azure-defender-for-cloud

name	azure-defender-for-cloud
description	Expert knowledge for Azure Defender For Cloud development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when securing multicloud workloads, tuning alerts, exporting data via API/CLI, or integrating SIEM/ITSM tools, and other Azure Defender For Cloud related development tasks. Not for Azure Defender For Iot (use azure-defender-for-iot), Azure External Attack Surface Management (use azure-external-attack-surface-management), Azure Firewall (use azure-firewall), Azure DDoS Protection (use azure-ddos-protection).
compatibility	Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata	{"generated_at":"2026-08-09","generator":"docs2skills/1.0.0"}

Azure Defender For Cloud Skill

This skill provides expert guidance for Azure Defender For Cloud. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L84	Troubleshooting and interpreting Defender for Cloud alerts, validating detections, fixing deployment/config issues across VMs, SQL, storage, containers, APIs, DNS, AWS/GCP connectors, and integrations.
Best Practices	L85-L102	Guides for investigating and remediating alerts, misconfigurations, and vulnerabilities across VMs, containers, SQL, storage, and endpoints in Defender for Cloud.
Decision Making	L103-L129	Guides for choosing and migrating Defender for Cloud plans/features, estimating and optimizing costs, planning deployments, data residency, secure score, CNAPP, and agent/feature retirements.
Architecture & Design Patterns	L130-L139	Multicloud security architecture for Defender for Cloud: connector auth for AWS/GCP, secure/private connectivity, container protection design, ownership models, and applying Zero Trust.
Limits & Quotas	L140-L149	Limits, quotas, and constraints for Defender for Cloud: data ingestion, portal limitations, alert export caps, free trial limits, extension lifecycles, and storage malware scan capacity.
Security	L150-L198	Configuring Defender for Cloud security: roles/RBAC, permissions, standards, recommendations, exemptions, threat protection, CIEM/CSPM, Kubernetes/containers/storage/compute/Key Vault and data protection.
Configuration	L199-L278	Configuring and tuning Defender for Cloud features: malware and vulnerability scanning, containers/SQL/storage, alerts, exports, DevOps/CI/CD, policies, cross-tenant, and automation settings.
Integrations & Coding Patterns	L279-L316	Integrating Defender for Cloud with tools and platforms (Power BI, XDR, ServiceNow, QRadar/Splunk, AWS/GCP), using APIs/CLI for data export, queries, and automation of security workflows.
Deployment	L317-L341	Deploying and scaling Defender for Cloud plans and sensors (Containers, APIs, SQL, DevOps, GHAS), prerequisites/support matrices, and automation via CLI, PowerShell, ARM/Bicep, and policies.

Troubleshooting

Topic	URL
Interpret and respond to Defender for Cloud AI alerts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads
Interpret Defender for Cloud alerts for Azure App Service	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-app-service
Interpret Defender for Cloud alerts for Azure Cosmos DB	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-cosmos-db
Interpret Defender for Cloud alerts for Azure DDoS Protection	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-ddos-protection
Interpret Defender for Cloud alerts for Azure Key Vault	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-key-vault
Interpret Defender for Cloud alerts for Azure network layer	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer
Interpret Defender for Cloud alerts for Azure Storage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-storage
Interpret Defender for Cloud alerts for Azure VM extensions	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-vm-extensions
Diagnose and simulate Kubernetes alerts in Defender for Containers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-containers
Interpret Defender for Cloud alerts for Defender for APIs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-defender-for-apis
Interpret Defender for Cloud alerts for DNS

Best Practices

Topic	URL
Validate Microsoft Defender for Cloud alert configuration	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation
Review and remediate OS baseline misconfigurations in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/apply-security-baseline
Use binary drift detection to protect container workloads	https://learn.microsoft.com/en-us/azure/defender-for-cloud/binary-drift-detection
Handle false-positive recommendations in Defender for Storage	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-false-positive-recommendations
Investigate and fix Defender for Endpoint misconfiguration findings	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-misconfiguration
Remediate endpoint detection and response gaps in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-response-solution-recommendations
Apply OS misconfiguration recommendations in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/operating-system-misconfiguration
Remediate machine vulnerability findings in Defender for Servers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/remediate-vulnerability-findings-vm
Review and remediate Azure SQL VA findings	https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find
SQL vulnerability assessment rules and guidance	https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-rules

Decision Making

Topic	URL
Understand Defender AI model scanning and licensing implications	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-model-security
Choose between Azure and Defender portals for Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-portal-vs-defender-portal-comparison
Allocate Defender for Cloud costs using Azure Cost Analysis	https://learn.microsoft.com/en-us/azure/defender-for-cloud/chargeback
Select and configure Defender for Cloud plans for GCP projects	https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-google-plans
Estimate Microsoft Defender for Cloud costs with calculator	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cost-calculator
Evaluate and migrate from Defender for Storage classic	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-classic
Migrate from classic to new Defender for Storage plan	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-classic-migrate
Migrate from BYOL VM vulnerability assessment to Defender	https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-byol-vm
Enable Defender for open-source databases on AWS RDS	https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-defender-for-databases-aws
Migrate to updated File Integrity Monitoring in Defender for Servers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/episode-fifty-three

