Lesson 23 — Microsoft Defender for Cloud & Secure Score

Domain 1 — Identity & Governance Domain 5 — Monitor AZ-104: 20–25% ~30 min

Why Defender for Cloud Matters

Security is not a separate concern that you bolt on after deploying workloads. In enterprise Azure, security posture, compliance evidence, and threat detection are continuous operational concerns — and Microsoft Defender for Cloud is the central platform that addresses all three.

For the AZ-104 exam, Defender for Cloud appears across both the governance and monitoring domains. Practically, every senior Azure admin needs to know how to read a Secure Score, understand why a recommendation is being surfaced, and configure the right Defender plans for their workload types — without paying for coverage they don't need.

What Is Microsoft Defender for Cloud?

Microsoft Defender for Cloud (formerly Azure Security Center + Azure Defender) is a unified security management platform that combines two distinct capabilities under one roof:

  • Cloud Security Posture Management (CSPM) — continuous assessment of your resource configurations against security best practices. Generates the Secure Score and prioritised remediation recommendations.
  • Cloud Workload Protection (CWP) — active threat detection and response for specific workload types (servers, containers, databases, storage). This is the paid "Defender plans" layer.
Name history Microsoft has renamed this product twice. Azure Security Center + Azure Defender → Microsoft Defender for Cloud (2021). If you see older documentation or exam questions referencing "Azure Security Center", that is the free CSPM tier. "Azure Defender" refers to what are now the paid CWP plans.

Defender for Cloud coverage extends beyond Azure. It is a multi-cloud and hybrid platform — it can assess AWS and GCP workloads and on-premises servers connected via Azure Arc.

The Two Pillars: CSPM and CWP

Pillar 1 — Cloud Security Posture Management (CSPM)

CSPM is available in a free tier on all Azure subscriptions. It continuously inventories your resources and evaluates them against security best practices. Its primary outputs are:

  • Secure Score — a 0–100% rating of your overall security posture
  • Security recommendations — specific, actionable items to improve posture
  • Regulatory compliance dashboard — how your resources map to frameworks like CIS, NIST, and PCI-DSS

An enhanced paid tier called Defender CSPM adds attack path analysis, cloud security graph, and agentless vulnerability scanning beyond what the free tier provides.

Pillar 2 — Cloud Workload Protection (CWP)

CWP adds active threat detection through workload-specific Defender plans. Each plan is independently priced and targeted at a specific resource type. CWP capabilities include:

  • Real-time threat alerts for suspicious process execution, anomalous logins, network anomalies
  • Just-In-Time VM access (Defender for Servers)
  • File integrity monitoring (Defender for Servers Plan 2)
  • Container registry vulnerability scanning (Defender for Containers)
  • SQL injection detection (Defender for SQL)
Exam distinction CSPM = free, posture, recommendations, Secure Score. CWP = paid, active threat detection, alerts. Many questions test whether you know which tier provides which capability. An organisation that only wants visibility without additional cost enables CSPM free tier only.

Secure Score — Understanding Your Posture Number

The Secure Score is a percentage (0–100%) representing how well your resources comply with security best practices. A higher score means a better security posture. It is the primary KPI for security governance in Azure.

How the score is calculated

Recommendations are grouped into Security Controls — logical categories of related recommendations, such as:

  • Enable MFA
  • Remediate vulnerabilities
  • Restrict unauthorised network access
  • Enable encryption at rest
  • Apply system updates

Each control has a max score contribution (e.g. "Enable MFA" might contribute up to 10 points). Within a control, your score contribution is proportional to the ratio of healthy resources to total assessed resources. If 80 of 100 VMs have MFA-enabled admin accounts, you earn 80% of that control's max points.

Improving your score Focus on controls with the highest max score contribution first — they have the most leverage. Within a control, use Quick Fix (one-click remediation) where available to remediate multiple resources at once. High-severity recommendations do not necessarily correspond to the highest score gain — the two dimensions are independent.

