The ticket
CISO forwards a Defender recommendation: “JIT should be enabled on pay-api.” SOC marks the Sentinel incident “SQL brute force” as closed because the recommendation list is shorter this week. Those are not the same object.
Microsoft Defender for Cloud is CSPM + optional Defender plans (servers, SQL, storage, …): recommendations, secure score, regulatory. Microsoft Sentinel is SIEM/SOAR: connect data, analytics rules, incidents, hunting, automation. Both typically land on a Log Analytics workspace. Enabling a Defender plan is not “we have a SIEM.” Closing a recommendation is not closing an incident. You still need an owner, a timeline, and a control that would catch the next one.
Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10. Not a live tenant.
Mental model
| Defender for Cloud | Microsoft Sentinel | |
|---|---|---|
| Question | Are we configured badly? | Is something attacking us / did it land? |
| Unit of work | Recommendation / alert / secure score | Incident / hunt / analytics rule |
| Needs | Subscription + plans + workspace | Workspace + connectors + rules |
| This lab | pay-api missing disk encryption rec | Failed sign-ins for bg-emergency |
No workspace, no history. A recommendation screenshot is not a query.
How to choose
| Need | Open | Not enough |
|---|---|---|
| Missing NSG / disk / JIT | Defender for Cloud recommendations | A Sentinel workbook about France |
| Correlate Entra + Firewall + pay-api | Sentinel incident / hunt | Secure score alone |
| Keep 30+ days of sign-ins | Workspace retention + export | Portal last-24-hours click |
Unhealthy resources
Runbook
Side A — posture
Defender for Cloud on
sub-hubandsub-spoke-app. Connectlaw-tc-lab. Open recommendations for pay-api. Assign an owner. That is a change ticket, not a SOC close.Side B — SIEM
Enable Sentinel on the same workspace. Connect Entra sign-in, Azure Firewall, and Activity. Build one analytics rule: any
bg-emergencysign-in → incident.Side C — prove
Generate a lab sign-in to a decoy. Incident appears with entities. Recommendation list did not change. Two queues, two closes.
az monitor log-analytics workspace show -g rg-hub -n law-tc-lab --query customerId -o tsv # 44444444-4444-4444-4444-444444444444 az security pricing list --query "[].name" -o tsv # VirtualMachines # SqlServers # StorageAccounts # Sentinel proof is the incident blade + KQL, not this list. # SigninLogs | where UserPrincipalName == "bg-emergency@techclick-lab.in"
Four failures
1 · “Defender is on” as a close
Which plan, which sub, which recommendation still unhealthy?
2 · Recommendation closed as an incident
No IOCs, no user, no time. You closed homework.
3 · Sentinel with no connectors
Empty SIEM. Pretty, blind.
4 · Two workspaces, no story
Firewall in one, Entra in the other, nobody joins them.
How to prove it
1) You named the product for the question. 2) Workspace ID is known. 3) A Sentinel incident has entities. 4) A Defender recommendation has an owner and a remediating change — separately.
Traps
| Screenshot | Does not prove |
|---|---|
| Secure score 90% | Nobody is in the tenant right now |
| Sentinel enabled | Connectors + rules + an on-call |
| Recommendation “exempt” | The risk left the building |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview
Sources
Related: Azure session factory · Migration series.