Topic 3 of 8
Microsoft Defender for Cloud
Defender for Cloud continuously assesses the security posture of your clouds, protects workloads, and takes security all the way to code. The exam asks what's free, what requires the Defender CSPM plan, and what each plan protects.
Contents
What is Defender for Cloud?
It's a cloud-native application protection platform (CNAPP): a set of measures to protect cloud applications from threats and vulnerabilities. It covers resources in Azure, in other clouds like AWS and GCP, and in on-premises environments.
It organizes its capabilities into three pillars, from the development pipeline to production:
DevSecOps
Security in every phase of development (shift-left): scans and gates that catch issues while code is being written, not at deployment.
CSPM
Misconfiguration is one of the leading causes of cloud incidents. CSPM assesses continuously, alerts on issues, and sums it up in a secure score.
CWPP
Proactive workload protection with Defender plans per resource type. Alerts show the nature and severity of the threat.
- It adds AI security capabilities to discover and protect generative AI applications.
- It's integrated into the Microsoft Defender portal: posture management and threat protection in a single CNAPP experience, without switching tools.
- With Security Copilot, on the recommendations page: understand a recommendation's context and impact, get remediation steps, fix misconfigurations in code, and delegate to the resource owner.
Policies and initiatives
Defender for Cloud's security policies are built on Azure Policy, the governance service that enforces organizational rules on Azure resources.
Azure Policy definition
A rule about a specific security condition. There are many built-in ones and you can create custom ones.
Security initiative
A collection of policy definitions grouped toward a goal, managed as a single item.
Assignment
Applying the definition or initiative to a scope: management group, subscription, resource group, or resource.
Defender for Cloud applies initiatives to your subscriptions; each policy a resource fails becomes a recommendation. Policies → assessment → recommendations → remediation form a continuous cycle that shrinks the attack surface.
Microsoft cloud security benchmark (MCSB)
It's the built-in initiative assigned automatically when you enable Defender for Cloud. Microsoft-authored security and compliance guidelines based on Center for Internet Security (CIS) and NIST controls, with a cloud focus, for Azure and multicloud.
Each MCSB entry includes:
ID and control domain
Network security, data protection, identity management, privileged access, incident response, endpoint security, data recovery…
Mapping to industry frameworks
CIS, NIST, and PCI DSS, useful for regulated industries.
Recommendation
For example, in network security: segmentation, securing traffic, protecting web apps.
Azure, AWS, and GCP guidance
How to implement the control with each cloud's services, and which organizational functions are accountable.
Recommendations and regulatory compliance
Defender for Cloud periodically analyzes your resources' compliance against the chosen initiatives and the MCSB. Each recommendation includes:
- A short description of the issue
- The remediation steps
- The affected resources
- Severity (high, medium, or low) and risk factors
- Attack path context, when available
With Defender CSPM, recommendations are risk-prioritized: a weak setting on an internet-exposed resource holding customer data appears more urgent than the same setting on an isolated internal resource.
Regulatory compliance dashboard
Shows status against the MCSB and any standards you add, such as ISO 27001, SOC 2, NIST SP 800-53, or PCI DSS, control by control. A single fix can improve several standards at once: requiring MFA for privileged accounts helps ISO 27001, NIST, and PCI DSS.
CSPM and secure score
Secure score
Aggregates all findings across your multicloud resources into a single number: higher = less identified risk. Every customer gets it when enabling Defender for Cloud, with the MCSB generating the recommendations behind it.
Hardening recommendations
They're grouped into security controls, each a logical group reflecting an attack surface. The score only goes up when you remediate all recommendations for a resource within a control.
Foundational CSPM · free
Enabled by default on every subscription or account onboarded to Defender for Cloud:
- Asset discovery
- Continuous assessment and hardening recommendations
- Compliance with the MCSB
- Secure score
Defender CSPM plan
An optional plan with advanced posture management:
Attack path analysis
An AI-powered feature that models how an attacker would chain vulnerabilities to reach high-value resources. Example: an internet-exposed VM with a known vulnerability has access to a storage account with sensitive data. The combination is prioritized, not each issue in isolation.
Cloud security explorer
A graph-based query tool to proactively explore the environment and ask your own security questions, without waiting for recommendations to surface.
Governance
Assigns recommendations to resource owners with due dates, so nothing is left without an owner.
Data security posture management (DSPM)
Automatically discovers datastores with sensitive data (personal, financial) across Azure, AWS, and GCP, assesses their posture, and alerts if they're exposed. Available with Defender CSPM or with Defender for Storage.
AI security posture management (AI SPM)
An AI inventory (AI BOM), specific recommendations, and attack paths over generative AI workloads.
More standards
Assessment against many benchmarks, regulatory standards, and custom policies.
