1. Defender for Cloud Overview

  • Unified cloud security posture management (CSPM) and cloud workload protection (CWPP) across Azure, AWS, and GCP.
  • Free tier (Foundational CSPM) — Secure Score, basic recommendations, Azure security benchmarks.
  • Paid plans — Advanced CWPP per workload type, vulnerability scanning, adaptive controls, JIT VM access.
  • Integrates with Azure Policy, Microsoft Sentinel, and third-party SIEM/SOAR tools.

2. Architecture: CSPM + CWPP

  • CSPM evaluates configuration against benchmarks → generates recommendations.
  • CWPP applies runtime protection → generates security alerts on active threats.
  • Both feed into Sentinel for cross-signal correlation and automated playbooks.

3. Workload Protection Plans

Servers (P1/P2)
EDR (MDE), vulnerability scanning, FIM, adaptive app controls
Per server/hour
VMs, Arc-enabled servers
SQL
Vulnerability assessment, anomaly detection, ATP
Per instance/hour
Azure SQL, SQL on VMs, Arc SQL
Storage
Malware scanning, sensitive data detection, activity monitoring
Per storage account + txn
Blob, Files, Data Lake
Containers
Image vulnerability scan, runtime protection, K8s audit
Per vCore/hour
AKS, Arc-enabled K8s, ECR/GCR
Key Vault
Unusual access patterns, suspicious operations
Per vault/hour
All Key Vault instances
App Service
Web attack detection, dangling DNS, anomalies
Per App Service plan/hour
Web Apps, Functions (dedicated)

4. Secure Score & Recommendations

  • Secure Score — Percentage of implemented security controls (0–100%). Higher = better posture.
  • Recommendations are grouped by security control (e.g., "Enable encryption", "Restrict network access").
  • Each recommendation shows impact (score increase), freshness, and remediation steps (Quick Fix for many).
  • Exemptions — Mark resources as mitigated or waived with justification; excluded from score.
  • Governance rules — Assign recommendation owners and deadlines; track via email notifications.

5. Regulatory Compliance Dashboard

  • Maps recommendations to compliance standards: Azure Security Benchmark, CIS, NIST 800-53, PCI-DSS, ISO 27001, SOC 2.
  • Add custom standards via Azure Policy initiative assignments.
  • Export compliance reports (PDF/CSV) for auditors — shows pass/fail per control.
  • Continuous compliance vs point-in-time: dashboard updates as resources change.

6. Alerts & Sentinel Integration

  • Security alerts — Generated by CWPP plans when threats are detected (e.g., suspicious process, brute-force).
  • Alerts grouped into incidents with kill-chain mapping (MITRE ATT&CK).
  • Continuous export — Stream alerts and recommendations to Log Analytics / Event Hub.
  • Sentinel connector — One-click integration; alerts become Sentinel incidents for automated triage via playbooks (Logic Apps).
  • Workflow automation — Trigger Logic Apps directly from Defender alerts (e.g., isolate VM, notify Teams).

💼 Real-World Scenario

A healthcare company enables Defender for Cloud across their Azure landing zone. They activate Servers P2 for VMs handling PHI, SQL plan for patient databases, and Containers plan for their microservices on AKS. The security team uses governance rules to assign recommendation owners per subscription. Continuous export streams all alerts into Sentinel, where playbooks auto-isolate VMs on high-severity alerts. Monthly compliance reports (HIPAA mapped via custom initiative) are sent to auditors automatically.

🎯 Exam Tip

AZ-305 tests your ability to choose the right Defender plan per workload and understand the CSPM vs CWPP distinction. Remember: recommendations come from CSPM (posture), alerts come from CWPP (runtime threats). Secure Score only improves when you remediate or exempt recommendations. JIT VM access and adaptive application controls require Servers P2.

🧪 Knowledge Check