This skill instructs security practitioners on deploying Microsoft Defender for Cloud as a cloud-native application protection platform for Azure, multi-cloud, and hybrid environments. It covers enabling Defender plans for servers, containers, storage, and databases, configuring security recommendations, managing Secure Score, and integrating with the unified Defender portal for centralized threat management.
This skill instructs security practitioners on deploying Microsoft Defender for Cloud as a cloud-native application protection platform for Azure, multi-cloud, and hybrid environments. It covers enabling Defender plans for servers, containers, storage, and databases, configuring security recommendations, managing Secure Score, and integrating with the unified Defender portal for centralized threat management.
When deploying cloud workload protection across Azure subscriptions and resource groups
When establishing a Secure Score baseline and prioritizing security recommendations
When extending threat protection to multi-cloud environments including AWS and GCP
When enabling container security for AKS clusters and Azure Container Registry
When integrating AI workload security with the Data and AI security dashboard
Do not use for AWS-only environments (see implementing-aws-security-hub), for identity provider configuration (see managing-cloud-identity-with-okta), or for network-level firewall rule management (see implementing-cloud-waf-rules).
Common Misconfigurations & Verification
Plan enabled on one subscription only: Defender plans don't auto-cover sibling or newly created subscriptions. Enable at the management-group level via Azure Policy, then verify each with az security pricing list --query "[?pricingTier=='Standard']".
Wrong subplan:az security pricing create --name VirtualMachines --tier Standard without --subplan P2 leaves out vulnerability assessment/EDR. Confirm subPlan in the pricing list, not just the tier.
Storage malware scanning needs the extension: the plan alone doesn't scan - OnUploadMalwareScanning must be isEnabled: True (with a per-account cap). Verify in the pricing config.
Connector "connected" but ingesting nothing: AWS/GCP connectors require the remote IAM role (cloudRoleArn) actually deployed. Check connector health, not just existence.
Unmonitored assets inflate Secure Score: if AMA/Log Analytics auto-provisioning is off, servers report no findings and the score looks better than reality. Confirm agent coverage.
JIT only protects listed ports and only when Defender manages the NSG; an unlisted port stays open.
Verify it actually works: trigger a benign Defender sample alert and confirm it reaches the configured az security contact email / Logic App; confirm attack-path queries return data (requires the Defender CSPM plan + agentless scanning on); and after a JIT policy, confirm the port is denied by default and only opens after az security jit-policy initiate.
Prerequisites
Azure subscription with Security Admin or Contributor role
Azure Policy initiative for Defender for Cloud enabled at the management group level
Log Analytics workspace provisioned for security data collection
Microsoft Defender for Cloud plans licensed (P1 or P2 for server protection)
Workflow
Step 1: Enable Defender for Cloud Plans
Activate Defender plans for each workload type: Servers, Containers, App Service, Storage, Databases, Key Vault, Resource Manager, and DNS. Each plan provides specialized threat detection and vulnerability assessment.
# Enable Defender for Servers Plan 2
az security pricing create --name VirtualMachines --tier Standard --subplan P2
# Enable Defender for Containers
az security pricing create --name Containers --tier Standard
# Enable Defender for Storage with malware scanning
az security pricing create --name StorageAccounts --tier Standard \
--extensions '[{"name":"OnUploadMalwareScanning","isEnabled":"True",
"additionalExtensionProperties":{"CapGBPerMonthPerStorageAccount":"5000"}}]'
# Enable Defender for Databases
az security pricing create --name SqlServers --tier Standard
az security pricing create --name CosmosDbs --tier Standard
# Enable Defender for Key Vault
az security pricing create --name KeyVaults --tier Standard
# Verify all enabled plans
az security pricing list --query "[?pricingTier=='Standard'].{Plan:name, Tier:pricingTier, SubPlan:subPlan}" -o table
Step 2: Configure Environment Connectors for Multi-Cloud
Connect AWS accounts and GCP projects to Defender for Cloud for unified security posture management across cloud providers.
