Microsoft Defender for Cloud

Microsoft Defender for Cloud is a unified cloud security posture management (CSPM) and workload protection platform. It continuously monitors your Azure resources, hybrid servers, and multi-cloud environments (AWS, GCP) for security misconfigurations, threats, and vulnerabilities. It provides a prioritised list of recommendations to harden your environment and actively detects attacks in progress.

Defender for Cloud operates across two main pillars. Cloud Security Posture Management (CSPM) evaluates your resource configurations against security best practices and compliance frameworks, assigning a Secure Score to your subscription. Cloud Workload Protection (CWP) — enabled via Defender plans — adds active threat detection, vulnerability scanning, and just-in-time VM access to protect running workloads.

The Secure Score is a numeric metric (0-100) that reflects the security posture of your subscription. Each security recommendation has a score impact; remediating higher-impact recommendations improves your score more. Microsoft benchmarks show that customers with higher Secure Scores experience fewer security incidents. The score dashboard breaks down by security control area (identity, network, data, etc.), helping you prioritise remediation efforts.

Defender for Cloud has a free foundational CSPM tier (always on) and paid Defender plans for specific resource types. Plans include Defender for Servers (endpoint threat detection for VMs), Defender for Containers (Kubernetes threat detection and image scanning), Defender for Databases (SQL injection and anomalous access detection), Defender for Key Vault, and others. Each plan is billed per resource.

When Defender for Cloud detects a misconfiguration, it creates a security recommendation. Each recommendation includes: a description of the issue, the list of affected resources, the severity (High/Medium/Low), the potential Secure Score increase if remediated, and remediation steps with a Quick Fix button for single-click remediation of simple fixes. Recommendations are mapped to the Microsoft Cloud Security Benchmark (MCSB).

When Defender for Cloud detects an active threat, it generates a security alert describing the attack, the affected resources, and recommended response steps. Related alerts from the same attack campaign are automatically correlated into a security incident, giving you a unified view of an attack's progression (the kill chain) rather than dozens of isolated alerts. Alerts can be routed to Microsoft Sentinel, Logic Apps, or email.

Just-In-Time (JIT) VM access (available in Defender for Servers) locks down management ports like RDP (3389) and SSH (22) at the NSG level when they are not in use. When an administrator needs access, they request it for a specific time window (e.g., 3 hours), from a specific source IP, through Defender for Cloud. The NSG rule is created for that window and automatically removed afterwards, eliminating the attack surface of always-open admin ports.

Adaptive Application Controls use machine learning to analyse which applications are running on your VMs and generate a recommended allowlist. You review and approve the list, and Defender for Cloud creates Windows AppLocker rules or Linux auditing rules to flag or block applications not in the approved set. This is a powerful tool against malware and ransomware that exploits unapproved software.

Defender for Cloud includes a regulatory compliance dashboard that maps your security posture to specific frameworks such as ISO 27001, SOC 2, PCI DSS, NIST SP 800-53, and CIS Benchmarks. Each control in the framework is mapped to one or more Defender for Cloud recommendations. Auditors can view the dashboard to see how many controls pass and which require remediation, making compliance evidence gathering significantly faster.

Defender for Cloud extends beyond Azure to provide security coverage for AWS and GCP resources through cloud connectors, and for on-premises servers via the Azure Arc agent. This gives a single pane of glass security view across hybrid and multi-cloud estates. Recommendations and Secure Score encompass non-Azure resources too, making it a genuinely unified security management platform.

The typical Defender for Cloud workflow is: Assess — review the Secure Score and open recommendations; Secure — remediate recommendations starting with the highest-impact ones; Defend — enable Defender plans to detect and respond to threats in real time. This iterative cycle continuously improves your security posture and reduces the likelihood and impact of security incidents over time.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Defender for Cloud provides CSPM posture management via Secure Score and active threat protection via Defender plans, Just-In-Time VM access closes admin ports and opens them only on request, and the regulatory compliance dashboard maps your posture to frameworks like ISO 27001 and PCI DSS. Next up we explore Azure Key Vault for secrets and certificate management.