azure-defender-for-cloud

name	azure-defender-for-cloud
description	Expert knowledge for Azure Defender For Cloud development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when securing Azure VMs, AKS/containers, SQL/storage, multi-cloud connectors, or Defender for DevOps APIs, and other Azure Defender For Cloud related development tasks. Not for Azure Defender For Iot (use azure-defender-for-iot), Azure DDos Protection (use azure-ddos-protection), Azure External Attack Surface Management (use azure-external-attack-surface-management), Azure Security (use azure-security).
compatibility	Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata	{"generated_at":"2026-04-19","generator":"docs2skills/1.0.0"}

Azure Defender For Cloud Skill

This skill provides expert guidance for Azure Defender For Cloud. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L65	Diagnosing and fixing Defender for Cloud issues: alert validation/interpretation, connector/onboarding problems (AWS/GCP/APIs/SQL/K8s), deployment gaps, malware/vuln handling, and incident references.
Best Practices	L66-L85	Best practices for investigating and remediating vulnerabilities, misconfigurations, secrets, and API/endpoint/Kubernetes risks across Defender for Cloud, AKS, registries, and CI/CD.
Decision Making	L86-L104	Guidance for choosing and planning Defender for Cloud plans, pricing, portals, agents, regional availability, and migration/transition paths for servers, containers, storage, and GCP.
Architecture & Design Patterns	L105-L114	Architectural guidance for Defender for Servers/Containers: agentless scanning, malware/vuln detection on VMs/Kubernetes, data collection, residency, workspaces, and large-scale deployment.
Limits & Quotas	L115-L124	Limits, quotas, and prerequisites for Defender for Cloud features: free trials, data ingestion, APIs, DevOps, portal preview, alert export limits, and data collection extension changes.
Security	L125-L199	Security alerts, permissions, and hardening for Defender for Cloud: configuring protections, interpreting alerts/recommendations, RBAC/CIEM, data handling, and securing SQL, storage, containers, VMs, APIs, and Kubernetes.
Configuration	L200-L267	Configuring Defender for Cloud features: onboarding, policies, exemptions, scanning (agentless, containers, SQL, storage, DevOps), alerts, exports, private links, and data security posture.
Integrations & Coding Patterns	L268-L297	Integrating Defender for Cloud with CI/CD, SIEM, EDR, ITSM, APIs, and multi-cloud logs, plus querying/exporting security data and automating tickets and container/AKS scans
Deployment	L298-L325	Deploying and managing Defender for Cloud plans and agents (Containers, SQL, Storage) across AKS/EKS/GKE and servers using portal, CLI, IaC, policies, APIs, and reviewing support/regions.

Troubleshooting

Topic	URL
Validate Defender for Cloud alert generation and coverage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation
Interpret and respond to Defender for Cloud AI alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads
Trigger and validate Defender for APIs alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-validation
Verify Defender for Containers deployment on EKS	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-aws-verify
Verify Defender for Containers deployment on AKS	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-azure-verify
Verify Defender for Containers deployment on GKE	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-gcp-verify
Respond to Microsoft Defender for DNS security alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns-alerts
Investigate and respond to Defender for Resource Manager alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-usage
Reference deprecated Defender for Cloud alert IDs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/deprecated-alerts
Remediate Defender for Cloud endpoint detection gaps	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-response-solution-recommendations

Best Practices

Topic	URL
Apply agentless vulnerability assessment for containers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-azure
Review OS misconfiguration recommendations against MCSB baselines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/apply-security-baseline
Review CI/CD scan results in Cloud Security Explorer	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-cli-reviewing-results
Investigate API security findings and posture in Defender for APIs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-posture
Remediate system update and patch recommendations in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-periodic-system-updates
Investigate Defender for Endpoint misconfiguration recommendations	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-misconfiguration
Remediate endpoint detection and response gaps in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-response-solution-recommendations
Apply Defender networking recommendations for Azure	https://learn.microsoft.com/en-us/azure/defender-for-cloud/protect-network-resources
Remediate cloud deployment secrets in Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/remediate-cloud-deployment-secrets
Remediate machine secrets findings in Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/remediate-server-secrets

Decision Making

Topic	URL
Understand Defender for Servers vulnerability scanning options	https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment
Choose between Azure and Defender portals for Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-portal-vs-defender-portal-comparison
Allocate Defender for Cloud costs via chargeback	https://learn.microsoft.com/en-us/azure/defender-for-cloud/chargeback
Select and configure Defender for Cloud plans for GCP	https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-google-plans
Estimate Defender for Cloud costs with calculator	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cost-calculator
Choose Defender for Containers deployment options	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deployment-overview
Decide between Defender for Storage classic and new plan	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-classic
Migrate from Defender for Storage classic to new plan	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-classic-migrate
Use BYOL vulnerability assessment with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-byol-vm
Choose the right Defender for Servers plan	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan

