Microsoft Defender for Cloud: — Posture Management and Workload Protection in One

① Two jobs in one — CSPM and CWPP

Meet Sneha, an L1 cloud-security analyst at Infosys. On her first week she's handed a single Azure blade — Microsoft Defender for Cloud — and told "keep our cloud secure." She opens it and sees two very different things on the same screen: a big Secure Score percentage with a list of recommendations, and separately a list of security alerts screaming about suspicious activity. Same product, two completely different jobs. Getting this split straight is the difference between passing AZ-500 and guessing.

Job one is CSPM (Cloud Security Posture Management). This is the free part. The moment you enable Defender for Cloud on a subscription, it starts assessing every resource against the Microsoft cloud security benchmark (MCSB) and produces a Secure Score plus a list of recommendations — "this storage account is public," "this VM has no disk encryption." CSPM finds misconfigurations before an attacker does, across Azure, AWS and GCP. Nothing is being attacked; this is the proactive, hygiene side.

Job two is CWPP (Cloud Workload Protection Platform). This is the paid part — a set of Defender plans you turn on per workload type: Defender for Servers (VMs), Storage, SQL, Containers/AKS, Key Vault and App Service. Each plan watches its workload for actual threats and raises a security alert when something is happening — "a malicious blob was uploaded," "a reverse shell on this VM." CWPP is the reactive, real-time defence.

One more layer worth naming now: CSPM itself comes in two plans. Foundational CSPM is free and on by default. Defender CSPM is paid and adds the heavy posture features: attack-path analysis, the cloud security graph, CIEM (permissions analysis) and agentless vulnerability scanning. So the full picture is: free Foundational CSPM, optional paid Defender CSPM, and then the per-workload CWPP Defender plans on top. Together Microsoft markets this whole thing as a CNAPP.

The four building blocks, one tap each

Tap each card. These four names are what every Defender for Cloud question on AZ-500 and SC-100 is really testing.

② Secure Score, recommendations & compliance

The Secure Score is the headline number on the blade, and L1 engineers are constantly asked "why did it drop?" So you need to know how it's built. Defender for Cloud groups recommendations into security controls. Each control has a fixed max score — for example Enable MFA = 10 points, Secure management ports = 8, Apply system updates = 6, Remediate vulnerabilities = 6. The bigger the number, the more it matters, so you fix the heavy controls first.

The maths is simple. For one control, Defender counts how many resources are healthy (compliant) versus unhealthy (need a fix). The control's current score is max ÷ total resources × healthy resources. Microsoft's own worked example: a control worth 6 points, with 4 healthy out of 78 total resources, scores 6 ÷ 78 = 0.0769, then 0.0769 × 4 = 0.31. Fix the other 74 and the control climbs toward its full 6. All the control scores add up into the subscription Secure Score, which Defender re-evaluates every eight hours.

Beyond the single score, the Regulatory compliance dashboard maps the very same findings against formal standards — CIS Azure Benchmark, PCI-DSS, NIST and more. So when an auditor at ICICI asks "are we PCI-DSS compliant on this subscription?", Meera doesn't run a separate scan — she opens the compliance dashboard, picks the PCI-DSS standard, and reads pass/fail per control with the failing resources listed. Recommendations are also mapped to the MITRE ATT&CK tactics so you can see which attacker techniques a misconfiguration would enable.

Now the part L1 engineers actually do all day: turning a recommendation into action. Take the classic "Storage accounts should restrict network access". Open it and you get three buttons in the Take action panel: Fix (apply the change now), Enforce (auto-correct future resources via Azure Policy) and Deny (block new non-compliant resources from being created at all). If you can't fix it today, you assign it instead — with a governance rule.

A governance rule turns "someone should fix this" into accountability. At Defender for Cloud → Environment settings → Governance rules → Create governance rule, you scope the rule, pick which recommendations it covers (by severity, risk level, category or specific recommendation), set an owner (by Microsoft Entra email, or read from a resource tag), and a remediation time frame of 7, 14, 30 or 90 days. Until the due date the recommendation shows On time; after it, Overdue. Owners and their managers get a weekly email of open and overdue tasks. (Governance rules need the paid Defender CSPM plan.)

③ Workload protection — the Defender plans

Now the paid side: the CWPP Defender plans. Each protects one workload type and raises ATT&CK-mapped alerts. The one you'll meet first is Defender for Servers, and it ships in two plans. Plan 1 (P1) integrates Microsoft Defender for Endpoint (MDE) — a full EDR on every VM, auto-provisioned, billed per hour (so you only pay while the VM runs). Plan 2 (P2) includes everything in P1 and adds the operational extras.