Recommendation anatomy

Each recommendation in Defender for Cloud includes:

  • Severity: High, Medium, or Low
  • Description: what the issue is and why it matters
  • Affected resources: which specific resources are unhealthy
  • Remediation steps: manual instructions to fix
  • Quick Fix: one-click automated remediation (not available for all recommendations)
  • Score impact: how many points implementing this will add to your score

Security Recommendations vs. Security Alerts

These are two fundamentally different concepts that appear in the same interface. Confusing them is a common mistake.

Concept Source Nature Purpose
Recommendation CSPM (free + paid) Proactive "You should do X to reduce your risk surface" — configuration guidance based on best practices
Alert CWP (Defender plans) Reactive "Something suspicious is happening right now" — a detected threat event requiring investigation

Recommendations improve your Secure Score when implemented. Alerts do not affect Secure Score — they are operational events that need triage and response.

Alerts and Incidents

Individual suspicious events generate alerts (e.g. suspicious process execution on a VM, anomalous login to a storage account). When Defender for Cloud determines that multiple related alerts represent a coordinated attack, it groups them into an incident — a correlated set of alerts representing a potential attack chain.

Alert severity: High, Medium, Low, Informational. The standard response workflow is: alert surfaced → investigate in Defender for Cloud → correlate with other signals → remediate → close.

Regulatory Compliance Dashboard

Beyond Secure Score, Defender for Cloud maps your resource configurations to recognised compliance frameworks via the Regulatory Compliance dashboard. This is invaluable for audit preparation — it gives you documented evidence of which controls are passing or failing.

Supported frameworks (know these for the exam)

Framework Description
Azure Security Benchmark (ASB) Microsoft's own best-practice framework, aligned with CIS Controls and NIST CSF. Assigned by default to all subscriptions.
CIS Microsoft Azure Foundations Benchmark Centre for Internet Security benchmark for Azure-specific configurations.
NIST SP 800-53 US Federal information security standard. Required for US government workloads.
PCI-DSS Payment Card Industry Data Security Standard. Required for environments processing cardholder data.
ISO 27001:2013 International information security management standard.
SOC 2 Type II Service Organisation Controls — availability, security, processing integrity.
HIPAA / HITRUST US healthcare data security and privacy requirements.
Azure Security Benchmark is the default ASB is assigned automatically to every subscription enrolled in Defender for Cloud. It provides an always-on baseline even before you add any additional frameworks. Additional frameworks are added on demand (e.g. when you're preparing for a PCI-DSS audit).

Defender Plans — Know These for the Exam

Each Defender plan protects a specific workload type. Plans are enabled per-subscription. You pay only for the plans you enable.

Defender Plan Workload Protected Key Capabilities
Defender for Servers Plan 1 Windows & Linux VMs, Arc-enabled servers Microsoft Defender for Endpoint integration, Just-In-Time VM access, adaptive application controls, network map
Defender for Servers Plan 2 Windows & Linux VMs, Arc-enabled servers All of Plan 1 + file integrity monitoring, vulnerability assessment (Qualys/MDVM), OS-level threat detection, 500 MB/day free Log Analytics ingestion
Defender for Storage Azure Blob Storage, Azure Files, ADLS Gen2 Anomalous access pattern detection, malware upload scanning, sensitive data exposure alerts, hash reputation analysis
Defender for SQL Azure SQL DB, SQL Managed Instance, SQL on VMs SQL injection detection, anomalous access patterns, vulnerability assessment, data classification
Defender for Containers AKS, Arc-enabled Kubernetes, container registries Kubernetes threat detection, container image vulnerability scanning, runtime protection, misconfiguration assessment
Defender for Key Vault Azure Key Vault Unusual access patterns, access from suspicious locations, anomalous operation volume, policy violation alerts
Defender for App Service Azure App Service web apps & functions Web attack detection, dangling DNS alerts, anomalous process spawning
Defender CSPM (enhanced) All resources (cross-cloud) Attack path analysis, cloud security graph, agentless scanning, data-aware security posture — paid upgrade over free CSPM
Plan 1 vs Plan 2 for Servers Just-In-Time VM access requires Defender for Servers Plan 1 as a minimum. It is not available in the free CSPM tier. File integrity monitoring and vulnerability assessment require Plan 2. Know this distinction — it appears in scenario questions.

