2.2.4. Detecting Exposed Secrets: Defender CSPM and Defender for Key Vault
💡 First Principle: Prevention eventually fails somewhere — a secret gets hardcoded into a repository, a connection string ends up in a config file that shouldn't have it — so this is the detection layer specifically built to catch secrets that escaped Key Vault's boundary, plus threats aimed at the vault itself.
Defender Cloud Security Posture Management (Defender CSPM) includes secret scanning that looks across your environment — VMs, repositories, code — for secrets that were hardcoded or exposed outside of Key Vault, flagging them as a posture risk. Defender for Key Vault is a separate, workload-specific plan that monitors the vault itself for anomalous or potentially malicious access patterns (unusual retrieval volume, access from a suspicious IP, an unusual application accessing secrets it's never touched before) and raises security alerts in near real time.
⚠️ Exam Trap: Defender CSPM's secret scanning finding a hardcoded credential and Defender for Key Vault flagging unusual vault access are two different products catching two different problems — one is about secrets that escaped the vault, the other is about suspicious activity against the vault. Don't conflate them when a scenario asks which plan would have caught a specific incident.
Reflection Question: A secret was hardcoded directly into an application's source code and never stored in Key Vault at all. Which of these two capabilities would have a chance of catching that — and why wouldn't Defender for Key Vault help here?