Architecture & Design Patterns

Topic	URL
Use agentless malware scanning for virtual machines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-malware-scanning
Understand Defender for Containers security architecture	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-architecture
Design a Defender for Servers deployment architecture	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
Understand Defender for Servers data collection design	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-agents
Plan Defender for Servers data residency and workspaces	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-data-workspace
Scale Microsoft Defender for Servers across environments	https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-scale

Limits & Quotas

Topic	URL
Use Defender for Servers data ingestion benefit and free quota	https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-ingestion-benefit
Understand current limitations of Defender portal preview	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-portal/known-limitations
Review support scope and prerequisites for DevOps security	https://learn.microsoft.com/en-us/azure/defender-for-cloud/devops-support
Export Defender for Cloud alerts to CSV with limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-alerts-to-csv
Check and understand Defender for Cloud free trial limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/free-trial
Understand Defender data collection extensions and retirement	https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components

Security

Topic	URL
Configure and use Defender for Cloud AI model security	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-model-security
Understand Defender for Cloud alerts for Azure App Service	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-app-service
Understand Defender for Cloud alerts for Azure Cosmos DB	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-cosmos-db
Understand Defender for Cloud alerts for Azure DDoS Protection	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-ddos-protection
Understand Defender for Cloud alerts for Azure Key Vault	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-key-vault
Understand Defender for Cloud alerts for Azure network layer	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer
Understand Defender for Cloud alerts for Azure Storage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-storage
Understand Defender for Cloud alerts for Azure VM extensions	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-vm-extensions
Understand Defender for Containers and Kubernetes alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-containers
Understand Defender for Cloud alerts for Defender for APIs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-defender-for-apis
Understand Defender for Cloud alerts for DNS

Configuration

Topic	URL
Configure advanced malware scanning for Defender for Storage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/advanced-configurations-for-malware-scanning
Configure agentless code scanning in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning
Configure Docker Hub vulnerability assessments with Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-docker-hub
Configure JFrog Artifactory vulnerability assessments with Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-jfrog-artifactory
Enable Defender threat protection for Azure AI services	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-onboarding
Use Defender for Cloud alert schemas for integrations	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-schemas
Configure Azure Monitor Agent for Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-azure-monitoring-agent
Review prerequisites for data security posture	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-data-security-posture-prepare
Configure Microsoft Security Private Link for Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-private-links
Configure Microsoft Security DevOps extension in Azure DevOps	https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-azure-devops-extension

Integrations & Coding Patterns

Topic	URL
Connect Defender for Cloud data to Power BI	https://learn.microsoft.com/en-us/azure/defender-for-cloud/add-data-power-bi
Query Defender attack path data via ARG API	https://learn.microsoft.com/en-us/azure/defender-for-cloud/attack-path-api
Integrate Defender for Cloud CLI into CI/CD pipelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ci-cd-pipeline-scanning-with-defender-cli
Author Cloud Security Explorer queries for AKS vulnerabilities	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-security-explorer-kubernetes-clusters
Connect Endor Labs with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-endor-labs
Connect Mend.io with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-mend-io
Connect ServiceNow ITSM with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-servicenow
Set up Defender for Cloud continuous export via REST API	https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export-rest-api
Automate ServiceNow tickets with governance rules	https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-governance-rule-servicenow
Create and sync ServiceNow tickets from Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-ticket-servicenow
Use Defender for Cloud CLI to scan container images	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-cli-syntax

Deployment

Topic	URL
Integrate Defender for Cloud CLI into CI/CD pipelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ci-cd-pipeline-scanning-with-defender-cli
Enable Defender for Containers on EKS via portal	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-aws-enable-portal
Programmatically deploy Defender for Containers on EKS	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-aws-enable-programmatically
Remove Defender for Containers from EKS clusters	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-aws-remove
Remove Defender for Containers from AKS clusters	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-azure-remove
Enable Defender for Containers on GKE via portal	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-gcp-enable-portal
Programmatically deploy Defender for Containers on GKE	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-gcp-enable-programmatically
Remove Defender for Containers from GKE clusters	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-gcp-remove
Migrate Defender for SQL to AMA autoprovisioning	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-autoprovisioning
Enable Defender for SQL Servers on Machines across environments	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-usage