Architecture & Design Patterns

Topic	URL
Understand GCP connector authentication architecture in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/authentication-architecture-google-cloud
Understand AWS connector authentication architecture in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-authentication-architecture-aws
Design secure connectivity with Microsoft Security Private Link for Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-private-links
Review Defender for Containers security architecture and connectivity	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-architecture
Understand Defender for Containers deployment architecture options	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deployment-overview
Apply Zero Trust principles with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/zero-trust

Limits & Quotas

Topic	URL
Understand Defender for Servers data ingestion benefit	https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-ingestion-benefit
Review current limitations in Defender portal	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-portal/known-limitations
Export Defender for Cloud alerts to CSV with limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-alerts-to-csv
Check and understand Defender for Cloud free trial limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/free-trial
Review Defender for Cloud data collection extensions and retirement timelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components
Interpret Defender for Storage malware scan results and capacity limits	https://learn.microsoft.com/en-us/azure/defender-for-cloud/understand-malware-scan-results

Security

Topic	URL
Assign Defender for Cloud recommendations to active users	https://learn.microsoft.com/en-us/azure/defender-for-cloud/active-user
Enable Defender for Cloud threat protection for AI	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-onboarding
Configure container runtime antimalware in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/anti-malware
Assign workload owner access for AWS/GCP connectors	https://learn.microsoft.com/en-us/azure/defender-for-cloud/assign-access-to-workload
Assign regulatory compliance standards in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/assign-regulatory-compliance-standards
Configure unified RBAC cloud scopes in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-scopes-unified-rbac
Trace Defender for Cloud recommendations from code to runtime	https://learn.microsoft.com/en-us/azure/defender-for-cloud/code-to-runtime-mapping
Configure IAM roles for Defender for Containers on AWS and GCP	https://learn.microsoft.com/en-us/azure/defender-for-cloud/containers-permissions
Allow Defender for Cloud export to firewalled Event Hubs	https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export-event-hub-firewall
Create custom security standards and recommendations in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-custom-recommendations
Understand data collection and protection in Defender for Cloud

Configuration

Topic	URL
Advanced configuration and logging for malware scanning	https://learn.microsoft.com/en-us/azure/defender-for-cloud/advanced-configurations-for-malware-scanning
Configure agentless code scanning in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning
Configure agentless malware scanning for Defender for Servers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-malware-scanning
Configure container vulnerability management in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-azure
Onboard Docker Hub registries for Defender vulnerability assessment	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-docker-hub
Configure JFrog Artifactory tenants for agentless vulnerability scanning	https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-vulnerability-assessment-jfrog-artifactory
Understand Defender for Cloud alert schemas	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-schemas
Configure alert suppression rules in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules
Use Azure Monitor Agent with Defender for Cloud servers	https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-azure-monitoring-agent
Build Cloud Security Explorer queries for container vulnerabilities	https://learn.microsoft.com/en-us/azure/defender-for-cloud/cloud-security-explorer-container-vulnerabilities

Integrations & Coding Patterns

Topic	URL
Connect Defender for Cloud data to Power BI	https://learn.microsoft.com/en-us/azure/defender-for-cloud/add-data-power-bi
Query Defender attack path data via Azure Resource Graph API	https://learn.microsoft.com/en-us/azure/defender-for-cloud/attack-path-api
Integrate Defender for Cloud CLI into CI/CD pipelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ci-cd-pipeline-scanning-with-defender-cli
Integrate Defender for Cloud alerts with Microsoft Defender XDR	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-integration-365
Connect a specific partner integration in Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-an-integration
Connect Endor Labs with Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-endor-labs
Integrate Mend.io with Microsoft Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-mend-io
Integrate Defender for Cloud with ServiceNow ITSM	https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-servicenow
Configure Defender for Cloud continuous export via REST API	https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export-rest-api
Automate ServiceNow tickets with Defender governance rules	https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-governance-rule-servicenow
Create and sync ServiceNow tickets from Defender for Cloud	https://learn.microsoft.com/en-us/azure/defender-for-cloud/create-ticket-servicenow

Deployment

Topic	URL
Integrate Defender for Cloud CLI into CI/CD pipelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/ci-cd-pipeline-scanning-with-defender-cli
Review prerequisites and support for Defender data security posture	https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-data-security-posture-prepare
Verify prerequisites for Defender for APIs deployment	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-prepare
Deploy Defender for Containers sensor and policy using Azure CLI	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deploy-azure-cli
Plan Defender for Containers deployment across Kubernetes environments	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deployment-planning
Deploy Defender for Containers to private Kubernetes clusters	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-private-clusters
Migrate Defender for SQL on Machines to Azure Monitoring Agent	https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-autoprovisioning
Install Defender for Containers sensor using Helm charts	https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-helm
Check support and prerequisites for Defender DevOps security	https://learn.microsoft.com/en-us/azure/defender-for-cloud/devops-support
Integrate Defender for Cloud CLI into CI/CD pipelines	https://learn.microsoft.com/en-us/azure/defender-for-cloud/episode-fifty-nine