Just-In-Time (JIT) VM Access

Just-In-Time VM Access is one of the most operationally useful features of Defender for Servers. It addresses the risk of leaving management ports (RDP 3389, SSH 22) permanently open to the internet via NSG rules.

How JIT works from the Defender for Cloud perspective:

  1. You enable JIT on a VM through Defender for Cloud. Defender creates NSG rules that deny inbound traffic on management ports by default.
  2. When an administrator needs access, they submit a request through Defender for Cloud (or via CLI/API/portal) specifying their source IP and requested duration.
  3. Defender for Cloud approves the request (or enforces auto-approval for specific source IP ranges) and temporarily modifies the NSG to allow access for the requested time window.
  4. When the time window expires, the deny rule is automatically restored.
  5. All access requests are logged in the Azure Activity Log for audit purposes.
JIT prerequisites JIT requires Defender for Servers Plan 1 or Plan 2. The VM must have a Network Security Group (or Azure Firewall with Defender for Cloud integration) controlling inbound access. JIT cannot be used if the VM's NSG is managed entirely outside of Defender for Cloud.

Multi-Cloud and Hybrid Coverage

Defender for Cloud is not limited to Azure resources. Its coverage model extends to:

Environment How Connected Capabilities
Azure Native — no connector needed Full CSPM + all Defender plans
AWS AWS connector (OIDC-based, agentless) CSPM posture, Defender for Servers, Defender for Containers (EKS), Defender for SQL (RDS)
GCP GCP connector (Workload Identity Federation) CSPM posture, Defender for Servers, Defender for Containers (GKE)
On-premises Azure Arc agent on servers Defender for Servers (Plan 1 or 2) — same capabilities as Azure VMs

This multi-cloud capability is why Defender for Cloud is described as a Cloud Native Application Protection Platform (CNAPP) — it provides a single pane of glass for security posture across your entire estate regardless of where workloads run.

Integration with Microsoft Sentinel

Defender for Cloud is a detection engine. Microsoft Sentinel is a SIEM/SOAR (Security Information and Event Management / Security Orchestration, Automation and Response). The two products are designed to work together, not compete:

  • Defender for Cloud generates alerts from workload-level threat detection (process anomalies, network anomalies, credential abuse).
  • Microsoft Sentinel ingests those alerts alongside other data sources (sign-in logs, firewall logs, endpoint telemetry, third-party sources) and applies correlation rules, machine learning, and investigation tools to identify full attack chains.
  • You connect Defender for Cloud to Sentinel via the native data connector, which streams all Defender alerts into the Sentinel workspace.
  • Sentinel can also trigger automated playbooks (Logic Apps) in response to Defender for Cloud alerts — enabling automated remediation.
The relationship in one line Defender for Cloud detects individual suspicious events on your workloads. Sentinel correlates those events with everything else happening in your environment to tell you whether you're under attack — and from what direction.

Hands-On: Navigate Defender for Cloud

Open portal.azure.com and search for Microsoft Defender for Cloud.

  1. Overview blade: Note the Secure Score prominently displayed. Look at the number of active recommendations and alerts. This is the executive dashboard.
  2. Secure Score blade: Drill into the Security Controls list. Sort by "Potential score increase". Identify the control with the highest leverage and drill into its recommendations.
  3. Recommendations blade: Filter by severity = High. Open one recommendation. Read the description, affected resources, remediation steps, and look for the Quick Fix button if present.
  4. Regulatory Compliance blade: Review the Azure Security Benchmark section. Toggle between "All controls" and "Failed controls only". This is the view an auditor uses.
  5. Defender plans blade: Navigate to Environment Settings → your subscription → Defender plans. Observe which plans are on/off and their per-unit pricing. Do NOT enable paid plans in a lab unless you accept the cost.
  6. Security alerts blade: Review any existing alerts. Note the severity classification and the MITRE ATT&CK tactic mapping on each alert.
Checkpoint After this walkthrough, you should be able to explain the difference between a recommendation and an alert to a non-technical stakeholder, and identify which Defender plan would need to be enabled to detect a given threat scenario.