Two P2 features matter for the exam and the job. Just-in-Time (JIT) VM access keeps RDP (3389) and SSH (22) closed by default and opens them only when a named user requests access, for a specific source IP and a limited time — then auto-closes. That kills the #1 brute-force entry point. File Integrity Monitoring (FIM) watches critical OS files, Windows registry keys and Linux system files and alerts when they change — a classic sign of tampering. Modern FIM rides on the MDE agent (the old Log Analytics/MMA agent retired in 2024).

az security pricing create \
  --name VirtualMachines \
  --tier Standard \
  --subscription 11111111-2222-3333-4444-555555555555

# verify which Defender plans are on
az security pricing list --query "value[].{plan:name, tier:pricingTier}" -o table

Plan                 Tier
-------------------  --------
VirtualMachines      Standard
StorageAccounts      Standard
Containers           Free
SqlServers           Free
KeyVaults            Free

Next, Defender for Storage. Its headline feature is on-upload malware scanning: every blob is scanned by Microsoft Defender Antivirus the moment it lands, so a poisoned file can't sit in your bucket and spread — you get the alert "Malicious blob uploaded to storage account" (ATT&CK: Lateral Movement, High). It also does sensitive-data threat detection (powered by Sensitive Data Discovery + Microsoft Purview labels), so an alert on a container holding PII is prioritised higher. And it flags abused SAS tokens and public-access changes — all without you enabling any diagnostic logs.

Finally, Defender for Containers. It works in two halves. Registry scanning is agentless vulnerability assessment — every image pushed to Azure Container Registry (ACR) (or AWS ECR, Google GAR) is scanned for CVEs, re-scanned daily, so you stop deploying known-vulnerable images. Runtime protection uses the Defender sensor (a DaemonSet on the cluster nodes) plus Kubernetes audit logs to run 60+ Kubernetes-aware analytics — "exposed Kubernetes dashboard," "creation of a high-privileged role," "sensitive mount" — each mapped to the MITRE ATT&CK matrix for Containers.

④ Operating it — multicloud, SIEM & a worked flow

Real environments are rarely pure Azure. The strength of Defender for Cloud is that the same Secure Score, recommendations and even CWPP plans extend to AWS and GCP through multicloud connectors. You add one at Defender for Cloud → Environment settings → Add environment → Amazon Web Services (or Google Cloud Platform). You name the connector, choose Management account or Single account, pick the Defender plans, then deploy a CloudFormation (AWS) or Terraform (AWS/GCP) template that grants the read role. Within a few hours, AWS EC2 and S3 show up in the same Secure Score as your Azure VMs.

SecurityResources
| where type == 'microsoft.security/securescores'
| extend current = properties.score.current, max = todouble(properties.score.max)
| project subscriptionId, current, max, percentage = ((current / max) * 100)

subscriptionId                        current  max   percentage
-----------------------------------   -------  ----  ----------
11111111-2222-3333-4444-555555555555  41.2     58    71.03
aws-connector-prod-123456789012       28.7     46    62.39
gcp-connector-prod-flipkart-data      33.1     50    66.20

Defender for Cloud is not where your SOC lives all day — your SIEM is. So you export. The cleanest route to Microsoft's own SIEM, Microsoft Sentinel, is the built-in Microsoft Defender for Cloud connector, which streams alerts and can two-way-sync status (close it in Sentinel, it closes in Defender). For third-party SIEMs (Splunk, QRadar, ArcSight) you use continuous export at Environment settings → Continuous export, sending to an Event Hub the SIEM reads from.

Two more operating switches. Auto-provisioning means Defender installs the MDE extension and enables agentless scanning on supported machines automatically as they appear — turn it on once and new VMs are protected without manual agent rollouts. And remember the cost guardrail: Defender for Storage's malware scanning lets you set a monthly GB scan cap, and you get the alert "Malware scanning will stop soon: 75% of monthly cap reached" before it pauses — so a sudden upload spike can't blow the bill silently.

Let's tie the whole lesson together with the worked flow every L1 should be able to narrate. (1) Finding: the free CSPM raises "Storage accounts should restrict network access" on a public account — Secure Score takes a hit on the Restrict unauthorised network access control. (2) Triage: Sneha opens it, sees 7 unhealthy of 31, reads the ATT&CK context. (3) Remediate: she clicks Fix to apply network rules now, then clicks Enforce to deploy an Azure Policy so future storage accounts can't be public. (4) Govern: for the resources she can't touch today she assigns a governance rule (owner by tag, 14-day SLA, grace period on). (5) Score rises: within ~8 hours the unhealthy count drops, the control's max ÷ total × healthy climbs, and the Secure Score goes up.

One forward-looking note, because interviewers ask about it: Defender for Cloud is steadily moving into the unified Microsoft Defender portal (XDR), and 2025 brought AI security posture management and attack-path analysis for AI agents — Defender now discovers your generative-AI workloads and maps how a weak link could chain into a breach. Heads-up on cost: from 1 July 2026, AI-agent discovery and posture for Microsoft Foundry and third-party cloud agents needs a Microsoft Agent 365 license rather than just Defender CSPM. The split you learned — free posture, paid protection — keeps holding as the surface grows.

For your certification path, this lesson is high-yield. On AZ-500, Defender for Cloud sits squarely in the Manage security operations and Secure compute, storage and databases domains — Secure Score, recommendations, JIT, the Defender plans and Sentinel export are all directly testable. On SC-100 (the architect exam) it's the tool you cite when designing posture management and a CNAPP strategy across a multicloud estate. Know the CSPM-vs-CWPP split, the score formula and which features are free, and these questions become free marks.