Microsoft Defender for Cloud

Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that provides unified security management across your Azure, on-premises, and other cloud environments (like AWS and GCP). The core business problem it solves is the complexity and fragmentation of securing modern IT environments. Without it, security teams must manually check configurations, monitor logs from multiple sources, and respond to threats reactively. Defender for Cloud automates this by continuously assessing your resources, identifying misconfigurations, detecting threats, and providing prioritized recommendations.

For AZ-900, you need to understand that Defender for Cloud is not a single product but a suite of capabilities. It includes two main components: (1) Cloud Security Posture Management (CSPM) – free features that give you a secure score and recommendations based on security best practices (like Azure Security Benchmark). (2) Cloud Workload Protection (CWP) – paid features (Microsoft Defender for Cloud plans) that provide advanced threat protection for specific workloads like servers, databases, storage, and containers.

- Defender for Servers: ~$15/server/month - Defender for SQL: ~$15/SQL server/month - Defender for Storage: ~$10/storage account/month (per GB of data processed) - Defender for App Service: ~$30/App Service plan/month - Defender for Containers: ~$30/core/month (AKS clusters) - Defender for Key Vault: ~$0.01/10k transactions - Regulatory Compliance Dashboard: Available in both free and paid tiers, but the number of standards you can monitor is limited in free (up to 10). Paid plans allow unlimited standards (e.g., SOC 2, ISO 27001, NIST, PCI DSS). - Security Alerts: Only generated when a Defender plan is enabled. Alerts include details like affected resources, attack type, and recommended steps. - Workload Protections Dashboard: Shows the security status of each workload type (VMs, SQL, Storage, etc.).

In an on-premises environment, security posture management typically requires multiple tools: vulnerability scanners (e.g., Nessus), configuration management (e.g., SCCM), SIEM (e.g., Splunk), and manual audits. Defender for Cloud replaces all of these with a single, cloud-native service. It also provides continuous monitoring (not periodic scans) and integrates with Azure policies and automation. For hybrid environments, you can extend Defender for Cloud to on-premises servers by installing the Azure Arc agent and enabling Defender for Servers. This gives you the same CSPM and threat detection capabilities for your on-premises VMs.

- Azure Portal: Navigate to 'Microsoft Defender for Cloud' (or search for it). The main dashboard shows Secure Score, regulatory compliance, inventory, and alerts. You can drill down into recommendations, enable plans, and configure policies. - Azure CLI: Use the az security command group. For example: - az security secure-score list – get secure scores - az security alert list – list alerts - az security auto-provisioning-setting update --name default --auto-provision on – enable Log Analytics agent auto-provisioning - Azure PowerShell: Use Get-AzSecurity* cmdlets, e.g., Get-AzSecuritySecureScore. - ARM/Bicep: You can enable Defender plans programmatically using resource provider 'Microsoft.Security'. Example Bicep snippet:

resource defenderPlan 'Microsoft.Security/pricings@2023-01-01' = {
    name: 'VirtualMachines'
    properties: {
      pricingTier: 'Standard'
    }
  }

Problem: An e-commerce company runs its web application on Azure VMs and also has legacy on-premises servers for database processing. They need unified security visibility and threat detection across both environments. Solution: They enable Defender for Cloud for their Azure subscription and install Azure Arc on their on-premises servers. Then they enable Defender for Servers plan (paid) for all VMs (both Azure and on-premises). Defender for Cloud now provides a single dashboard showing secure score, recommendations, and alerts for all servers. They configure JIT VM access to reduce exposure of management ports. The security team receives alerts for suspicious logins and potential malware. Over time, they remediate recommendations and improve their secure score from 40% to 85%. Cost: Approximately $15/server/month for Defender for Servers. For 50 servers, that's $750/month. What goes wrong: If they forget to enable the Defender plan for on-premises servers, those servers won't generate alerts. Also, if they don't install the Log Analytics agent properly, data won't be collected. Incorrect configuration of JIT can block legitimate admin access if not whitelisted correctly.

Problem: A bank must comply with PCI DSS and SOC 2 for its Azure-hosted payment processing system. Manual compliance audits are time-consuming and error-prone. Solution: They enable Defender for Cloud and configure the regulatory compliance dashboard with PCI DSS and SOC 2 standards. They assign a dedicated security team to review the dashboard weekly. They remediate all critical and high-severity recommendations that affect compliance. For example, they enable encryption on all storage accounts and SQL databases. They also enable Defender for SQL to detect SQL injection attempts. The compliance dashboard shows a 95% compliance score for PCI DSS, which satisfies auditors. Cost: Free CSPM tier covers up to 10 compliance standards; they use paid plans only for SQL and storage protection (approx. $200/month). What goes wrong: If they don't regularly update the compliance dashboard, new resources might be non-compliant. Also, if they rely solely on the dashboard without remediating recommendations, the score will drop.

Problem: A startup deploys microservices on Azure Kubernetes Service (AKS) and wants to secure container workloads without a dedicated security team. Solution: They enable Defender for Containers plan (paid) on their AKS cluster. Defender for Cloud scans container images for vulnerabilities, monitors runtime behavior for threats, and provides recommendations like 'Container should not run as root' or 'Limit container capabilities'. They also enable the free CSPM to get a secure score for their subscription. The security alerts help them detect cryptominers or unauthorized container access. Cost: Defender for Containers is priced per core per hour. For a small cluster with 10 cores, it might be ~$300/month. What goes wrong: If they don't enable the plan for all AKS clusters, some clusters remain unprotected. Also, if they don't regularly update container images, vulnerability scans might miss new CVEs.