doc-authoring-1013@@ -39,9 +39,9 @@ spProducts: platformId: c740d043-dc9b-0ffb-6d4b-b70898fdbab0 --- -# Explore risks to sensitive data - Microsoft Defender for Cloud | Microsoft Learn+# Explore Risks to Sensitive Data - Microsoft Defender for Cloud | Microsoft Learn -This article explains how to investigate sensitive data risks in attack paths, Cloud Security Explorer, and related alerts in Microsoft Defender for Cloud. You learn how to identify exposed resources that contain sensitive data, prioritize security alerts, and export findings to share with data owners for remediation.
+You can investigate sensitive data risks in attack paths, Cloud Security Explorer, and related alerts in Microsoft Defender for Cloud. Learn how to identify exposed resources that contain sensitive data, prioritize security alerts, and export findings to share with data owners for remediation.
## Explore and review sensitive data risks
@@ -60,58 +60,58 @@ View predefined attack paths to discover data breach risks, and get remediation
[](media/data-security-review-risks/attack-paths.png#lightbox)
3. Review the data attack paths.
-4. To view sensitive information detected in data resources, select the resource name > **Insights**. Then, expand the **Contain sensitive data** insight.
+4. To view sensitive information detected in data resources, select the resource name, then **Insights**. Expand the **Contain sensitive data** insight.
5. For risk mitigation steps, open **Active Recommendations**.
Other examples of attack paths for sensitive data include:
-- "Internet exposed Azure Storage container with sensitive data is publicly accessible"
-- "Managed database with excessive internet exposure and sensitive data allows basic (local user/password) authentication"
-- "VM has high severity vulnerabilities and read permission to a data store with sensitive data"
-- "Internet exposed AWS S3 Bucket with sensitive data is publicly accessible"
-- "Private AWS S3 bucket that replicates data to the internet is exposed and publicly accessible"
-- "RDS snapshot is publicly available to all AWS accounts"
+- Internet exposed Azure Storage container with sensitive data is publicly accessible
+- Managed database with excessive internet exposure and sensitive data allows basic (local user/password) authentication
+- VM has high severity vulnerabilities and read permission to a data store with sensitive data
+- Internet exposed AWS S3 Bucket with sensitive data is publicly accessible
+- Private AWS S3 bucket that replicates data to the internet is exposed and publicly accessible
+- RDS snapshot is publicly available to all AWS accounts
## Explore risks with Cloud Security Explorer
-Explore data risks and exposure in cloud security graph insights using a query template, or by defining a manual query.
+Explore data risks and exposure in cloud security graph insights by using a query template or by defining a manual query.
1. In Defender for Cloud, open **Cloud Security Explorer**.
-2. You can build your own query, or select one of the sensitive data query templates > **Open query**, and modify it as needed. Here's an example:
+2. Build your own query or select one of the sensitive data query templates, select **Open query**, and modify it as needed. Here's an example:
[](media/data-security-review-risks/query.png#lightbox)
### Use query templates
-As an alternative to creating your own query, you can use predefined query templates. Several sensitive data query templates are available. For example:
+Instead of creating your own query, you can use predefined query templates. Several sensitive data query templates are available. For example:
-- Internet exposed storage containers with sensitive data that allow public access.
+- Internet exposed storage containers with sensitive data that allow public access
- Internet exposed S3 buckets with sensitive data that allow public access
-When you open a predefined query, it's populated automatically and can be tweaked as needed. For example, here are the prepopulated fields for "Internet exposed storage containers with sensitive data that allow public access".
+When you open a predefined query, it's populated automatically. You can change it as needed. For example, here are the prepopulated fields for *Internet exposed storage containers with sensitive data that allow public access*.
[](media/data-security-review-risks/query-template.png#lightbox)
## Explore sensitive data security alerts
-When sensitive data discovery is enabled in the Defender for Storage plan, you can prioritize and focus on alerts that affect resources with sensitive data. For details, see [Monitor data security alerts in Defender for Storage](defender-for-storage-data-sensitivity).
+When you enable sensitive data discovery in the Defender for Storage plan, you can prioritize and focus on alerts that affect resources with sensitive data. For more information, see [Monitor data security alerts in Defender for Storage](defender-for-storage-data-sensitivity).
-For platform as a service (PaaS) databases and Amazon S3 buckets, findings are reported to Azure Resource Graph (ARG). You can filter and sort by sensitivity labels and sensitive info types in the Defender for Cloud Inventory, Alert, and Recommendation blades.
+For platform as a service (PaaS) databases and Amazon S3 buckets, findings are reported to Azure Resource Graph (ARG). You can filter and sort by sensitivity labels and sensitive information types in the Defender for **Cloud Inventory**, **Alert**, and **Recommendation** panes.
## Export findings
It's common for the security administrator, who reviews sensitive data findings in attack paths or the security explorer, to lack direct access to the data stores. Therefore, they need to share the findings with the data owners, who can then conduct further investigation.
-To share findings with data owners, use the **Export** within the **Contains sensitive data** insight.
+To share findings with data owners, use the **Export** option in the **Contains sensitive data** insight.
[](media/data-security-review-risks/export-findings.png#lightbox)
The CSV file produced includes:
-- **Sample name** – depending on the resource type, this can be a database column, file name, or container name.
-- **Sensitivity label** – the highest ranking label found on this resource (same value for all rows).
-- **Contained in** – sample full path (file path or column full name).
-- **Sensitive info types** – discovered info types per sample. If more than one info type was detected, a new row is added for each info type. This is to allow an easier filtering experience.
+- **Sample name**. Depending on the resource type, this value can be a database column, file name, or container name.
+- **Sensitivity label**. The highest ranking label found on this resource, which is the same value for all rows.
+- **Contained in**. Sample full path: file path or column full name.
+- **Sensitive info types**. Discovered info types per sample. If more than one info type was detected, a new row is added for each info type. This approach is to allow an easier filtering experience.
Note