This chapter covers Microsoft Defender for Cloud, Azure's security posture management and threat protection service. AZ-900 tests this under objective 2.5, as part of the broader identity, access, and security domain.
Jump to a section
A simple way to picture Microsoft Defender for Cloud
Individual locks on individual doors help, but a dedicated security team monitoring the whole building — watching for suspicious activity, flagging unlocked doors, and recommending better locks where needed — provides a different, broader layer of protection. Microsoft Defender for Cloud works similarly for an organization's cloud resources: rather than securing just one resource at a time, it continuously monitors the overall security posture across an organization's resources, flags potential vulnerabilities, and can help detect active threats.
What Microsoft Defender for Cloud is
Microsoft Defender for Cloud is a service that helps organizations strengthen their overall security posture and protect workloads across Azure, other clouds, and on-premises environments. It provides visibility into potential vulnerabilities and can help detect active threats across an organization's resources.
Security posture management
One core function is assessing an organization's current security configuration and providing recommendations to improve it — for example, flagging a resource that's missing a recommended security setting, or highlighting an overly permissive access configuration.
Threat protection
Beyond posture recommendations, Defender for Cloud can also help detect active threats — such as unusual sign-in patterns or suspicious activity on a resource — providing alerts so an organization can respond before a potential issue becomes a larger incident.
Coverage beyond just Azure
Microsoft Defender for Cloud isn't limited to Azure resources alone — it can extend visibility and protection to resources in other clouds and on-premises environments as well, supporting organizations with hybrid or multi-cloud environments.
How it fits with other security concepts
Defender for Cloud works alongside, rather than replacing, other security practices covered in this study guide — like RBAC (controlling who can do what) and Conditional Access (controlling how access is granted) — adding a layer focused specifically on ongoing monitoring and threat detection across the environment as a whole.
Enable Defender for Cloud across relevant resources
Defender for Cloud is enabled to begin assessing the security posture of an organization's resources.
Review security posture recommendations
The service provides recommendations for improving security configuration, which an organization can review and act on.
Monitor for threat detection alerts
Defender for Cloud monitors for suspicious activity and generates alerts when potential threats are detected, allowing a faster response.
Extend coverage where relevant
For organizations with hybrid or multi-cloud environments, Defender for Cloud's coverage can be extended beyond Azure resources alone.
An organization uses Microsoft Defender for Cloud to identify that several virtual machines are missing a recommended security configuration, allowing the security team to remediate the gap before it becomes an actual vulnerability that's exploited.
A separate organization receives a Defender for Cloud alert about unusual sign-in activity on one of its accounts, allowing the security team to investigate and respond quickly — potentially catching a compromised account before significant damage occurs, illustrating the value of ongoing threat monitoring beyond just initial security configuration.
Objective 2.5 expects a general, conceptual understanding of Microsoft Defender for Cloud's role in security posture management and threat protection — implementation-level detail isn't required at this level.
A common wrong answer is assuming Defender for Cloud only covers Azure resources — it can extend to other clouds and on-premises environments too. Another common trap is confusing Defender for Cloud with RBAC or Conditional Access — those control access itself, while Defender for Cloud focuses on ongoing security posture assessment and threat detection across the environment.
Stable terms: Microsoft Defender for Cloud, security posture, threat protection. Recognizing its dual role — posture recommendations and active threat detection — is the core exam-relevant idea.
Memory trick: Defender for Cloud watches the whole environment continuously, both flagging security configuration gaps (posture) and detecting active threats (protection) — not just controlling access at a single point in time like RBAC or Conditional Access do.
Microsoft Defender for Cloud helps organizations strengthen their overall security posture and protect workloads across environments.
It provides two main functions: security posture recommendations and active threat detection.
Defender for Cloud can extend coverage beyond Azure to other clouds and on-premises environments.
It complements, rather than replaces, access-control mechanisms like RBAC and Conditional Access.
These come up on the exam all the time. Here's how to tell them apart.
RBAC / Conditional Access
Controls who can access what, and under what conditions
Applied at the point of access
Focused on granting or restricting access
Microsoft Defender for Cloud
Monitors overall security posture and detects threats
Applied continuously across resources
Focused on visibility, recommendations, and threat detection
Mistake
Microsoft Defender for Cloud only protects Azure resources.
Correct
It can extend visibility and protection to resources in other clouds and on-premises environments as well, supporting hybrid and multi-cloud scenarios, not just Azure alone.
Mistake
Defender for Cloud is the same as RBAC or Conditional Access.
Correct
RBAC and Conditional Access control access itself. Defender for Cloud focuses on ongoing security posture assessment and threat detection across the environment — a different, complementary function.
Mistake
Defender for Cloud only provides recommendations, without detecting active threats.
Correct
It serves two roles — providing security posture recommendations and also detecting active threats, generating alerts for suspicious activity that might indicate an actual security incident.
It's a service that helps organizations strengthen their security posture and protect workloads across Azure, other clouds, and on-premises environments, by providing security recommendations and detecting active threats.
No — it can extend visibility and protection to resources in other clouds and on-premises environments as well, supporting organizations with hybrid or multi-cloud setups, not just Azure-only environments.
RBAC controls who can access specific resources and what they can do. Defender for Cloud focuses on a different function — continuously monitoring the overall security posture of an environment and detecting potential threats, complementing access-control mechanisms like RBAC rather than replacing them.
You've just covered Microsoft Defender for Cloud — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?