Defender plans (CWPP)
Workload protection is delivered through Defender plans specific to each resource type. They're enabled separately and run at the same time to cover compute, data, and services.
Defender for Servers
Threat detection for Windows and Linux; includes Defender for Endpoint (EDR)
Defender for App Service
Attacks against apps on App Service
Defender for Storage
Harmful activity on storage accounts
Defender for Databases
Azure SQL, open-source relational databases, and Cosmos DB
Defender for Containers
Kubernetes and registries: hardening, protection, and runtime detection
Defender for Key Vault
Advanced threat protection for Key Vault
Defender for Resource Manager
Monitors resource management operations
Defender for AI Services
Prompt injection and anomalous usage in Azure AI services
Defender for APIs
Visibility, posture, prioritization, and real-time threats against APIs
Enhanced security features
- Full EDR on servers with Defender for Endpoint
- Vulnerability scanning for VMs, container registries, and SQL resources
- Multicloud (AWS and GCP connectors) and hybrid (a unified view of on-premises and cloud, data from firewalls and partner solutions)
- Threat protection alerts on networks, machines, and services, with contextual intelligence
- Tracking of more compliance standards
- Access and application controls: machine learning-based allow and block lists and just-in-time access to VM management ports, against brute force
DevOps security
Attackers increasingly target development tools. Defender for DevOps, within Defender for Cloud, protects from code to cloud in GitHub, Azure DevOps, and GitLab pipelines from a central console.
Code scanning vulnerabilities
Weaknesses in the application code itself.
Exposed secrets
Credentials, API keys, or other sensitive information in code or configuration.
Open-source vulnerabilities
Known flaws in third-party dependencies.
Infrastructure as code
Assesses IaC templates so misconfigurations don't reach production.
- It prioritizes fixes with pull request annotations and workflows that assign the issue to the developer.
- With Defender CSPM, findings are correlated with cloud risks: a misconfigured network in production is traced back to the template that created it.
- It also applies to AI pipelines: it detects an AI service key committed to the repository or an AI endpoint deployed without authentication.
AI security
AI SPM (posture)
Maintains an AI Bill of Materials with the AI models, apps, and services, assesses their posture, and uses attack paths. Example: an AI app with access to a customer database and reachable from the internet without authentication. Part of the Defender CSPM plan.
AI threat protection
Defender for AI Services, with Microsoft Threat Intelligence and Azure AI Content Safety Prompt Shields, detects prompt injection, data leakage, data poisoning, and credential theft in real time. Alerts flow to Defender XDR.
A data and AI security dashboard centralizes AI resources, their risks, and their protection status.
Exam scenarios
| Need | Answer | Why |
|---|---|---|
| See the security posture of Azure, AWS, and GCP at a glance | Secure score (foundational CSPM) | Free and enabled by default. |
| Know how an attacker would chain issues to reach sensitive data | Attack path analysis | Requires the Defender CSPM plan. |
| Ask your own questions about the environment with graph queries | Cloud security explorer | Requires the Defender CSPM plan. |
| Assign recommendations to owners with a due date | Defender CSPM governance | It gives every fix a clear owner. |
| Detect threats on Windows and Linux VMs with EDR | Defender for Servers | It includes Defender for Endpoint. |
| Detect prompt injection against an Azure OpenAI service | Defender for AI Services | Real-time protection for AI workloads. |
| Find an API key committed to a GitHub repository | Defender for DevOps | Exposed secrets scanning in code. |
| Measure ISO 27001 compliance in addition to the MCSB | Regulatory compliance dashboard | Standards are added to the assessment. |
Common exam traps
❓ Does secure score require a paid plan?
No. It comes with free foundational CSPM along with recommendations and MCSB compliance.
❓ You want to know how an attacker could chain issues to reach a sensitive database. Which feature and plan?
Attack path analysis, included in the Defender CSPM plan, not in the foundational one.
❓ Does Defender for Cloud only protect Azure resources?
No. It covers Azure, AWS, GCP, and on-premises environments.
❓ You fixed two of three recommendations for a VM within a control. Does the score go up?
No. The score only rises when you fix all recommendations for that resource in the control.
❓ Which service are Defender for Cloud's policies built on?
Azure Policy: definitions grouped into initiatives and assigned to a scope.
❓ Are Defender for Cloud and Defender for Cloud Apps the same thing?
No. Defender for Cloud protects cloud infrastructure and workloads (CNAPP); Defender for Cloud Apps protects SaaS apps (CASB).
❓ Which code platforms does Defender for DevOps cover?
GitHub, Azure DevOps, and GitLab.
Did you get this topic?
Test what you just learned
Which standard does Defender for Cloud assign automatically when enabled, and which frameworks is it based on?
Ready to test "Microsoft Defender for Cloud"?
Original questions, each with a full explanation.
Start a mock exam