The team in charge of Azure Security Center has developed a Power Bi dashboard to help you track your Secure Score evolution. It also includes backlog of actions to be performed.
You will have 2 setup options:
Then you will need to deploy a playbook to get Secure Score data (Get-SecureScoreData); you can deploy from here https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Security-Center%2Fmaster%2FSecure%2520Score%2FGet-SecureScoreData%2Fazuredeploy.json)
After logging on your Azure portal, define the subscription and resource group for the deployment
The playbook will gather the Secure Data (including recommendations) every 24 hours.
The playbook consist of:
You will need to gather Log Analytics workspace ID created above by accessing the Azure portal and search for Log Analytics
Once you have identified the Log Analytics access the Overview tab to get the workspace ID
Then you need to assign Reader access to either the subscription(s) (recommended) and/or resource groups you want to include in the report to the Logic App created above (Get-SecureScoreData)
Then you can go back to the Logic App to manually trigger the first run
The initial run will take about 15 s; you can check the result if all steps have been executed successfully
You need of course a Power BI account to be able to use it – a Pro license is required if you want to open it as an application.
You will need to use the latest version of Power BI Desktop – version 2.83.5894.961 (available here https://aka.ms/pbiSingleInstaller)
You can get the template from https://github.com/Azure/Azure-Security-Center/tree/master/Secure%20Score/PowerBI-SecureScoreReport
Now you can open the Power BI template file to edit it; you will be asked to provide the Workspace ID gathered above
It will then start loading the data and request you to authenticate with an account with permission to access the workspace; use the Organizational Account authentication option and use the OAuth2 method
Then you have some data starting to be displayed
You can now publish it to your Power BI service for reading access.
You will need to allow to Install templates app not listed in AppSource; to do it connect with an administrator account to your PowerBI https://app.powerbi.com/ and access the Admin portal to update the Tenant Settings
Now you can install the Secure Score reporting app using this link https://app.powerbi.com/Redirect?action=InstallApp&appId=0c3bbb94-36cc-4153-a5c2-b63181a17166&packageKey=14ec9028-3513-4a1c-aed1-83a01ecfc975qTsHacSHROKH9oDSq9Co9Ln72xYehlJKmEvIYPIxbz8&ownerId=72f988bf-86f1-41af-91ab-2d7cd011db47&buildVersion=12
You will be asked to confirm the application install
The Secure Score app is now installed
You can now connect to your Azure tenant by using the Connect your data option
There enter the Log Analytics workspace ID created during the Azure preparation steps
Then you need to use your organizational account; you can define whatever privacy level you want
Then the Power BI application is refreshing the data; it may take up to 10 minutes to complete
Once completed, you can access the Report using the Reports\Secure score report navigation