Academmia

Microsoft Defender for Cloud: improve security posture and detect threats

az-900•beginner•

Azure architecture and services

Microsoft Defender for Cloud: improve security posture and detect threats

Short Summary

Microsoft Defender for Cloud helps you improve your cloud security posture and protect workloads from threats. It gives you recommendations to reduce risk (for example, by fixing insecure configurations) and security alerts when suspicious activity is detected. It can also cover hybrid and multi-cloud environments when you connect them.

Learning Objectives

By the end of this lesson, you will be able to:

  • Define what Microsoft Defender for Cloud does at a high level.
  • Differentiate security posture management from workload threat protection.
  • Interpret the difference between a security recommendation and a security alert.
  • Describe how Defender for Cloud can extend to hybrid and multi-cloud resources when they’re onboarded.
  • Compare Defender for Cloud with a log-and-incident platform like Microsoft Sentinel.

Core Concepts

Microsoft Defender for Cloud is a cloud-native security service that combines two big ideas:

  1. Improve posture (reduce risk before an attack)
  2. Detect threats (spot and alert on suspicious activity during runtime)

A simple way to keep it straight:

  • Recommendations help you harden your environment.
  • Alerts help you respond to potential attacks.

Cloud Security Posture Management (CSPM)

Cloud Security Posture Management (CSPM) is the “posture” side of Defender for Cloud. It focuses on:

  • continuously assessing your environment,
  • identifying misconfigurations or risky settings,
  • producing prioritized security recommendations you can act on.

Think of CSPM as: “What should I fix to lower my risk?”

Cloud Workload Protection Platform (CWPP)

Cloud Workload Protection Platform (CWPP) is the “protect workloads” side of Defender for Cloud. It focuses on:

  • monitoring workloads (for example, virtual machines, containers, storage, and databases),
  • detecting suspicious behavior,
  • generating security alerts when threats are identified.

Think of CWPP as: “What might be actively attacking or compromising my workloads right now?”

Hybrid and multi-cloud coverage

Defender for Cloud can cover more than Azure-only resources, but you must connect/onboard non-Azure environments. For example:

  • On-premises or other-cloud servers typically appear after you onboard them (commonly via Azure Arc-enabled onboarding paths).
  • AWS/GCP environments require a connection step before Defender for Cloud can assess and protect them.

A key mindset: Defender for Cloud doesn’t “automatically see everything everywhere” unless you connect it.

Practical Understanding

Practical Situation 1: When you see “recommendations,” think posture management

A team wants to reduce risk caused by insecure configurations (for example, resources that are not configured securely). They want an ongoing view of what needs improvement.

How to think about it: That’s the CSPM side of Defender for Cloud: continuous assessment plus security recommendations.

Common misunderstanding: “This is just a one-time security audit.” Posture management is meant to be continuous.

Practical Situation 2: When you see “security alerts,” think workload protection

A security team wants to be notified when suspicious behavior happens across workloads so they can investigate and respond.

How to think about it: That’s the CWPP side of Defender for Cloud: threat detections generate security alerts tied to workloads.

Common misunderstanding: “Alerts are the same thing as recommendations.” Recommendations help you reduce risk; alerts indicate a possible active threat.

Practical Situation 3: When you see “Azure + on-prem + another cloud,” think “connect and onboard”

A company runs workloads in Azure, has on-premises servers, and also uses AWS or GCP. They want one view instead of multiple separate tools.

How to think about it: Defender for Cloud can cover hybrid and multi-cloud, but non-Azure resources must be connected/onboarded before they show up and can be assessed.

Common misunderstanding: “Defender for Cloud automatically covers all clouds the moment I turn it on.” Coverage beyond Azure requires onboarding/connection steps.

Practical Situation 4: When comparing products, separate “posture + workload protection” from “log analytics + incidents”

A team compares Microsoft security services and notices some overlap in terminology.

How to think about it: Defender for Cloud focuses on posture (CSPM) and workload protection (CWPP) for cloud resources. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that centralizes logs/signals for detection, investigation, and response workflows. They can complement each other, but they don’t have the same primary job.

Common misunderstanding: “If both tools are about security, they’re interchangeable.” They solve different problems at different layers.

Common Pitfalls

  • Mistake: Treating Defender for Cloud as “endpoint antivirus in Azure.” Correction: Defender for Cloud focuses on cloud posture (recommendations) and workload threat protection (alerts).

  • Mistake: Assuming Defender for Cloud is Azure-only. Correction: It can cover hybrid and multi-cloud environments when those resources are connected/onboarded.

  • Mistake: Believing that enabling Defender for Cloud automatically fixes all security issues. Correction: It surfaces recommendations and alerts; you still need to remediate and respond.

  • Mistake: Mixing up recommendations and alerts. Correction: Recommendations are posture improvements; alerts are threat notifications.

  • Mistake: Confusing Defender for Cloud with Microsoft Sentinel. Correction: Defender for Cloud is posture + workload protection; Sentinel is SIEM (log centralization, analytics, investigation, response).

Check Your Understanding

  1. In your own words, explain the difference between a security recommendation and a security alert.
  2. Describe a posture management example where fixing a recommendation reduces risk even when no attack is happening.
  3. Describe a workload protection example where an alert helps you respond faster to a possible compromise.
  4. Name two environments outside Azure that Defender for Cloud can help cover, and explain what must happen before they appear in Defender for Cloud.
  5. Explain (briefly) how Defender for Cloud and Microsoft Sentinel can work together without being the same thing.

Further Reading