Step 3: Review and Prioritize Secure Score Recommendations
Analyze the Secure Score across all subscriptions. Each recommendation includes a risk priority based on asset exposure, internet exposure, and threat intelligence context.
# Get current Secure Score
az security secure-score list \
--query "[].{Name:displayName, Score:current, Max:max, Percentage:percentage}" -o table
# List unhealthy recommendations sorted by severity
az security assessment list \
--query "[?properties.status.code=='Unhealthy'].{Name:properties.displayName, Severity:properties.metadata.severity, Resources:properties.resourceDetails.id}" \
--output table
# Get specific recommendation details
az security assessment show \
--assessment-name "4fb67663-9ab9-475d-b026-8c544cced439" \
--query "{Name:properties.displayName, Description:properties.metadata.description, Remediation:properties.metadata.remediationDescription}"
Step 4: Configure Adaptive Application Controls and JIT Access
Enable Just-In-Time VM access to reduce the attack surface by opening management ports only when needed, and deploy adaptive application controls to whitelist approved executables.
Step 5: Set Up Security Alerts and Workflow Automation
Configure workflow automation to trigger Logic Apps or Azure Functions when security alerts are generated. Set up email notifications for Critical and High severity alerts.
Step 6: Enable Cloud Security Graph and Attack Path Analysis
Use the cloud security graph to visualize attack paths that adversaries could exploit to reach critical assets. Prioritize remediation based on actual exploitability rather than individual finding severity.
# Query attack paths via Resource Graph
az graph query -q "
securityresources
| where type == 'microsoft.security/attackpaths'
| extend riskLevel = properties.riskLevel
| extend entryPoint = properties.attackPathDisplayName
| where riskLevel == 'Critical'
| project entryPoint, riskLevel, properties.description
| limit 20
"
Key Concepts
Term
Definition
Secure Score
A numerical measure of an organization's security posture based on the percentage of implemented security recommendations, scored per subscription and aggregated at the management group level
Cloud Security Graph
A graph database mapping relationships between cloud resources, identities, network exposure, and vulnerabilities to identify exploitable attack paths
Attack Path Analysis
Visualization of multi-step attack chains an adversary could follow from an entry point to a high-value target, prioritized by real-world exploitability
Just-In-Time Access
Security control that blocks management ports by default and opens them temporarily upon approved request, reducing the VM attack surface
Adaptive Application Controls
Machine-learning-based allowlisting that recommends which applications should run on VMs and alerts on deviations
Defender CSPM
Enhanced cloud security posture management plan providing agentless scanning, attack path analysis, and cloud security graph capabilities
Security Connector
Integration point connecting AWS or GCP environments to Defender for Cloud for multi-cloud posture management
Tools & Systems
Microsoft Defender for Cloud: Core CNAPP platform providing CSPM, CWP, and threat protection across Azure, AWS, and GCP
Azure Resource Graph: Query engine for exploring cloud security graph data and attack paths at scale
Azure Logic Apps: Workflow automation platform for building remediation playbooks triggered by Defender alerts
Microsoft Defender Portal: Unified security operations console integrating Defender for Cloud with XDR, Sentinel, and threat intelligence
Azure Policy: Governance engine for enforcing Defender for Cloud recommendations as compliance requirements
Common Scenarios
Scenario: Internet-Exposed SQL Server with Known Vulnerability
Context: Defender for Cloud identifies an Azure SQL Server with a public endpoint, an unpatched critical CVE, and a service principal with database owner permissions that also has access to a Key Vault containing production encryption keys.
Approach:
Review the attack path in the cloud security graph showing: Internet -> SQL Server (CVE) -> Service Principal -> Key Vault
Immediately restrict the SQL Server firewall to private endpoints only
Apply the SQL Server security patch through Azure Update Management
Rotate the service principal credentials and scope its permissions to only the required database operations
Add a Key Vault access policy requiring the service principal to authenticate via managed identity rather than secret-based credentials
Verify the attack path is resolved in Defender CSPM within 24 hours
Pitfalls: Focusing on the SQL vulnerability alone misses the lateral movement path to Key Vault. Restricting the endpoint without updating application connection strings causes an outage.
