Microsoft Defender EASM Implementation — External Attack Surface Monitoring

This service includes setup of Microsoft Defender External Attack Surface Management in the client’s Azure environment, configuration of discovery seeds, launch of the initial discovery process, monitoring rules and alerts for newly discovered assets, optimization recommendations, and knowledge transfer. The goal is to help the organization discover, map, and monitor external-facing digital assets exposed to the open internet.

The Microsoft Defender External Attack Surface Management implementation service is $2,500 per project, quoted fixed-price in writing before work begins.

This is a 21-day service. During that period, IT Partner verifies Azure readiness, configures the Defender EASM resource, connects discovery seeds, starts the initial assessment, establishes monitoring and alerts, and provides knowledge transfer.

Microsoft Defender External Attack Surface Management helps organizations continuously discover and monitor their external digital attack surface. It can identify internet-facing assets such as domains, IP blocks, hosts, email contacts, Autonomous System Numbers, and WHOIS organizations so security teams can better understand exposure and prioritize risk mitigation.

Discovery seeds are known legitimate assets provided by the client, such as domains or other external identifiers, that Defender EASM uses as starting points for discovery. IT Partner configures these seeds so Microsoft’s discovery technology can uncover connected infrastructure and build an external-facing asset inventory.

Yes, an Azure subscription is required for the Defender EASM setup. If needed, a 30-day free trial of Defender EASM can be used for initial setup and evaluation, subject to Microsoft’s availability and terms.

IT Partner assists with verifying or setting up the Azure subscription or Defender EASM trial, creates the Azure resource group, configures the Defender EASM resource, connects discovery seeds, and starts the initial assessment. IT Partner also establishes monitoring rules and alerts, provides optimization recommendations, and transfers knowledge on interpreting reports and responding to alerts.

The client ensures access to the required Azure subscription with the permissions needed to create the Defender EASM resource, provides known legitimate assets for discovery seeds, and works with IT Partner to define security priorities. These inputs matter because Defender EASM discovery starts from known assets and expands outward to connected external infrastructure.

No — hands-on remediation of discovered exposures, vulnerabilities, misconfigurations, DNS issues, or certificate issues is not included beyond providing recommendations. Remediation work can be scoped separately with IT Partner.

No. Defender EASM subscription charges and Azure consumption are billed by Microsoft and are not included in the $2,500 per project implementation price.

The service does not include 24/7 support, continuous monitoring services, ongoing maintenance, SOC operations, incident response, penetration testing, custom SIEM/SOAR or ticketing integrations, large-scale asset ownership validation, or changes to production workloads, DNS, or registrar settings. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional extra-cost add-ons when separately contracted, delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.

After completion, the client has Defender EASM configured and operational in Azure, with initial discovery started and monitoring rules and alerts established. The client’s security team continues using Defender EASM for ongoing visibility, while additional optimization, remediation, or ongoing monitoring beyond the engagement can be scoped as optional extra-cost add-ons.