The Defender CSPM plan utilizes the data collected through the Defender External Attack Surface Management integration to provide the following capabilities within the Defender for Cloud portal:
- Discover of all the internet facing cloud resources through the use of an outside-in scan.
- Attack path analysis which finds all exploitable paths starting from internet exposed IPs.
- Custom queries that correlate all internet exposed IPs with the rest of Defender for Cloud data in the cloud security explorer.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-easm