Check Your Understanding

Click any option to see immediate feedback.

1. How is the Secure Score calculated, and what action directly increases it?

Secure Score measures your security posture as a percentage — it increases when you implement security recommendations. The score is calculated based on the ratio of healthy resources to total resources across all security controls. Alerts, Defender plans, and compliance frameworks are separate dimensions.

2. An organisation wants to see their Azure security posture and receive improvement recommendations but has a strict zero-additional-cost requirement. Which Defender for Cloud capability should they enable?

CSPM free tier provides continuous assessment and Secure Score recommendations at no additional cost. CWP Defender plans add active threat detection and response. An organisation wanting only posture visibility with no additional cost should enable the free CSPM tier only — it is on by default for Azure subscriptions.

3. A security engineer wants to enable Just-In-Time VM access for a fleet of Azure VMs. What is the minimum Defender for Cloud plan required?

Defender for Servers Plan 1 is the minimum required to enable Just-In-Time VM access. JIT is not available in the free CSPM tier. Plan 2 is not required — it adds file integrity monitoring and vulnerability assessment on top of Plan 1, but JIT is available in Plan 1.

4. Your organisation is preparing for a PCI-DSS audit and needs to document which Azure controls are passing and failing. Which Defender for Cloud feature provides this evidence?

The Regulatory Compliance dashboard maps your resources against compliance frameworks including PCI-DSS, CIS, NIST SP 800-53, ISO 27001, and others. It shows which controls are passing or failing per framework and can generate downloadable compliance reports — exactly what an auditor needs.

5. What is the operational difference between a security recommendation and a security alert in Defender for Cloud?

Security recommendations are proactive guidance to reduce attack surface — they come from CSPM and tell you what to fix before an incident happens. Security alerts are reactive signals that a suspicious event is occurring right now — they come from CWP Defender plans via active threat detection. Both appear in Defender for Cloud but serve fundamentally different purposes.

6. Which Defender plan would detect a malware-infected file uploaded to an Azure Blob Storage container?

Defender for Storage detects malicious file uploads (malware scanning via hash reputation and deep scan), anomalous access patterns, and potential data exfiltration from storage accounts. It integrates with Azure Blob Storage, Azure Files, and ADLS Gen2 at the storage account level. This is a CWP feature requiring the paid Defender for Storage plan.
Primary source for this lesson What is Microsoft Defender for Cloud? — Microsoft Learn

Read the introduction and the Defender plans overview pages. Pay particular attention to the CSPM vs CWP distinction and the Secure Score calculation methodology — both are frequently tested concepts.

Questions for your teacher (the AI agent)
This lesson covered the architecture, plans, and core concepts of Defender for Cloud. Dig deeper with these:
  • Walk me through configuring a Defender for Cloud policy initiative to require all VMs to use Defender for Servers Plan 1.
  • How does attack path analysis in Defender CSPM work, and what is an example of an attack path it would identify?
  • What is the difference between agentless scanning and agent-based scanning in Defender for Servers, and when would you use each?
  • How do I export Defender for Cloud alerts to Microsoft Sentinel, and what connector is used?
Coming up: Lesson 24 — Azure Landing Zones & Cloud Adoption Framework Now that you understand how to secure individual workloads, the next lesson covers how enterprises architect the entire Azure platform from day one — the Cloud Adoption Framework and Azure Landing Zones. You'll see how Defender for Cloud fits into the broader governance and management design areas of the landing zone framework.